Merge branch 'main' into ENG-4021

.github/workflows/release-standalone-docker-img-postgres-offical.yml

@@ -135,10 +135,10 @@ jobs:
             TAG_NAME="${{ github.ref_name }}"
             echo "Checking for tag: $TAG_NAME"
 
-            EXACT_MATCH=$(gh api repos/Infisical/infisical-omnibus/git/refs/tags/$TAG_NAME | jq -r 'if type == "array" then .[].ref else .ref end' | grep -x "refs/tags/$TAG_NAME")
+            EXACT_MATCH=$(gh api repos/Infisical/infisical-omnibus/git/refs/tags/$TAG_NAME 2>/dev/null | jq -r 'if type == "array" then .[].ref else .ref end' | grep -x "refs/tags/$TAG_NAME" || true)
 
             if [ "$EXACT_MATCH" == "refs/tags/$TAG_NAME" ]; then
-            echo "Tag $TAG_NAME already exists, skipping..."
+              echo "Tag $TAG_NAME already exists, skipping..."
             else
               echo "Creating tag in Infisical/infisical-omnibus: $TAG_NAME"
               LATEST_SHA=$(gh api repos/Infisical/infisical-omnibus/git/refs/heads/main --jq '.object.sha')

.github/workflows/release_helm_gateway.yaml

@@ -24,6 +24,8 @@ jobs:
 
       - name: Set up chart-testing
         uses: helm/[email protected]
+        with:
+          yamale_version: "6.0.0"
 
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --charts helm-charts/infisical-gateway

.github/workflows/run-helm-chart-tests-infisical-gateway.yml

@@ -27,6 +27,8 @@ jobs:
 
       - name: Set up chart-testing
         uses: helm/[email protected]
+        with:
+          yamale_version: "6.0.0"
 
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --charts helm-charts/infisical-gateway

backend/package.json

@@ -40,10 +40,10 @@
     "type:check": "node --max-old-space-size=8192 ./node_modules/.bin/tsc --noEmit",
     "lint:fix": "node --max-old-space-size=8192 ./node_modules/.bin/eslint --fix --ext js,ts ./src",
     "lint": "node --max-old-space-size=8192 ./node_modules/.bin/eslint 'src/**/*.ts'",
-    "test:unit": "vitest run -c vitest.unit.config.ts",
-    "test:e2e": "vitest run -c vitest.e2e.config.ts --bail=1",
-    "test:e2e-watch": "vitest -c vitest.e2e.config.ts --bail=1",
-    "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.ts",
+    "test:unit": "vitest run -c vitest.unit.config.mts",
+    "test:e2e": "vitest run -c vitest.e2e.config.mts --bail=1",
+    "test:e2e-watch": "vitest -c vitest.e2e.config.mts --bail=1",
+    "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.mts",
     "generate:component": "tsx ./scripts/create-backend-file.ts",
     "generate:schema": "tsx ./scripts/generate-schema-types.ts && eslint --fix --ext ts ./src/db/schemas",
     "auditlog-migration:latest": "node ./dist/db/rename-migrations-to-mjs.mjs && knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:latest",
@@ -98,7 +98,7 @@
     "@types/jsrp": "^0.2.6",
     "@types/libsodium-wrappers": "^0.7.13",
     "@types/lodash.isequal": "^4.5.8",
-    "@types/node": "^20.17.30",
+    "@types/node": "^20.19.0",
     "@types/nodemailer": "^6.4.14",
     "@types/passport-google-oauth20": "^2.0.14",
     "@types/pg": "^8.10.9",
@@ -130,10 +130,10 @@
     "ts-node": "^10.9.2",
     "tsc-alias": "^1.8.8",
     "tsconfig-paths": "^4.2.0",
-    "tsup": "^8.0.1",
+    "tsup": "^8.5.0",
     "tsx": "^4.4.0",
     "typescript": "^5.3.2",
-    "vitest": "^1.2.2"
+    "vitest": "^3.0.6"
   },
   "dependencies": {
     "@aws-sdk/client-elasticache": "^3.637.0",

backend/src/@types/fastify.d.ts

@@ -135,9 +135,23 @@ import { TWorkflowIntegrationServiceFactory } from "@app/services/workflow-integ
 declare module "@fastify/request-context" {
   interface RequestContextData {
     reqId: string;
+    ip?: string;
+    userAgent?: string;
     orgId?: string;
+    orgName?: string;
+    userAuthInfo?: {
+      userId: string;
+      email: string;
+    };
+    projectDetails?: {
+      id: string;
+      name: string;
+      slug: string;
+    };
     identityAuthInfo?: {
       identityId: string;
+      identityName: string;
+      authMethod: string;
       oidc?: {
         claims: Record<string, string>;
       };

backend/src/@types/knex.d.ts

@@ -62,6 +62,9 @@ import {
   TCertificateSecretsUpdate,
   TCertificatesInsert,
   TCertificatesUpdate,
+  TCertificateSyncs,
+  TCertificateSyncsInsert,
+  TCertificateSyncsUpdate,
   TCertificateTemplateEstConfigs,
   TCertificateTemplateEstConfigsInsert,
   TCertificateTemplateEstConfigsUpdate,
@@ -738,6 +741,11 @@ declare module "knex/types/tables" {
       TPkiSubscribersUpdate
     >;
     [TableName.PkiSync]: KnexOriginal.CompositeTableType<TPkiSyncs, TPkiSyncsInsert, TPkiSyncsUpdate>;
+    [TableName.CertificateSync]: KnexOriginal.CompositeTableType<
+      TCertificateSyncs,
+      TCertificateSyncsInsert,
+      TCertificateSyncsUpdate
+    >;
     [TableName.UserGroupMembership]: KnexOriginal.CompositeTableType<
       TUserGroupMembership,
       TUserGroupMembershipInsert,

backend/src/db/migrations/20251018061215_sub-org.ts

@@ -2,7 +2,7 @@ import { Knex } from "knex";
 
 import { dropConstraintIfExists } from "@app/db/migrations/utils/dropConstraintIfExists";
 
-import { AccessScope, TableName } from "../schemas";
+import { TableName } from "../schemas";
 
 export async function up(knex: Knex): Promise<void> {
   const hasParentOrgId = await knex.schema.hasColumn(TableName.Organization, "parentOrgId");
@@ -18,8 +18,6 @@ export async function up(knex: Knex): Promise<void> {
       await dropConstraintIfExists(TableName.Organization, "organizations_slug_unique", knex);
       t.unique(["rootOrgId", "parentOrgId", "slug"]);
     });
-
-    // had to switch to raw for null not distinct
   }
 
   const hasIdentityOrgCol = await knex.schema.hasColumn(TableName.Identity, "orgId");
@@ -28,24 +26,6 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("orgId");
       t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
     });
-
-    await knex.raw(
-      `
-  UPDATE ?? AS identity
-  SET "orgId" = membership."scopeOrgId"
-  FROM ?? AS membership
-  WHERE 
-    membership."actorIdentityId" = identity."id"
-    AND membership."scope" = ?
-`,
-      [TableName.Identity, TableName.Membership, AccessScope.Organization]
-    );
-
-    await knex.raw(`DELETE FROM ?? WHERE "orgId" IS NULL`, [TableName.Identity]);
-
-    await knex.schema.alterTable(TableName.Identity, (t) => {
-      t.uuid("orgId").notNullable().alter();
-    });
   }
 }
 

backend/src/db/migrations/20251019061215_sub-org-identity-backfill.ts

@@ -0,0 +1,48 @@
+import { Knex } from "knex";
+
+import { chunkArray } from "@app/lib/fn";
+
+import { AccessScope, TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.transaction(async (tx) => {
+    const hasIdentityOrgCol = await tx.schema.hasColumn(TableName.Identity, "orgId");
+    if (hasIdentityOrgCol) {
+      const identityMemberships = await tx(TableName.Membership)
+        .where({
+          scope: AccessScope.Organization
+        })
+        .whereNotNull("actorIdentityId")
+        .select("actorIdentityId", "scopeOrgId");
+
+      const identityToOrgMapping: Record<string, string> = {};
+      identityMemberships.forEach((el) => {
+        if (el.actorIdentityId) {
+          identityToOrgMapping[el.actorIdentityId] = el.scopeOrgId;
+        }
+      });
+
+      const batchMemberships = chunkArray(identityMemberships, 500);
+      for await (const membership of batchMemberships) {
+        const identityIds = membership.map((el) => el.actorIdentityId).filter(Boolean) as string[];
+        if (identityIds.length) {
+          const identities = await tx(TableName.Identity).whereIn("id", identityIds).select("*");
+          await tx(TableName.Identity)
+            .insert(
+              identities.map((el) => ({
+                ...el,
+                orgId: identityToOrgMapping[el.id]
+              }))
+            )
+            .onConflict("id")
+            .merge();
+        }
+      }
+    }
+  });
+}
+
+export async function down(): Promise<void> {}
+
+const config = { transaction: false };
+export { config };

backend/src/db/migrations/20251021112356_add-certificate-auto-renewal.ts

@@ -0,0 +1,51 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.PkiApiEnrollmentConfig, "autoRenewDays")) {
+    await knex.schema.alterTable(TableName.PkiApiEnrollmentConfig, (t) => {
+      t.renameColumn("autoRenewDays", "renewBeforeDays");
+    });
+  }
+
+  if (!(await knex.schema.hasColumn(TableName.Certificate, "renewBeforeDays"))) {
+    await knex.schema.alterTable(TableName.Certificate, (t) => {
+      t.integer("renewBeforeDays").nullable();
+      t.uuid("renewedFromCertificateId").nullable();
+      t.uuid("renewedByCertificateId").nullable();
+      t.text("renewalError").nullable();
+      t.string("keyAlgorithm").nullable();
+      t.string("signatureAlgorithm").nullable();
+      t.foreign("renewedFromCertificateId").references("id").inTable(TableName.Certificate).onDelete("SET NULL");
+      t.foreign("renewedByCertificateId").references("id").inTable(TableName.Certificate).onDelete("SET NULL");
+      t.index("renewedFromCertificateId");
+      t.index("renewedByCertificateId");
+      t.index("renewBeforeDays");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.Certificate, "renewBeforeDays")) {
+    await knex.schema.alterTable(TableName.Certificate, (t) => {
+      t.dropForeign(["renewedFromCertificateId"]);
+      t.dropForeign(["renewedByCertificateId"]);
+      t.dropIndex("renewedFromCertificateId");
+      t.dropIndex("renewedByCertificateId");
+      t.dropIndex("renewBeforeDays");
+      t.dropColumn("renewBeforeDays");
+      t.dropColumn("renewedFromCertificateId");
+      t.dropColumn("renewedByCertificateId");
+      t.dropColumn("renewalError");
+      t.dropColumn("keyAlgorithm");
+      t.dropColumn("signatureAlgorithm");
+    });
+  }
+
+  if (await knex.schema.hasColumn(TableName.PkiApiEnrollmentConfig, "renewBeforeDays")) {
+    await knex.schema.alterTable(TableName.PkiApiEnrollmentConfig, (t) => {
+      t.renameColumn("renewBeforeDays", "autoRenewDays");
+    });
+  }
+}

backend/src/db/migrations/20251021124744_fix-project-deletion-approval-policy-constraint.ts

@@ -0,0 +1,68 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+// Fix for 20250722152841_add-policies-environments-table.ts migration.
+// 20250722152841_add-policies-environments-table.ts introduced a bug where you can no longer delete a project if it has any approval policy environments.
+
+export async function up(knex: Knex): Promise<void> {
+  // Fix SecretApprovalPolicyEnvironment to cascade delete when environment is deleted
+  // note: this won't actually happen, as we prevent deletion of environments with active approval policies
+
+  // in the old migration it was ON DELETE SET NULL, which doesn't work because envId is not a nullable col
+  await knex.schema.alterTable(TableName.SecretApprovalPolicyEnvironment, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+  });
+
+  // Fix AccessApprovalPolicyEnvironment to cascade delete when environment is deleted
+  // note: this won't actually happen, as we prevent deletion of environments with active approval policies
+
+  // in the old migration it was ON DELETE SET NULL, which doesn't work because envId is not a nullable col
+  await knex.schema.alterTable(TableName.AccessApprovalPolicyEnvironment, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+  });
+
+  // Fix SecretApprovalPolicy to CASCADE instead of SET NULL
+
+  // in the old migration it was ON DELETE SET NULL, which doesn't work because envId is not a nullable col
+  await knex.schema.alterTable(TableName.SecretApprovalPolicy, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+  });
+
+  // Fix AccessApprovalPolicy to CASCADE instead of SET NULL
+
+  // in the old migration it was ON DELETE SET NULL, which doesn't work because envId is not a nullable col
+  await knex.schema.alterTable(TableName.AccessApprovalPolicy, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  // Revert SecretApprovalPolicyEnvironment
+  await knex.schema.alterTable(TableName.SecretApprovalPolicyEnvironment, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment);
+  });
+
+  // Revert AccessApprovalPolicyEnvironment
+  await knex.schema.alterTable(TableName.AccessApprovalPolicyEnvironment, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment);
+  });
+
+  // Revert SecretApprovalPolicy back to SET NULL
+  await knex.schema.alterTable(TableName.SecretApprovalPolicy, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("SET NULL");
+  });
+
+  // Revert AccessApprovalPolicy back to SET NULL
+  await knex.schema.alterTable(TableName.AccessApprovalPolicy, (t) => {
+    t.dropForeign(["envId"]);
+    t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("SET NULL");
+  });
+}

backend/src/db/migrations/20251023123213_block-duplicate-sync-destinations-setting.ts

@@ -0,0 +1,27 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasOrgBlockDuplicateColumn = await knex.schema.hasColumn(
+    TableName.Organization,
+    "blockDuplicateSecretSyncDestinations"
+  );
+  if (!hasOrgBlockDuplicateColumn) {
+    await knex.schema.table(TableName.Organization, (table) => {
+      table.boolean("blockDuplicateSecretSyncDestinations").notNullable().defaultTo(false);
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasOrgBlockDuplicateColumn = await knex.schema.hasColumn(
+    TableName.Organization,
+    "blockDuplicateSecretSyncDestinations"
+  );
+  if (hasOrgBlockDuplicateColumn) {
+    await knex.schema.table(TableName.Organization, (table) => {
+      table.dropColumn("blockDuplicateSecretSyncDestinations");
+    });
+  }
+}

backend/src/db/migrations/20251028064623_pam-account-rotation-status.ts

@@ -0,0 +1,29 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn(TableName.PamAccount, "rotationStatus"))) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.string("rotationStatus").nullable();
+    });
+  }
+  if (!(await knex.schema.hasColumn(TableName.PamAccount, "encryptedLastRotationMessage"))) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.binary("encryptedLastRotationMessage").nullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.PamAccount, "rotationStatus")) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.dropColumn("rotationStatus");
+    });
+  }
+  if (await knex.schema.hasColumn(TableName.PamAccount, "encryptedLastRotationMessage")) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.dropColumn("encryptedLastRotationMessage");
+    });
+  }
+}

backend/src/db/migrations/20251028120000_add-certificate-sync-table.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "@app/db/schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "@app/db/utils";
+import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.CertificateSync))) {
+    await knex.schema.createTable(TableName.CertificateSync, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("pkiSyncId").notNullable();
+      t.foreign("pkiSyncId").references("id").inTable(TableName.PkiSync).onDelete("CASCADE");
+      t.uuid("certificateId").notNullable();
+      t.foreign("certificateId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
+      t.string("syncStatus").defaultTo(CertificateSyncStatus.Pending);
+      t.text("lastSyncMessage");
+      t.datetime("lastSyncedAt");
+      t.timestamps(true, true, true);
+
+      // Ensure unique combination of pki sync and certificate
+      t.unique(["pkiSyncId", "certificateId"]);
+
+      t.index("pkiSyncId");
+      t.index("certificateId");
+      t.index("syncStatus");
+    });
+
+    await createOnUpdateTrigger(knex, TableName.CertificateSync);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.CertificateSync);
+  await dropOnUpdateTrigger(knex, TableName.CertificateSync);
+}

backend/src/db/migrations/20251028155708_identity-access-token-remove-fk-for-identity-id.ts

@@ -0,0 +1,22 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.transaction(async (tx) => {
+    await tx.schema.alterTable(TableName.IdentityAccessToken, (table) => {
+      table.dropForeign("identityId");
+    });
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.transaction(async (tx) => {
+    await tx.schema.alterTable(TableName.IdentityAccessToken, (table) => {
+      table.foreign("identityId").references("id").inTable(TableName.Identity);
+    });
+  });
+}
+
+const config = { transaction: false };
+export { config };

backend/src/db/migrations/20251028160921_delete-no-org-identities.ts

@@ -0,0 +1,30 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+const MIGRATION_TIMEOUT = 30 * 60 * 1000; // 30 minutes
+
+export async function up(knex: Knex): Promise<void> {
+  const result = await knex.raw("SHOW statement_timeout");
+  const originalTimeout = result.rows[0].statement_timeout;
+
+  await knex.transaction(async (tx) => {
+    try {
+      await tx.raw(`SET statement_timeout = ${MIGRATION_TIMEOUT}`);
+      const hasIdentityOrgCol = await tx.schema.hasColumn(TableName.Identity, "orgId");
+      if (hasIdentityOrgCol) {
+        await tx(TableName.Identity).whereNull("orgId").delete();
+        await tx.schema.alterTable(TableName.Identity, (t) => {
+          t.uuid("orgId").notNullable().alter();
+        });
+      }
+    } finally {
+      await tx.raw(`SET statement_timeout = '${originalTimeout}'`);
+    }
+  });
+}
+
+export async function down(): Promise<void> {}
+
+const config = { transaction: false };
+export { config };

backend/src/db/migrations/20251031044512_add-certificate-sync-external-identifier.ts

@@ -0,0 +1,21 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn(TableName.CertificateSync, "externalIdentifier"))) {
+    await knex.schema.alterTable(TableName.CertificateSync, (t) => {
+      t.text("externalIdentifier").nullable();
+      t.index("externalIdentifier");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.CertificateSync, "externalIdentifier")) {
+    await knex.schema.alterTable(TableName.CertificateSync, (t) => {
+      t.dropIndex("externalIdentifier");
+      t.dropColumn("externalIdentifier");
+    });
+  }
+}

backend/src/db/schemas/certificate-syncs.ts

@@ -0,0 +1,24 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const CertificateSyncsSchema = z.object({
+  id: z.string().uuid(),
+  pkiSyncId: z.string().uuid(),
+  certificateId: z.string().uuid(),
+  syncStatus: z.string().default("pending").nullable().optional(),
+  lastSyncMessage: z.string().nullable().optional(),
+  lastSyncedAt: z.date().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  externalIdentifier: z.string().nullable().optional()
+});
+
+export type TCertificateSyncs = z.infer<typeof CertificateSyncsSchema>;
+export type TCertificateSyncsInsert = Omit<z.input<typeof CertificateSyncsSchema>, TImmutableDBKeys>;
+export type TCertificateSyncsUpdate = Partial<Omit<z.input<typeof CertificateSyncsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/certificates.ts

@@ -27,7 +27,13 @@ export const CertificatesSchema = z.object({
   extendedKeyUsages: z.string().array().nullable().optional(),
   projectId: z.string(),
   pkiSubscriberId: z.string().uuid().nullable().optional(),
-  profileId: z.string().uuid().nullable().optional()
+  profileId: z.string().uuid().nullable().optional(),
+  renewBeforeDays: z.number().nullable().optional(),
+  renewedFromCertificateId: z.string().uuid().nullable().optional(),
+  renewedByCertificateId: z.string().uuid().nullable().optional(),
+  renewalError: z.string().nullable().optional(),
+  keyAlgorithm: z.string().nullable().optional(),
+  signatureAlgorithm: z.string().nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;

backend/src/db/schemas/index.ts

@@ -17,6 +17,7 @@ export * from "./certificate-authority-crl";
 export * from "./certificate-authority-secret";
 export * from "./certificate-bodies";
 export * from "./certificate-secrets";
+export * from "./certificate-syncs";
 export * from "./certificate-template-est-configs";
 export * from "./certificate-templates";
 export * from "./certificates";

backend/src/db/schemas/models.ts

@@ -161,6 +161,7 @@ export enum TableName {
   AppConnection = "app_connections",
   SecretSync = "secret_syncs",
   PkiSync = "pki_syncs",
+  CertificateSync = "certificate_syncs",
   KmipClient = "kmip_clients",
   KmipOrgConfig = "kmip_org_configs",
   KmipOrgServerCertificates = "kmip_org_server_certificates",

backend/src/db/schemas/organizations.ts

@@ -40,7 +40,8 @@ export const OrganizationsSchema = z.object({
   googleSsoAuthEnforced: z.boolean().default(false),
   googleSsoAuthLastUsed: z.date().nullable().optional(),
   parentOrgId: z.string().uuid().nullable().optional(),
-  rootOrgId: z.string().uuid().nullable().optional()
+  rootOrgId: z.string().uuid().nullable().optional(),
+  blockDuplicateSecretSyncDestinations: z.boolean().default(false)
 });
 
 export type TOrganizations = z.infer<typeof OrganizationsSchema>;

backend/src/db/schemas/pam-accounts.ts

@@ -21,7 +21,9 @@ export const PamAccountsSchema = z.object({
   updatedAt: z.date(),
   rotationEnabled: z.boolean().default(false),
   rotationIntervalSeconds: z.number().nullable().optional(),
-  lastRotatedAt: z.date().nullable().optional()
+  lastRotatedAt: z.date().nullable().optional(),
+  rotationStatus: z.string().nullable().optional(),
+  encryptedLastRotationMessage: zodBuffer.nullable().optional()
 });
 
 export type TPamAccounts = z.infer<typeof PamAccountsSchema>;

backend/src/db/schemas/pki-api-enrollment-configs.ts

@@ -10,7 +10,7 @@ import { TImmutableDBKeys } from "./models";
 export const PkiApiEnrollmentConfigsSchema = z.object({
   id: z.string().uuid(),
   autoRenew: z.boolean().default(false).nullable().optional(),
-  autoRenewDays: z.number().nullable().optional(),
+  renewBeforeDays: z.number().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date()
 });

backend/src/ee/routes/v1/dynamic-secret-lease-router.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 
 import { DynamicSecretLeasesSchema } from "@app/db/schemas";
 import { ApiDocsTags, DYNAMIC_SECRET_LEASES } from "@app/lib/api-docs";
-import { daysToMillisecond } from "@app/lib/dates";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -32,8 +31,8 @@ export const registerDynamicSecretLeaseRouter = async (server: FastifyZodProvide
             const valMs = ms(val);
             if (valMs < 60 * 1000)
               ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-            if (valMs > daysToMillisecond(1))
-              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+            if (valMs > ms("10y"))
+              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
           }),
         path: z.string().trim().default("/").transform(removeTrailingSlash).describe(DYNAMIC_SECRET_LEASES.CREATE.path),
         environmentSlug: z.string().min(1).describe(DYNAMIC_SECRET_LEASES.CREATE.environmentSlug),
@@ -127,8 +126,8 @@ export const registerDynamicSecretLeaseRouter = async (server: FastifyZodProvide
             const valMs = ms(val);
             if (valMs < 60 * 1000)
               ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-            if (valMs > daysToMillisecond(1))
-              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+            if (valMs > ms("10y"))
+              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
           }),
         projectSlug: z.string().min(1).describe(DYNAMIC_SECRET_LEASES.RENEW.projectSlug),
         path: z

backend/src/ee/routes/v1/dynamic-secret-lease-routers/kubernetes-lease-router.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 
 import { DynamicSecretLeasesSchema } from "@app/db/schemas";
 import { ApiDocsTags, DYNAMIC_SECRET_LEASES } from "@app/lib/api-docs";
-import { daysToMillisecond } from "@app/lib/dates";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { writeLimit } from "@app/server/config/rateLimiter";
@@ -32,8 +31,8 @@ export const registerKubernetesDynamicSecretLeaseRouter = async (server: Fastify
             const valMs = ms(val);
             if (valMs < 60 * 1000)
               ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be greater than 1min" });
-            if (valMs > daysToMillisecond(1))
-              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+            if (valMs > ms("10y"))
+              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
           }),
         path: z.string().trim().default("/").transform(removeTrailingSlash).describe(DYNAMIC_SECRET_LEASES.CREATE.path),
         environmentSlug: z.string().min(1).describe(DYNAMIC_SECRET_LEASES.CREATE.environmentSlug),

backend/src/ee/routes/v1/dynamic-secret-router.ts

@@ -3,7 +3,6 @@ import { z } from "zod";
 import { DynamicSecretLeasesSchema } from "@app/db/schemas";
 import { DynamicSecretProviderSchema } from "@app/ee/services/dynamic-secret/providers/models";
 import { ApiDocsTags, DYNAMIC_SECRETS } from "@app/lib/api-docs";
-import { daysToMillisecond } from "@app/lib/dates";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { isValidHandleBarTemplate } from "@app/lib/template/validate-handlebars";
@@ -60,8 +59,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
             const valMs = ms(val);
             if (valMs < 60 * 1000)
               ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-            if (valMs > daysToMillisecond(1))
-              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+            if (valMs > ms("10y"))
+              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
           }),
         maxTTL: z
           .string()
@@ -72,8 +71,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
             const valMs = ms(val);
             if (valMs < 60 * 1000)
               ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-            if (valMs > daysToMillisecond(1))
-              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+            if (valMs > ms("10y"))
+              ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
           })
           .nullable(),
         path: z.string().describe(DYNAMIC_SECRETS.CREATE.path).trim().default("/").transform(removeTrailingSlash),
@@ -130,8 +129,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
               const valMs = ms(val);
               if (valMs < 60 * 1000)
                 ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-              if (valMs > daysToMillisecond(1))
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+              if (valMs > ms("10y"))
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
             }),
           maxTTL: z
             .string()
@@ -142,8 +141,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
               const valMs = ms(val);
               if (valMs < 60 * 1000)
                 ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
-              if (valMs > daysToMillisecond(1))
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+              if (valMs > ms("10y"))
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
             })
             .nullable(),
           newName: z.string().describe(DYNAMIC_SECRETS.UPDATE.newName).optional(),

backend/src/ee/routes/v1/kmip-spec-router.ts

@@ -182,7 +182,8 @@ export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
           algorithm: z.string(),
           isActive: z.boolean(),
           createdAt: z.date(),
-          updatedAt: z.date()
+          updatedAt: z.date(),
+          kmipMetadata: z.record(z.any()).nullish()
         })
       }
     },
@@ -384,7 +385,8 @@ export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
               isActive: z.boolean(),
               algorithm: z.string(),
               createdAt: z.date(),
-              updatedAt: z.date()
+              updatedAt: z.date(),
+              kmipMetadata: z.record(z.any()).nullish()
             })
             .array()
         })

backend/src/ee/routes/v1/pam-resource-routers/index.ts

@@ -1,14 +1,14 @@
+import {
+  CreateMySQLResourceSchema,
+  MySQLResourceSchema,
+  UpdateMySQLResourceSchema
+} from "@app/ee/services/pam-resource/mysql/mysql-resource-schemas";
 import { PamResource } from "@app/ee/services/pam-resource/pam-resource-enums";
 import {
   CreatePostgresResourceSchema,
   SanitizedPostgresResourceSchema,
   UpdatePostgresResourceSchema
 } from "@app/ee/services/pam-resource/postgres/postgres-resource-schemas";
-import {
-  CreateMySQLResourceSchema,
-  MySQLResourceSchema,
-  UpdateMySQLResourceSchema
-} from "@app/ee/services/pam-resource/mysql/mysql-resource-schemas";
 
 import { registerPamResourceEndpoints } from "./pam-resource-endpoints";
 

backend/src/ee/routes/v1/saml-router.ts

@@ -7,6 +7,7 @@
 // All the any rules are disabled because passport typesense with fastify is really poor
 
 import { Authenticator } from "@fastify/passport";
+import { requestContext } from "@fastify/request-context";
 import fastifySession from "@fastify/session";
 import { MultiSamlStrategy } from "@node-saml/passport-saml";
 import { FastifyRequest } from "fastify";
@@ -17,6 +18,7 @@ import { ApiDocsTags, SamlSso } from "@app/lib/api-docs";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { SanitizedSamlConfigSchema } from "@app/server/routes/sanitizedSchema/directory-config";
@@ -102,15 +104,15 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => {
       },
       // eslint-disable-next-line
       async (req, profile, cb) => {
+        if (!profile) throw new BadRequestError({ message: "Missing profile" });
+
+        const email =
+          profile?.email ??
+          // entra sends data in this format
+          (profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email"] as string) ??
+          (profile?.emailAddress as string); // emailRippling is added because in Rippling the field `email` reserved\
+
         try {
-          if (!profile) throw new BadRequestError({ message: "Missing profile" });
-
-          const email =
-            profile?.email ??
-            // entra sends data in this format
-            (profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email"] as string) ??
-            (profile?.emailAddress as string); // emailRippling is added because in Rippling the field `email` reserved\
-
           const firstName = (profile.firstName ??
             // entra sends data in this format
             profile["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstName"]) as string;
@@ -144,7 +146,7 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => {
             })
             .filter((el) => el.key && !["email", "firstName", "lastName"].includes(el.key));
 
-          const { isUserCompleted, providerAuthToken } = await server.services.saml.samlLogin({
+          const { isUserCompleted, providerAuthToken, user, organization } = await server.services.saml.samlLogin({
             externalId: profile.nameID,
             email: email.toLowerCase(),
             firstName,
@@ -154,8 +156,32 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => {
             orgId: (req as unknown as FastifyRequest).ssoConfig?.orgId,
             metadata: userMetadata
           });
+
+          if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+            authAttemptCounter.add(1, {
+              "infisical.user.email": email.toLowerCase(),
+              "infisical.user.id": user.id,
+              "infisical.organization.id": organization.id,
+              "infisical.organization.name": organization.name,
+              "infisical.auth.method": AuthAttemptAuthMethod.SAML,
+              "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+              "client.address": requestContext.get("ip"),
+              "user_agent.original": requestContext.get("userAgent")
+            });
+          }
+
           cb(null, { isUserCompleted, providerAuthToken });
         } catch (error) {
+          if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+            authAttemptCounter.add(1, {
+              "infisical.user.email": email.toLowerCase(),
+              "infisical.auth.method": AuthAttemptAuthMethod.SAML,
+              "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+              "client.address": requestContext.get("ip"),
+              "user_agent.original": requestContext.get("userAgent")
+            });
+          }
+
           logger.error(error);
           cb(error as Error);
         }

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -340,6 +340,8 @@ export enum EventType {
   ISSUE_PKI_SUBSCRIBER_CERT = "issue-pki-subscriber-cert",
   SIGN_PKI_SUBSCRIBER_CERT = "sign-pki-subscriber-cert",
   AUTOMATED_RENEW_SUBSCRIBER_CERT = "automated-renew-subscriber-cert",
+  AUTOMATED_RENEW_CERTIFICATE = "automated-renew-certificate",
+  AUTOMATED_RENEW_CERTIFICATE_FAILED = "automated-renew-certificate-failed",
   LIST_PKI_SUBSCRIBER_CERTS = "list-pki-subscriber-certs",
   GET_SUBSCRIBER_ACTIVE_CERT_BUNDLE = "get-subscriber-active-cert-bundle",
   CREATE_KMS = "create-kms",
@@ -367,6 +369,9 @@ export enum EventType {
   ISSUE_CERTIFICATE_FROM_PROFILE = "issue-certificate-from-profile",
   SIGN_CERTIFICATE_FROM_PROFILE = "sign-certificate-from-profile",
   ORDER_CERTIFICATE_FROM_PROFILE = "order-certificate-from-profile",
+  RENEW_CERTIFICATE = "renew-certificate",
+  UPDATE_CERTIFICATE_RENEWAL_CONFIG = "update-certificate-renewal-config",
+  DISABLE_CERTIFICATE_RENEWAL_CONFIG = "disable-certificate-renewal-config",
   ATTEMPT_CREATE_SLACK_INTEGRATION = "attempt-create-slack-integration",
   ATTEMPT_REINSTALL_SLACK_INTEGRATION = "attempt-reinstall-slack-integration",
   GET_PROJECT_SLACK_CONFIG = "get-project-slack-config",
@@ -421,6 +426,7 @@ export enum EventType {
   SECRET_SYNC_REMOVE_SECRETS = "secret-sync-remove-secrets",
   GET_PKI_SYNCS = "get-pki-syncs",
   GET_PKI_SYNC = "get-pki-sync",
+  GET_PKI_SYNC_CERTIFICATES = "get-pki-sync-certificates",
   CREATE_PKI_SYNC = "create-pki-sync",
   UPDATE_PKI_SYNC = "update-pki-sync",
   DELETE_PKI_SYNC = "delete-pki-sync",
@@ -2458,6 +2464,29 @@ interface AutomatedRenewPkiSubscriberCert {
   };
 }
 
+interface AutomatedRenewCertificate {
+  type: EventType.AUTOMATED_RENEW_CERTIFICATE;
+  metadata: {
+    certificateId: string;
+    commonName: string;
+    profileId: string;
+    renewBeforeDays: string;
+    profileName: string;
+  };
+}
+
+interface AutomatedRenewCertificateFailed {
+  type: EventType.AUTOMATED_RENEW_CERTIFICATE_FAILED;
+  metadata: {
+    certificateId: string;
+    commonName: string;
+    profileId: string;
+    renewBeforeDays: string;
+    profileName: string;
+    error: string;
+  };
+}
+
 interface SignPkiSubscriberCert {
   type: EventType.SIGN_PKI_SUBSCRIBER_CERT;
   metadata: {
@@ -2720,6 +2749,16 @@ interface OrderCertificateFromProfile {
   };
 }
 
+interface RenewCertificate {
+  type: EventType.RENEW_CERTIFICATE;
+  metadata: {
+    originalCertificateId: string;
+    newCertificateId: string;
+    profileName: string;
+    commonName: string;
+  };
+}
+
 interface AttemptCreateSlackIntegration {
   type: EventType.ATTEMPT_CREATE_SLACK_INTEGRATION;
   metadata: {
@@ -3123,6 +3162,16 @@ interface GetPkiSyncEvent {
   };
 }
 
+interface GetPkiSyncCertificatesEvent {
+  type: EventType.GET_PKI_SYNC_CERTIFICATES;
+  metadata: {
+    syncId: string;
+    count: number;
+    certificateIds: string[];
+    destination: string;
+  };
+}
+
 interface CreatePkiSyncEvent {
   type: EventType.CREATE_PKI_SYNC;
   metadata: {
@@ -4009,6 +4058,23 @@ interface PamResourceDeleteEvent {
   };
 }
 
+interface UpdateCertificateRenewalConfigEvent {
+  type: EventType.UPDATE_CERTIFICATE_RENEWAL_CONFIG;
+  metadata: {
+    certificateId: string;
+    renewBeforeDays: string;
+    commonName: string;
+  };
+}
+
+interface DisableCertificateRenewalConfigEvent {
+  type: EventType.DISABLE_CERTIFICATE_RENEWAL_CONFIG;
+  metadata: {
+    certificateId: string;
+    commonName: string;
+  };
+}
+
 export type Event =
   | CreateSubOrganizationEvent
   | UpdateSubOrganizationEvent
@@ -4216,6 +4282,7 @@ export type Event =
   | IssueCertificateFromProfile
   | SignCertificateFromProfile
   | OrderCertificateFromProfile
+  | RenewCertificate
   | GetAzureAdCsTemplatesEvent
   | AttemptCreateSlackIntegration
   | AttemptReinstallSlackIntegration
@@ -4273,6 +4340,7 @@ export type Event =
   | SecretSyncRemoveSecretsEvent
   | GetPkiSyncsEvent
   | GetPkiSyncEvent
+  | GetPkiSyncCertificatesEvent
   | CreatePkiSyncEvent
   | UpdatePkiSyncEvent
   | DeletePkiSyncEvent
@@ -4373,4 +4441,8 @@ export type Event =
   | PamResourceGetEvent
   | PamResourceCreateEvent
   | PamResourceUpdateEvent
-  | PamResourceDeleteEvent;
+  | PamResourceDeleteEvent
+  | UpdateCertificateRenewalConfigEvent
+  | DisableCertificateRenewalConfigEvent
+  | AutomatedRenewCertificate
+  | AutomatedRenewCertificateFailed;

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -112,7 +112,7 @@ export const dynamicSecretServiceFactory = ({
 
     const existingDynamicSecret = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (existingDynamicSecret)
-      throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" });
+      throw new BadRequestError({ message: "Provided dynamic secret already exists under the folder" });
 
     const selectedProvider = dynamicSecretProviders[provider.type];
     const inputs = await selectedProvider.validateProviderInputs(provider.inputs, { projectId });
@@ -265,7 +265,7 @@ export const dynamicSecretServiceFactory = ({
     if (newName) {
       const existingDynamicSecret = await dynamicSecretDAL.findOne({ name: newName, folderId: folder.id });
       if (existingDynamicSecret)
-        throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" });
+        throw new BadRequestError({ message: "Provided dynamic secret already exists under the folder" });
     }
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({

backend/src/ee/services/gateway-v2/gateway-v2-service.ts

@@ -25,7 +25,7 @@ import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TNotificationServiceFactory } from "@app/services/notification/notification-service";
 import { NotificationType } from "@app/services/notification/notification-types";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
-import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
+import { TSmtpService } from "@app/services/smtp/smtp-service";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { PamResource } from "../pam-resource/pam-resource-enums";
@@ -61,8 +61,7 @@ export const gatewayV2ServiceFactory = ({
   relayDAL,
   permissionService,
   orgDAL,
-  notificationService,
-  smtpService
+  notificationService
 }: TGatewayV2ServiceFactoryDep) => {
   const $validateIdentityAccessToGateway = async (orgId: string, actorId: string, actorAuthMethod: ActorAuthMethod) => {
     const orgLicensePlan = await licenseService.getPlan(orgId);
@@ -931,15 +930,17 @@ export const gatewayV2ServiceFactory = ({
           }))
         );
 
-        await smtpService.sendMail({
-          recipients: admins.map((admin) => admin.user.email).filter((v): v is string => !!v),
-          subjectLine: "Gateway Health Alert",
-          substitutions: {
-            type: "gateway",
-            names: gatewayNames
-          },
-          template: SmtpTemplates.HealthAlert
-        });
+        // Temporarily disabled email notifications due to excessive noise. Will be revised later
+        //
+        // await smtpService.sendMail({
+        //   recipients: admins.map((admin) => admin.user.email).filter((v): v is string => !!v),
+        //   subjectLine: "Gateway Health Alert",
+        //   substitutions: {
+        //     type: "gateway",
+        //     names: gatewayNames
+        //   },
+        //   template: SmtpTemplates.HealthAlert
+        // });
 
         await Promise.all(gateways.map((gw) => gatewayV2DAL.updateById(gw.id, { healthAlertedAt: new Date() })));
       } catch (error) {

backend/src/ee/services/kmip/kmip-operation-service.ts

@@ -341,7 +341,8 @@ export const kmipOperationServiceFactory = ({
       algorithm: completeKeyDetails.internalKms.encryptionAlgorithm,
       isActive: !key.isDisabled,
       createdAt: key.createdAt,
-      updatedAt: key.updatedAt
+      updatedAt: key.updatedAt,
+      kmipMetadata: key.kmipMetadata as Record<string, unknown>
     };
   };
 

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unsafe-call */
 import { ForbiddenError } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import { Issuer, Issuer as OpenIdIssuer, Strategy as OpenIdStrategy, TokenSet } from "openid-client";
 
 import { AccessScope, OrganizationActionScope, OrgMembershipStatus, TableName, TUsers } from "@app/db/schemas";
@@ -15,6 +16,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, OidcAuthError } from "@app/lib/errors";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { OrgServiceActor } from "@app/lib/types";
 import { ActorType, AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
@@ -471,7 +473,7 @@ export const oidcConfigServiceFactory = ({
         });
     }
 
-    return { isUserCompleted, providerAuthToken };
+    return { isUserCompleted, providerAuthToken, user };
   };
 
   const updateOidcCfg = async ({
@@ -754,10 +756,35 @@ export const oidcConfigServiceFactory = ({
           callbackPort,
           manageGroupMemberships: oidcCfg.manageGroupMemberships
         })
-          .then(({ isUserCompleted, providerAuthToken }) => {
+          .then(({ isUserCompleted, providerAuthToken, user }) => {
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": claims?.email?.toLowerCase(),
+                "infisical.user.id": user.id,
+                "infisical.organization.id": org.id,
+                "infisical.organization.name": org.name,
+                "infisical.auth.method": AuthAttemptAuthMethod.OIDC,
+                "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
+
             cb(null, { isUserCompleted, providerAuthToken });
           })
           .catch((error) => {
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": claims?.email?.toLowerCase(),
+                "infisical.organization.id": org.id,
+                "infisical.organization.name": org.name,
+                "infisical.auth.method": AuthAttemptAuthMethod.OIDC,
+                "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
+
             cb(error);
           });
       }

backend/src/ee/services/pam-account/pam-account-fns.ts

@@ -45,17 +45,47 @@ export const decryptAccountCredentials = async ({
   return JSON.parse(decryptedPlainTextBlob.toString()) as TPamAccountCredentials;
 };
 
-export const decryptAccount = async <T extends { encryptedCredentials: Buffer }>(
+export const decryptAccountMessage = async ({
+  projectId,
+  encryptedMessage,
+  kmsService
+}: {
+  projectId: string;
+  encryptedMessage: Buffer;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+}) => {
+  const { decryptor } = await kmsService.createCipherPairWithDataKey({
+    type: KmsDataKey.SecretManager,
+    projectId
+  });
+
+  const decryptedPlainTextBlob = decryptor({
+    cipherTextBlob: encryptedMessage
+  });
+
+  return decryptedPlainTextBlob.toString();
+};
+
+export const decryptAccount = async <
+  T extends { encryptedCredentials: Buffer; encryptedLastRotationMessage?: Buffer | null }
+>(
   account: T,
   projectId: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<T & { credentials: TPamAccountCredentials }> => {
+): Promise<T & { credentials: TPamAccountCredentials; lastRotationMessage: string | null }> => {
   return {
     ...account,
     credentials: await decryptAccountCredentials({
       encryptedCredentials: account.encryptedCredentials,
       projectId,
       kmsService
-    })
-  } as T & { credentials: TPamAccountCredentials };
+    }),
+    lastRotationMessage: account.encryptedLastRotationMessage
+      ? await decryptAccountMessage({
+          encryptedMessage: account.encryptedLastRotationMessage,
+          projectId,
+          kmsService
+        })
+      : null
+  };
 };

backend/src/ee/services/pam-account/pam-account-service.ts

@@ -15,6 +15,7 @@ import { logger } from "@app/lib/logger";
 import { OrgServiceActor } from "@app/lib/types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
@@ -353,6 +354,7 @@ export const pamAccountServiceFactory = ({
       TPamAccounts & {
         resource: Pick<TPamResources, "id" | "name" | "resourceType"> & { rotationCredentialsConfigured: boolean };
         credentials: TPamAccountCredentials;
+        lastRotationMessage: string | null;
       }
     > = [];
 
@@ -376,6 +378,7 @@ export const pamAccountServiceFactory = ({
       ) {
         // Decrypt the account only if the user has permission to read it
         const decryptedAccount = await decryptAccount(account, account.projectId, kmsService);
+
         decryptedAndPermittedAccounts.push({
           ...decryptedAccount,
           resource: {
@@ -575,10 +578,10 @@ export const pamAccountServiceFactory = ({
     for (let i = 0; i < accounts.length; i += ROTATION_CONCURRENCY_LIMIT) {
       const batch = accounts.slice(i, i + ROTATION_CONCURRENCY_LIMIT);
 
-      const rotationPromises = batch.map(async (account) =>
-        pamAccountDAL.transaction(async (tx) => {
-          let logResourceType = "unknown";
-          try {
+      const rotationPromises = batch.map(async (account) => {
+        let logResourceType = "unknown";
+        try {
+          await pamAccountDAL.transaction(async (tx) => {
             const resource = await pamResourceDAL.findById(account.resourceId, tx);
             if (!resource || !resource.encryptedRotationAccountCredentials) return;
             logResourceType = resource.resourceType;
@@ -619,7 +622,9 @@ export const pamAccountServiceFactory = ({
               account.id,
               {
                 encryptedCredentials,
-                lastRotatedAt: new Date()
+                lastRotatedAt: new Date(),
+                rotationStatus: "success",
+                encryptedLastRotationMessage: null
               },
               tx
             );
@@ -640,32 +645,45 @@ export const pamAccountServiceFactory = ({
                 }
               }
             });
-          } catch (error) {
-            logger.error(error, `Failed to rotate credentials for account [accountId=${account.id}]`);
+          });
+        } catch (error) {
+          logger.error(error, `Failed to rotate credentials for account [accountId=${account.id}]`);
 
-            const errorMessage = error instanceof Error ? error.message : "An unknown error occurred";
+          const errorMessage = error instanceof Error ? error.message : "An unknown error occurred";
 
-            await auditLogService.createAuditLog({
-              projectId: account.projectId,
-              actor: {
-                type: ActorType.PLATFORM,
-                metadata: {}
-              },
-              event: {
-                type: EventType.PAM_ACCOUNT_CREDENTIAL_ROTATION_FAILED,
-                metadata: {
-                  accountId: account.id,
-                  accountName: account.name,
-                  resourceId: account.resourceId,
-                  resourceType: logResourceType,
-                  errorMessage
-                }
+          const { encryptor } = await kmsService.createCipherPairWithDataKey({
+            type: KmsDataKey.SecretManager,
+            projectId: account.projectId
+          });
+
+          const { cipherTextBlob: encryptedMessage } = encryptor({
+            plainText: Buffer.from(errorMessage)
+          });
+
+          await pamAccountDAL.updateById(account.id, {
+            rotationStatus: "failed",
+            encryptedLastRotationMessage: encryptedMessage
+          });
+
+          await auditLogService.createAuditLog({
+            projectId: account.projectId,
+            actor: {
+              type: ActorType.PLATFORM,
+              metadata: {}
+            },
+            event: {
+              type: EventType.PAM_ACCOUNT_CREDENTIAL_ROTATION_FAILED,
+              metadata: {
+                accountId: account.id,
+                accountName: account.name,
+                resourceId: account.resourceId,
+                resourceType: logResourceType,
+                errorMessage
               }
-            });
-            throw error; // Rollback transaction
-          }
-        })
-      );
+            }
+          });
+        }
+      });
 
       // eslint-disable-next-line no-await-in-loop
       await Promise.all(rotationPromises);

backend/src/ee/services/pam-resource/pam-resource-schemas.ts

@@ -33,7 +33,9 @@ export const BasePamAccountSchemaWithResource = BasePamAccountSchema.extend({
     resourceType: true
   }).extend({
     rotationCredentialsConfigured: z.boolean()
-  })
+  }),
+  lastRotationMessage: z.string().nullable().optional(),
+  rotationStatus: z.string().nullable().optional()
 });
 
 export const BaseCreatePamAccountSchema = z.object({

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts

@@ -41,7 +41,10 @@ export interface SqlResourceConnection {
    *
    * @returns Promise to be resolved with the new credentials
    */
-  rotateCredentials: (currentCredentials: TSqlAccountCredentials) => Promise<TSqlAccountCredentials>;
+  rotateCredentials: (
+    currentCredentials: TSqlAccountCredentials,
+    newPassword: string
+  ) => Promise<TSqlAccountCredentials>;
 
   /**
    * Close the connection.
@@ -113,8 +116,7 @@ const makeSqlConnection = (
             });
           }
         },
-        rotateCredentials: async (currentCredentials) => {
-          const newPassword = alphaNumericNanoId(32);
+        rotateCredentials: async (currentCredentials, newPassword) => {
           // Note: The generated random password is not really going to make SQL Injection possible.
           //       The reason we are not using parameters binding is that the "ALTER USER" syntax is DDL,
           //       parameters binding is not supported. But just in case if the this code got copied
@@ -295,6 +297,7 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
     rotationAccountCredentials,
     currentCredentials
   ) => {
+    const newPassword = alphaNumericNanoId(32);
     try {
       return await executeWithGateway(
         {
@@ -305,7 +308,7 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
           password: rotationAccountCredentials.password
         },
         gatewayV2Service,
-        (client) => client.rotateCredentials(currentCredentials)
+        (client) => client.rotateCredentials(currentCredentials, newPassword)
       );
     } catch (error) {
       if (error instanceof BadRequestError) {
@@ -328,8 +331,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
         }
       }
 
+      const sanitizedErrorMessage = ((error as Error).message || String(error)).replaceAll(newPassword, "REDACTED");
+
       throw new BadRequestError({
-        message: `Unable to rotate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
+        message: `Unable to rotate account credentials for ${resourceType}: ${sanitizedErrorMessage}`
       });
     }
   };

backend/src/ee/services/permission/permission-service.ts

@@ -337,6 +337,12 @@ export const permissionServiceFactory = ({
       throw new NotFoundError({ message: `Project with ${projectId} not found` });
     }
 
+    requestContext.set("projectDetails", {
+      id: projectDetails.id,
+      name: projectDetails.name,
+      slug: projectDetails.slug
+    });
+
     if (projectDetails.orgId !== actorOrgId) {
       throw new ForbiddenRequestError({ name: "You are not logged into this organization" });
     }

backend/src/ee/services/relay/relay-service.ts

@@ -1268,15 +1268,17 @@ export const relayServiceFactory = ({
             }))
           );
 
-          await smtpService.sendMail({
-            recipients: admins.map((admin) => admin.user.email).filter((v): v is string => !!v),
-            subjectLine: "Relay Health Alert",
-            substitutions: {
-              type: "relay",
-              names: relayNames
-            },
-            template: SmtpTemplates.HealthAlert
-          });
+          // Temporarily disabled email notifications due to excessive noise. Will be revised later
+          //
+          // await smtpService.sendMail({
+          //   recipients: admins.map((admin) => admin.user.email).filter((v): v is string => !!v),
+          //   subjectLine: "Relay Health Alert",
+          //   substitutions: {
+          //     type: "relay",
+          //     names: relayNames
+          //   },
+          //   template: SmtpTemplates.HealthAlert
+          // });
         }
 
         await Promise.all(relays.map((r) => relayDAL.updateById(r.id, { healthAlertedAt: new Date() })));

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -769,7 +769,7 @@ export const samlConfigServiceFactory = ({
       });
     }
 
-    return { isUserCompleted, providerAuthToken };
+    return { isUserCompleted, providerAuthToken, user, organization };
   };
 
   return {

backend/src/ee/services/saml-config/saml-config-types.ts

@@ -1,4 +1,4 @@
-import { TSamlConfigs } from "@app/db/schemas";
+import { TOrganizations, TSamlConfigs, TUsers } from "@app/db/schemas";
 import { TOrgPermission } from "@app/lib/types";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 
@@ -78,5 +78,7 @@ export type TSamlConfigServiceFactory = {
   samlLogin: (arg: TSamlLoginDTO) => Promise<{
     isUserCompleted: boolean;
     providerAuthToken: string;
+    user: TUsers;
+    organization: TOrganizations;
   }>;
 };

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -1517,7 +1517,7 @@ export const secretApprovalRequestServiceFactory = ({
         }))
       );
       if (secrets.length)
-        throw new BadRequestError({ message: `Secret already exist: ${secrets.map((el) => el.key).join(",")}` });
+        throw new BadRequestError({ message: `Secret already exists: ${secrets.map((el) => el.key).join(",")}` });
 
       commits.push(
         ...createdSecrets.map((createdSecret) => ({

backend/src/lib/api-docs/constants.ts

@@ -2348,6 +2348,9 @@ export const AppConnections = {
     RAILWAY: {
       apiToken: "The API token used to authenticate with Railway."
     },
+    NORTHFLANK: {
+      apiToken: "The API token used to authenticate with Northflank."
+    },
     CHECKLY: {
       apiKey: "The API key used to authenticate with Checkly."
     },
@@ -2376,6 +2379,12 @@ export const AppConnections = {
     },
     LARAVEL_FORGE: {
       apiToken: "The API token used to authenticate with Laravel Forge."
+    },
+    CHEF: {
+      serverUrl: "The URL of the Chef server to connect to.",
+      orgName: "The short name of the Chef organization to connect to.",
+      userName: "The username used to access Chef.",
+      privateKey: "The private key used to access Chef."
     }
   }
 };
@@ -2620,6 +2629,16 @@ export const SecretSyncs = {
       siteName: "The name of the Netlify site to sync secrets to.",
       siteId: "The ID of the Netlify site to sync secrets to.",
       context: "The Netlify context to sync secrets to."
+    },
+    CHEF: {
+      dataBagName: "The name of the Chef data bag to sync secrets to.",
+      dataBagItemName: "The name of the Chef data bag item to sync secrets to."
+    },
+    NORTHFLANK: {
+      projectId: "The ID of the Northflank project to sync secrets to.",
+      projectName: "The name of the Northflank project to sync secrets to.",
+      secretGroupId: "The ID of the Northflank secret group to sync secrets to.",
+      secretGroupName: "The name of the Northflank secret group to sync secrets to."
     }
   }
 };

backend/src/lib/gateway-v2/gateway-v2.ts

@@ -7,6 +7,7 @@ import https from "https";
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
 import { splitPemChain } from "@app/services/certificate/certificate-fns";
 
+import { getConfig } from "../config/env";
 import { BadRequestError } from "../errors";
 import { GatewayProxyProtocol } from "../gateway/types";
 import { logger } from "../logger";
@@ -80,6 +81,8 @@ const createGatewayConnection = async (
   gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string },
   protocol: GatewayProxyProtocol
 ): Promise<net.Socket> => {
+  const appCfg = getConfig();
+
   const protocolToAlpn = {
     [GatewayProxyProtocol.Http]: "infisical-http-proxy",
     [GatewayProxyProtocol.Tcp]: "infisical-tcp-proxy",
@@ -94,7 +97,8 @@ const createGatewayConnection = async (
     minVersion: "TLSv1.2",
     maxVersion: "TLSv1.3",
     rejectUnauthorized: true,
-    ALPNProtocols: [protocolToAlpn[protocol]]
+    ALPNProtocols: [protocolToAlpn[protocol]],
+    checkServerIdentity: appCfg.isDevelopmentMode ? () => undefined : tls.checkServerIdentity
   };
 
   return new Promise((resolve, reject) => {

backend/src/lib/telemetry/metrics.ts

@@ -0,0 +1,100 @@
+import { requestContext } from "@fastify/request-context";
+import opentelemetry from "@opentelemetry/api";
+
+import { getConfig } from "../config/env";
+
+const infisicalMeter = opentelemetry.metrics.getMeter("Infisical");
+
+export enum AuthAttemptAuthMethod {
+  EMAIL = "email",
+  SAML = "saml",
+  OIDC = "oidc",
+  GOOGLE = "google",
+  GITHUB = "github",
+  GITLAB = "gitlab",
+  TOKEN_AUTH = "token-auth",
+  UNIVERSAL_AUTH = "universal-auth",
+  KUBERNETES_AUTH = "kubernetes-auth",
+  GCP_AUTH = "gcp-auth",
+  ALICLOUD_AUTH = "alicloud-auth",
+  AWS_AUTH = "aws-auth",
+  AZURE_AUTH = "azure-auth",
+  TLS_CERT_AUTH = "tls-cert-auth",
+  OCI_AUTH = "oci-auth",
+  OIDC_AUTH = "oidc-auth",
+  JWT_AUTH = "jwt-auth",
+  LDAP_AUTH = "ldap-auth"
+}
+
+export enum AuthAttemptAuthResult {
+  SUCCESS = "success",
+  FAILURE = "failure"
+}
+
+export const authAttemptCounter = infisicalMeter.createCounter("infisical.auth.attempt.count", {
+  description: "Authentication attempts (both successful and failed)",
+  unit: "{attempt}"
+});
+
+export const secretReadCounter = infisicalMeter.createCounter("infisical.secret.read.count", {
+  description: "Number of secret read operations",
+  unit: "{operation}"
+});
+
+export const recordSecretReadMetric = (params: { environment: string; secretPath: string; name?: string }) => {
+  const appCfg = getConfig();
+
+  if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+    const attributes: Record<string, string> = {
+      "infisical.environment": params.environment,
+      "infisical.secret.path": params.secretPath,
+      ...(params.name ? { "infisical.secret.name": params.name } : {})
+    };
+
+    const orgId = requestContext.get("orgId");
+    if (orgId) {
+      attributes["infisical.organization.id"] = orgId;
+    }
+
+    const orgName = requestContext.get("orgName");
+    if (orgName) {
+      attributes["infisical.organization.name"] = orgName;
+    }
+
+    const projectDetails = requestContext.get("projectDetails");
+    if (projectDetails?.id) {
+      attributes["infisical.project.id"] = projectDetails.id;
+    }
+    if (projectDetails?.name) {
+      attributes["infisical.project.name"] = projectDetails.name;
+    }
+
+    const userAuthInfo = requestContext.get("userAuthInfo");
+    if (userAuthInfo?.userId) {
+      attributes["infisical.user.id"] = userAuthInfo.userId;
+    }
+    if (userAuthInfo?.email) {
+      attributes["infisical.user.email"] = userAuthInfo.email;
+    }
+
+    const identityAuthInfo = requestContext.get("identityAuthInfo");
+    if (identityAuthInfo?.identityId) {
+      attributes["infisical.identity.id"] = identityAuthInfo.identityId;
+    }
+    if (identityAuthInfo?.identityName) {
+      attributes["infisical.identity.name"] = identityAuthInfo.identityName;
+    }
+
+    const userAgent = requestContext.get("userAgent");
+    if (userAgent) {
+      attributes["user_agent.original"] = userAgent;
+    }
+
+    const ip = requestContext.get("ip");
+    if (ip) {
+      attributes["client.address"] = ip;
+    }
+
+    secretReadCounter.add(1, attributes);
+  }
+};

backend/src/queue/queue-service.ts

@@ -78,6 +78,7 @@ export enum QueueName {
   SecretReminderMigration = "secret-reminder-migration",
   UserNotification = "user-notification",
   HealthAlert = "health-alert",
+  CertificateV3AutoRenewal = "certificate-v3-auto-renewal",
   PamAccountRotation = "pam-account-rotation"
 }
 
@@ -128,6 +129,7 @@ export enum QueueJobs {
   SecretReminderMigration = "secret-reminder-migration",
   UserNotification = "user-notification-job",
   HealthAlert = "health-alert",
+  CertificateV3DailyAutoRenewal = "certificate-v3-daily-auto-renewal",
   PamAccountRotation = "pam-account-rotation"
 }
 
@@ -359,6 +361,10 @@ export type TQueueJobTypes = {
     name: QueueJobs.HealthAlert;
     payload: undefined;
   };
+  [QueueName.CertificateV3AutoRenewal]: {
+    name: QueueJobs.CertificateV3DailyAutoRenewal;
+    payload: undefined;
+  };
   [QueueName.PamAccountRotation]: {
     name: QueueJobs.PamAccountRotation;
     payload: undefined;

backend/src/server/app.ts

@@ -141,7 +141,9 @@ export const main = async ({
     await server.register(fastifyRequestContext, {
       defaultStoreValues: (req) => ({
         reqId: req.id,
-        log: req.log.child({ reqId: req.id })
+        log: req.log.child({ reqId: req.id }),
+        ip: req.realIp,
+        userAgent: req.headers["user-agent"]
       })
     });
 

backend/src/server/plugins/api-metrics.ts

@@ -1,12 +1,26 @@
+import { requestContext } from "@fastify/request-context";
 import opentelemetry from "@opentelemetry/api";
 import fp from "fastify-plugin";
 
-export const apiMetrics = fp(async (fastify) => {
-  const apiMeter = opentelemetry.metrics.getMeter("API");
-  const latencyHistogram = apiMeter.createHistogram("API_latency", {
-    unit: "ms"
-  });
+const apiMeter = opentelemetry.metrics.getMeter("API");
 
+const latencyHistogram = apiMeter.createHistogram("API_latency", {
+  unit: "ms"
+});
+
+const infisicalMeter = opentelemetry.metrics.getMeter("Infisical");
+
+const requestCounter = infisicalMeter.createCounter("infisical.http.server.request.count", {
+  description: "Total number of API requests to Infisical (covers both human users and machine identities)",
+  unit: "{request}"
+});
+
+const requestDurationHistogram = infisicalMeter.createHistogram("infisical.http.server.request.duration", {
+  description: "API request latency",
+  unit: "s"
+});
+
+export const apiMetrics = fp(async (fastify) => {
   fastify.addHook("onResponse", async (request, reply) => {
     const { method } = request;
     const route = request.routerPath;
@@ -17,5 +31,67 @@ export const apiMetrics = fp(async (fastify) => {
       method,
       statusCode
     });
+
+    const orgId = requestContext.get("orgId");
+    const orgName = requestContext.get("orgName");
+    const userAuthInfo = requestContext.get("userAuthInfo");
+    const identityAuthInfo = requestContext.get("identityAuthInfo");
+    const projectDetails = requestContext.get("projectDetails");
+    const userAgent = requestContext.get("userAgent");
+    const ip = requestContext.get("ip");
+
+    const attributes: Record<string, string | number> = {
+      "http.request.method": method,
+      "http.route": route,
+      "http.response.status_code": statusCode
+    };
+
+    if (orgId) {
+      attributes["infisical.organization.id"] = orgId;
+    }
+    if (orgName) {
+      attributes["infisical.organization.name"] = orgName;
+    }
+
+    if (userAuthInfo) {
+      if (userAuthInfo.userId) {
+        attributes["infisical.user.id"] = userAuthInfo.userId;
+      }
+      if (userAuthInfo.email) {
+        attributes["infisical.user.email"] = userAuthInfo.email;
+      }
+    }
+
+    if (identityAuthInfo) {
+      if (identityAuthInfo.identityId) {
+        attributes["infisical.identity.id"] = identityAuthInfo.identityId;
+      }
+      if (identityAuthInfo.identityName) {
+        attributes["infisical.identity.name"] = identityAuthInfo.identityName;
+      }
+      if (identityAuthInfo.authMethod) {
+        attributes["infisical.auth.method"] = identityAuthInfo.authMethod;
+      }
+    }
+
+    if (projectDetails) {
+      if (projectDetails.id) {
+        attributes["infisical.project.id"] = projectDetails.id;
+      }
+      if (projectDetails.name) {
+        attributes["infisical.project.name"] = projectDetails.name;
+      }
+    }
+
+    if (userAgent) {
+      attributes["user_agent.original"] = userAgent;
+    }
+
+    if (ip) {
+      attributes["client.address"] = ip;
+    }
+
+    requestCounter.add(1, attributes);
+    requestDurationHistogram.record(reply.elapsedTime / 1000, attributes);
   });
 });

backend/src/server/plugins/auth/inject-identity.ts

@@ -1,4 +1,4 @@
-import { requestContext } from "@fastify/request-context";
+import { requestContext, RequestContextData } from "@fastify/request-context";
 import { FastifyRequest } from "fastify";
 import fp from "fastify-plugin";
 import type { JwtPayload } from "jsonwebtoken";
@@ -138,6 +138,11 @@ export const injectIdentity = fp(
         return;
       }
 
+      // Authentication is handled on a route-level
+      if (req.url === "/api/v1/relays/heartbeat-instance-relay") {
+        return;
+      }
+
       // Authentication is handled on a route-level here.
       if (req.url.includes("/api/v1/workflow-integrations/microsoft-teams/message-endpoint")) {
         return;
@@ -154,10 +159,11 @@ export const injectIdentity = fp(
 
       switch (authMode) {
         case AuthMode.JWT: {
-          const { user, tokenVersionId, orgId, rootOrgId, parentOrgId } =
+          const { user, tokenVersionId, orgId, orgName, rootOrgId, parentOrgId } =
             await server.services.authToken.fnValidateJwtIdentity(token, subOrganizationSelector);
           requestContext.set("orgId", orgId);
-
+          requestContext.set("orgName", orgName);
+          requestContext.set("userAuthInfo", { userId: user.id, email: user.email || "" });
           req.auth = {
             authMode: AuthMode.JWT,
             user,
@@ -181,6 +187,7 @@ export const injectIdentity = fp(
           );
           const serverCfg = await getServerCfg();
           requestContext.set("orgId", identity.orgId);
+          requestContext.set("orgName", identity.orgName);
           req.auth = {
             authMode: AuthMode.IDENTITY_ACCESS_TOKEN,
             actor,
@@ -193,24 +200,23 @@ export const injectIdentity = fp(
             isInstanceAdmin: serverCfg?.adminIdentityIds?.includes(identity.identityId),
             token
           };
+          const identityAuthInfo: RequestContextData["identityAuthInfo"] = {
+            identityId: identity.identityId,
+            identityName: identity.name,
+            authMethod: identity.authMethod
+          };
+
           if (token?.identityAuth?.oidc) {
-            requestContext.set("identityAuthInfo", {
-              identityId: identity.identityId,
-              oidc: token?.identityAuth?.oidc
-            });
+            identityAuthInfo.oidc = token?.identityAuth?.oidc;
           }
           if (token?.identityAuth?.kubernetes) {
-            requestContext.set("identityAuthInfo", {
-              identityId: identity.identityId,
-              kubernetes: token?.identityAuth?.kubernetes
-            });
+            identityAuthInfo.kubernetes = token?.identityAuth?.kubernetes;
           }
           if (token?.identityAuth?.aws) {
-            requestContext.set("identityAuthInfo", {
-              identityId: identity.identityId,
-              aws: token?.identityAuth?.aws
-            });
+            identityAuthInfo.aws = token?.identityAuth?.aws;
           }
+
+          requestContext.set("identityAuthInfo", identityAuthInfo);
           break;
         }
         case AuthMode.SERVICE_TOKEN: {

backend/src/server/plugins/error-handler.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError, PureAbility } from "@casl/ability";
+import { requestContext } from "@fastify/request-context";
 import opentelemetry from "@opentelemetry/api";
 import fastifyPlugin from "fastify-plugin";
 import jwt from "jsonwebtoken";
@@ -47,6 +48,12 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
     unit: "1"
   });
 
+  const infisicalMeter = opentelemetry.metrics.getMeter("Infisical");
+  const errorCounter = infisicalMeter.createCounter("infisical.http.server.error.count", {
+    description: "Total number of API errors in Infisical (covers both human users and machine identities)",
+    unit: "{error}"
+  });
+
   server.setErrorHandler((error, req, res) => {
     req.log.error(error);
     if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
@@ -61,6 +68,67 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
         type: errorType,
         name: error.name
       });
+
+      const orgId = requestContext.get("orgId");
+      const orgName = requestContext.get("orgName");
+      const userAuthInfo = requestContext.get("userAuthInfo");
+      const identityAuthInfo = requestContext.get("identityAuthInfo");
+      const projectDetails = requestContext.get("projectDetails");
+
+      const attributes: Record<string, string | number> = {
+        "http.request.method": method,
+        "http.route": route,
+        "error.type": errorType,
+        "error.name": error.name
+      };
+
+      if (orgId) {
+        attributes["infisical.organization.id"] = orgId;
+      }
+      if (orgName) {
+        attributes["infisical.organization.name"] = orgName;
+      }
+
+      if (userAuthInfo) {
+        if (userAuthInfo.userId) {
+          attributes["infisical.user.id"] = userAuthInfo.userId;
+        }
+        if (userAuthInfo.email) {
+          attributes["infisical.user.email"] = userAuthInfo.email;
+        }
+      }
+
+      if (identityAuthInfo) {
+        if (identityAuthInfo.identityId) {
+          attributes["infisical.identity.id"] = identityAuthInfo.identityId;
+        }
+        if (identityAuthInfo.identityName) {
+          attributes["infisical.identity.name"] = identityAuthInfo.identityName;
+        }
+        if (identityAuthInfo.authMethod) {
+          attributes["infisical.auth.method"] = identityAuthInfo.authMethod;
+        }
+      }
+
+      if (projectDetails) {
+        if (projectDetails.id) {
+          attributes["infisical.project.id"] = projectDetails.id;
+        }
+        if (projectDetails.name) {
+          attributes["infisical.project.name"] = projectDetails.name;
+        }
+      }
+
+      const userAgent = req.headers["user-agent"];
+      if (userAgent) {
+        attributes["user_agent.original"] = userAgent;
+      }
+
+      if (req.realIp) {
+        attributes["client.address"] = req.realIp;
+      }
+
+      errorCounter.add(1, attributes);
     }
 
     if (error instanceof BadRequestError) {

backend/src/server/routes/index.ts

@@ -172,11 +172,13 @@ import { internalCertificateAuthorityServiceFactory } from "@app/services/certif
 import { certificateEstV3ServiceFactory } from "@app/services/certificate-est-v3/certificate-est-v3-service";
 import { certificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import { certificateProfileServiceFactory } from "@app/services/certificate-profile/certificate-profile-service";
+import { certificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { certificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
 import { certificateTemplateEstConfigDALFactory } from "@app/services/certificate-template/certificate-template-est-config-dal";
 import { certificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { certificateTemplateV2DALFactory } from "@app/services/certificate-template-v2/certificate-template-v2-dal";
 import { certificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
+import { certificateV3QueueServiceFactory } from "@app/services/certificate-v3/certificate-v3-queue";
 import { certificateV3ServiceFactory } from "@app/services/certificate-v3/certificate-v3-service";
 import { cmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { convertorServiceFactory } from "@app/services/convertor/convertor-service";
@@ -607,6 +609,10 @@ export const registerRoutes = async (
   const membershipGroupService = membershipGroupServiceFactory({
     membershipGroupDAL,
     membershipRoleDAL,
+    accessApprovalPolicyDAL,
+    accessApprovalPolicyApproverDAL,
+    secretApprovalPolicyDAL,
+    secretApprovalPolicyApproverDAL: sapApproverDAL,
     roleDAL,
     permissionService,
     orgDAL
@@ -1059,6 +1065,7 @@ export const registerRoutes = async (
   const certificateDAL = certificateDALFactory(db);
   const certificateBodyDAL = certificateBodyDALFactory(db);
   const certificateSecretDAL = certificateSecretDALFactory(db);
+  const certificateSyncDAL = certificateSyncDALFactory(db);
 
   const pkiAlertDAL = pkiAlertDALFactory(db);
   const pkiCollectionDAL = pkiCollectionDALFactory(db);
@@ -1704,7 +1711,8 @@ export const registerRoutes = async (
     licenseService,
     permissionService,
     kmsService,
-    membershipIdentityDAL
+    membershipIdentityDAL,
+    orgDAL
   });
 
   const identityAwsAuthService = identityAwsAuthServiceFactory({
@@ -1957,6 +1965,8 @@ export const registerRoutes = async (
     secretImportDAL,
     permissionService,
     appConnectionService,
+    projectDAL,
+    orgDAL,
     folderDAL,
     secretSyncQueue,
     projectBotService,
@@ -2019,7 +2029,8 @@ export const registerRoutes = async (
     certificateBodyDAL,
     certificateSecretDAL,
     certificateAuthorityDAL,
-    certificateAuthorityCertDAL
+    certificateAuthorityCertDAL,
+    certificateSyncDAL
   });
 
   const pkiSyncCleanup = pkiSyncCleanupQueueServiceFactory({
@@ -2130,17 +2141,29 @@ export const registerRoutes = async (
     permissionService,
     pkiCollectionDAL,
     pkiCollectionItemDAL,
+    certificateSyncDAL,
     pkiSyncDAL,
     pkiSyncQueue
   });
 
   const certificateV3Service = certificateV3ServiceFactory({
     certificateDAL,
+    certificateSecretDAL,
     certificateAuthorityDAL,
     certificateProfileDAL,
     certificateTemplateV2Service,
     internalCaService: internalCertificateAuthorityService,
-    permissionService
+    permissionService,
+    certificateSyncDAL,
+    pkiSyncDAL,
+    pkiSyncQueue
+  });
+
+  const certificateV3Queue = certificateV3QueueServiceFactory({
+    queueService,
+    certificateDAL,
+    certificateV3Service,
+    auditLogService
   });
 
   const certificateEstV3Service = certificateEstV3ServiceFactory({
@@ -2175,6 +2198,8 @@ export const registerRoutes = async (
 
   const pkiSyncService = pkiSyncServiceFactory({
     pkiSyncDAL,
+    certificateDAL,
+    certificateSyncDAL,
     pkiSubscriberDAL,
     appConnectionService,
     permissionService,
@@ -2330,6 +2355,7 @@ export const registerRoutes = async (
   await dailyReminderQueueService.startSecretReminderMigrationJob();
   await dailyExpiringPkiItemAlert.startSendingAlerts();
   await pkiSubscriberQueue.startDailyAutoRenewalJob();
+  await certificateV3Queue.init();
   await kmsService.startService(hsmStatus);
   await microsoftTeamsService.start();
   await dynamicSecretQueueService.init();

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -48,6 +48,7 @@ import {
   ChecklyConnectionListItemSchema,
   SanitizedChecklyConnectionSchema
 } from "@app/services/app-connection/checkly";
+import { ChefConnectionListItemSchema, SanitizedChefConnectionSchema } from "@app/services/app-connection/chef";
 import {
   CloudflareConnectionListItemSchema,
   SanitizedCloudflareConnectionSchema
@@ -88,6 +89,10 @@ import {
   NetlifyConnectionListItemSchema,
   SanitizedNetlifyConnectionSchema
 } from "@app/services/app-connection/netlify";
+import {
+  NorthflankConnectionListItemSchema,
+  SanitizedNorthflankConnectionSchema
+} from "@app/services/app-connection/northflank";
 import { OktaConnectionListItemSchema, SanitizedOktaConnectionSchema } from "@app/services/app-connection/okta";
 import {
   PostgresConnectionListItemSchema,
@@ -160,10 +165,12 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedSupabaseConnectionSchema.options,
   ...SanitizedDigitalOceanConnectionSchema.options,
   ...SanitizedNetlifyConnectionSchema.options,
+  ...SanitizedNorthflankConnectionSchema.options,
   ...SanitizedOktaConnectionSchema.options,
   ...SanitizedAzureADCSConnectionSchema.options,
   ...SanitizedRedisConnectionSchema.options,
-  ...SanitizedLaravelForgeConnectionSchema.options
+  ...SanitizedLaravelForgeConnectionSchema.options,
+  ...SanitizedChefConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -203,10 +210,12 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   SupabaseConnectionListItemSchema,
   DigitalOceanConnectionListItemSchema,
   NetlifyConnectionListItemSchema,
+  NorthflankConnectionListItemSchema,
   OktaConnectionListItemSchema,
   AzureADCSConnectionListItemSchema,
   RedisConnectionListItemSchema,
-  LaravelForgeConnectionListItemSchema
+  LaravelForgeConnectionListItemSchema,
+  ChefConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/chef-connection-router.ts

@@ -0,0 +1,85 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateChefConnectionSchema,
+  SanitizedChefConnectionSchema,
+  UpdateChefConnectionSchema
+} from "@app/services/app-connection/chef";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerChefConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.Chef,
+    server,
+    sanitizedResponseSchema: SanitizedChefConnectionSchema,
+    createSchema: CreateChefConnectionSchema,
+    updateSchema: UpdateChefConnectionSchema
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/data-bags`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const dataBags = await server.services.appConnection.chef.listDataBags(connectionId, req.permission);
+
+      return dataBags;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/data-bag-items`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      querystring: z.object({
+        dataBagName: z.string()
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const { dataBagName } = req.query;
+      const dataBagItems = await server.services.appConnection.chef.listDataBagItems(
+        connectionId,
+        dataBagName,
+        req.permission
+      );
+
+      return dataBagItems;
+    }
+  });
+};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -13,6 +13,7 @@ import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connect
 import { registerBitbucketConnectionRouter } from "./bitbucket-connection-router";
 import { registerCamundaConnectionRouter } from "./camunda-connection-router";
 import { registerChecklyConnectionRouter } from "./checkly-connection-router";
+import { registerChefConnectionRouter } from "./chef-connection-router";
 import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
 import { registerDigitalOceanConnectionRouter } from "./digital-ocean-connection-router";
@@ -29,6 +30,7 @@ import { registerLdapConnectionRouter } from "./ldap-connection-router";
 import { registerMsSqlConnectionRouter } from "./mssql-connection-router";
 import { registerMySqlConnectionRouter } from "./mysql-connection-router";
 import { registerNetlifyConnectionRouter } from "./netlify-connection-router";
+import { registerNorthflankConnectionRouter } from "./northflank-connection-router";
 import { registerOktaConnectionRouter } from "./okta-connection-router";
 import { registerPostgresConnectionRouter } from "./postgres-connection-router";
 import { registerRailwayConnectionRouter } from "./railway-connection-router";
@@ -83,6 +85,8 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.Supabase]: registerSupabaseConnectionRouter,
     [AppConnection.DigitalOcean]: registerDigitalOceanConnectionRouter,
     [AppConnection.Netlify]: registerNetlifyConnectionRouter,
+    [AppConnection.Northflank]: registerNorthflankConnectionRouter,
     [AppConnection.Okta]: registerOktaConnectionRouter,
-    [AppConnection.Redis]: registerRedisConnectionRouter
+    [AppConnection.Redis]: registerRedisConnectionRouter,
+    [AppConnection.Chef]: registerChefConnectionRouter
   };

backend/src/server/routes/v1/app-connection-routers/northflank-connection-router.ts

@@ -0,0 +1,87 @@
+import { z } from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateNorthflankConnectionSchema,
+  SanitizedNorthflankConnectionSchema,
+  UpdateNorthflankConnectionSchema
+} from "@app/services/app-connection/northflank";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerNorthflankConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.Northflank,
+    server,
+    sanitizedResponseSchema: SanitizedNorthflankConnectionSchema,
+    createSchema: CreateNorthflankConnectionSchema,
+    updateSchema: UpdateNorthflankConnectionSchema
+  });
+
+  // The below endpoints are not exposed and for Infisical App use
+  server.route({
+    method: "GET",
+    url: `/:connectionId/projects`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          projects: z
+            .object({
+              name: z.string(),
+              id: z.string()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const projects = await server.services.appConnection.northflank.listProjects(connectionId, req.permission);
+      return { projects };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/projects/:projectId/secret-groups`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid(),
+        projectId: z.string()
+      }),
+      response: {
+        200: z.object({
+          secretGroups: z
+            .object({
+              name: z.string(),
+              id: z.string()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId, projectId } = req.params;
+      const secretGroups = await server.services.appConnection.northflank.listSecretGroups(
+        connectionId,
+        projectId,
+        req.permission
+      );
+      return { secretGroups };
+    }
+  });
+};

backend/src/server/routes/v1/certificate-profiles-router.ts

@@ -42,7 +42,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
           apiConfig: z
             .object({
               autoRenew: z.boolean().default(false),
-              autoRenewDays: z.number().min(1).max(365).optional()
+              renewBeforeDays: z.number().min(1).max(30).optional()
             })
             .optional()
         })
@@ -121,9 +121,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         limit: z.coerce.number().min(1).max(100).default(20),
         search: z.string().optional(),
         enrollmentType: z.nativeEnum(EnrollmentType).optional(),
-        caId: z.string().uuid().optional(),
-        includeMetrics: z.coerce.boolean().optional().default(false),
-        expiringDays: z.coerce.number().min(1).max(365).optional().default(7)
+        caId: z.string().uuid().optional()
       }),
       response: {
         200: z.object({
@@ -150,7 +148,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
               .object({
                 id: z.string(),
                 autoRenew: z.boolean(),
-                autoRenewDays: z.number().optional()
+                renewBeforeDays: z.number().optional()
               })
               .optional()
           }).array(),
@@ -195,10 +193,6 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       params: z.object({
         id: z.string().uuid()
       }),
-      querystring: z.object({
-        includeMetrics: z.coerce.boolean().optional().default(false),
-        expiringDays: z.coerce.number().min(1).max(365).optional().default(7)
-      }),
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
@@ -230,17 +224,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
               .object({
                 id: z.string(),
                 autoRenew: z.boolean(),
-                autoRenewDays: z.number().optional()
-              })
-              .optional(),
-            metrics: z
-              .object({
-                profileId: z.string(),
-                totalCertificates: z.number(),
-                activeCertificates: z.number(),
-                expiredCertificates: z.number(),
-                expiringCertificates: z.number(),
-                revokedCertificates: z.number()
+                renewBeforeDays: z.number().optional()
               })
               .optional()
           })
@@ -257,20 +241,6 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         profileId: req.params.id
       });
 
-      let result = certificateProfile;
-
-      if (req.query.includeMetrics) {
-        const metrics = await server.services.certificateProfile.getProfileMetrics({
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId,
-          profileId: req.params.id,
-          expiringDays: req.query.expiringDays
-        });
-        result = { ...certificateProfile, metrics };
-      }
-
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         projectId: certificateProfile.projectId,
@@ -283,7 +253,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         }
       });
 
-      return { certificateProfile: result };
+      return { certificateProfile };
     }
   });
 
@@ -355,7 +325,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
           apiConfig: z
             .object({
               autoRenew: z.boolean().default(false),
-              autoRenewDays: z.number().min(1).max(365).optional()
+              renewBeforeDays: z.number().min(1).max(30).optional()
             })
             .optional()
         })

backend/src/server/routes/v1/organization-router.ts

@@ -323,7 +323,11 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
           .min(1, "Max Shared Secret view count cannot be lower than 1")
           .max(1000, "Max Shared Secret view count cannot exceed 1000")
           .nullable()
+          .optional(),
+        blockDuplicateSecretSyncDestinations: z
+          .boolean()
           .optional()
+          .describe("Block duplicate secret sync destinations across the organization")
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/pki-sync-routers/pki-sync-endpoints.ts

@@ -26,7 +26,7 @@ export const registerSyncPkiEndpoints = ({
     syncOptions?: Record<string, unknown>;
     description?: string;
     isAutoSyncEnabled?: boolean;
-    subscriberId?: string;
+    subscriberId?: string | null;
   }>;
   updateSchema: z.ZodType<{
     connectionId?: string;
@@ -35,7 +35,7 @@ export const registerSyncPkiEndpoints = ({
     syncOptions?: Record<string, unknown>;
     description?: string;
     isAutoSyncEnabled?: boolean;
-    subscriberId?: string;
+    subscriberId?: string | null;
   }>;
   responseSchema: z.ZodTypeAny;
   syncOptions: {

backend/src/server/routes/v1/pki-sync-routers/pki-sync-router.ts

@@ -2,10 +2,11 @@ import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags } from "@app/lib/api-docs";
-import { readLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { PkiSync } from "@app/services/pki-sync/pki-sync-enums";
 
 const PkiSyncSchema = z.object({
@@ -60,7 +61,8 @@ const PkiSyncSchema = z.object({
       name: z.string()
     })
     .nullable()
-    .optional()
+    .optional(),
+  hasCertificate: z.boolean().optional()
 });
 
 const PkiSyncOptionsSchema = z.object({
@@ -76,6 +78,27 @@ const PkiSyncOptionsSchema = z.object({
   minCertificateNameLength: z.number().optional()
 });
 
+const PkiSyncCertificateSchema = z.object({
+  id: z.string().uuid(),
+  pkiSyncId: z.string().uuid(),
+  certificateId: z.string().uuid(),
+  syncStatus: z.nativeEnum(CertificateSyncStatus),
+  lastSyncMessage: z.string().nullable().optional(),
+  lastSyncedAt: z.date().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  certificateSerialNumber: z.string().optional(),
+  certificateCommonName: z.string().optional(),
+  certificateAltNames: z.string().optional(),
+  certificateStatus: z.string().optional(),
+  certificateNotBefore: z.date().optional(),
+  certificateNotAfter: z.date().optional(),
+  certificateRenewBeforeDays: z.number().nullish(),
+  certificateRenewalError: z.string().nullish(),
+  pkiSyncName: z.string().optional(),
+  pkiSyncDestination: z.string().optional()
+});
+
 export const registerPkiSyncRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
@@ -111,7 +134,8 @@ export const registerPkiSyncRouter = async (server: FastifyZodProvider) => {
       tags: [ApiDocsTags.PkiSyncs],
       description: "List all the PKI Syncs for the specified project.",
       querystring: z.object({
-        projectId: z.string().trim().min(1)
+        projectId: z.string().trim().min(1),
+        certificateId: z.string().uuid().optional()
       }),
       response: {
         200: z.object({ pkiSyncs: PkiSyncSchema.array() })
@@ -120,11 +144,11 @@ export const registerPkiSyncRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const {
-        query: { projectId },
+        query: { projectId, certificateId },
         permission
       } = req;
 
-      const pkiSyncs = await server.services.pkiSync.listPkiSyncsByProjectId({ projectId }, permission);
+      const pkiSyncs = await server.services.pkiSync.listPkiSyncsByProjectId({ projectId, certificateId }, permission);
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
@@ -179,4 +203,163 @@ export const registerPkiSyncRouter = async (server: FastifyZodProvider) => {
       return pkiSync;
     }
   });
+
+  server.route({
+    method: "GET",
+    url: "/:pkiSyncId/certificates",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiSyncs],
+      description: "List all certificates associated with a PKI Sync.",
+      params: z.object({
+        pkiSyncId: z.string().uuid()
+      }),
+      querystring: z.object({
+        offset: z.coerce.number().min(0).default(0),
+        limit: z.coerce.number().min(1).max(100).default(20)
+      }),
+      response: {
+        200: z.object({
+          certificates: PkiSyncCertificateSchema.array(),
+          totalCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { pkiSyncId } = req.params;
+      const { offset, limit } = req.query;
+
+      const { certificates, totalCount, pkiSyncInfo } = await server.services.pkiSync.listPkiSyncCertificates(
+        { pkiSyncId, offset, limit },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: pkiSyncInfo.projectId,
+        event: {
+          type: EventType.GET_PKI_SYNC_CERTIFICATES,
+          metadata: {
+            syncId: pkiSyncId,
+            destination: pkiSyncInfo.destination,
+            count: certificates.length,
+            certificateIds: certificates.map((c) => c.certificateId)
+          }
+        }
+      });
+
+      return { certificates, totalCount };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/:pkiSyncId/certificates",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiSyncs],
+      description: "Add certificates to a PKI Sync.",
+      params: z.object({
+        pkiSyncId: z.string().uuid()
+      }),
+      body: z.object({
+        certificateIds: z.array(z.string().uuid()).min(1, "At least one certificate ID is required")
+      }),
+      response: {
+        200: z.object({
+          addedCertificates: z.array(
+            z.object({
+              id: z.string().uuid(),
+              pkiSyncId: z.string().uuid(),
+              certificateId: z.string().uuid(),
+              syncStatus: z.string().default("pending").optional().nullable(),
+              lastSyncMessage: z.string().optional().nullable(),
+              lastSyncedAt: z.date().optional().nullable(),
+              createdAt: z.date(),
+              updatedAt: z.date()
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { pkiSyncId } = req.params;
+      const { certificateIds } = req.body;
+
+      const { addedCertificates, pkiSyncInfo } = await server.services.pkiSync.addCertificatesToPkiSync(
+        { pkiSyncId, certificateIds },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: pkiSyncInfo.projectId,
+        event: {
+          type: EventType.UPDATE_PKI_SYNC,
+          metadata: {
+            pkiSyncId,
+            name: pkiSyncInfo.name
+          }
+        }
+      });
+
+      return { addedCertificates };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:pkiSyncId/certificates",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiSyncs],
+      description: "Remove certificates from a PKI Sync.",
+      params: z.object({
+        pkiSyncId: z.string().uuid()
+      }),
+      body: z.object({
+        certificateIds: z.array(z.string().uuid()).min(1, "At least one certificate ID is required")
+      }),
+      response: {
+        200: z.object({
+          removedCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { pkiSyncId } = req.params;
+      const { certificateIds } = req.body;
+
+      const { removedCount, pkiSyncInfo } = await server.services.pkiSync.removeCertificatesFromPkiSync(
+        { pkiSyncId, certificateIds },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: pkiSyncInfo.projectId,
+        event: {
+          type: EventType.UPDATE_PKI_SYNC,
+          metadata: {
+            pkiSyncId,
+            name: pkiSyncInfo.name
+          }
+        }
+      });
+
+      return { removedCount };
+    }
+  });
 };

backend/src/server/routes/v1/project-router.ts

@@ -1195,12 +1195,17 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       querystring: z.object({
         friendlyName: z.string().optional().describe(PROJECTS.LIST_CERTIFICATES.friendlyName),
         commonName: z.string().optional().describe(PROJECTS.LIST_CERTIFICATES.commonName),
-        offset: z.coerce.number().min(0).max(100).default(0).describe(PROJECTS.LIST_CERTIFICATES.offset),
-        limit: z.coerce.number().min(1).max(100).default(25).describe(PROJECTS.LIST_CERTIFICATES.limit)
+        offset: z.coerce.number().min(0).default(0).describe(PROJECTS.LIST_CERTIFICATES.offset),
+        limit: z.coerce.number().min(1).max(100).default(25).describe(PROJECTS.LIST_CERTIFICATES.limit),
+        forPkiSync: z.coerce
+          .boolean()
+          .default(false)
+          .optional()
+          .describe("Retrieve only certificates available for PKI sync")
       }),
       response: {
         200: z.object({
-          certificates: z.array(CertificatesSchema),
+          certificates: z.array(CertificatesSchema.extend({ hasPrivateKey: z.boolean() })),
           totalCount: z.number()
         })
       }

backend/src/server/routes/v1/secret-sync-routers/chef-sync-router.ts

@@ -0,0 +1,13 @@
+import { ChefSyncSchema, CreateChefSyncSchema, UpdateChefSyncSchema } from "@app/services/secret-sync/chef";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+
+import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
+
+export const registerChefSyncRouter = async (server: FastifyZodProvider) =>
+  registerSyncSecretsEndpoints({
+    destination: SecretSync.Chef,
+    server,
+    responseSchema: ChefSyncSchema,
+    createSchema: CreateChefSyncSchema,
+    updateSchema: UpdateChefSyncSchema
+  });

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -10,6 +10,7 @@ import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
 import { registerBitbucketSyncRouter } from "./bitbucket-sync-router";
 import { registerCamundaSyncRouter } from "./camunda-sync-router";
 import { registerChecklySyncRouter } from "./checkly-sync-router";
+import { registerChefSyncRouter } from "./chef-sync-router";
 import { registerCloudflarePagesSyncRouter } from "./cloudflare-pages-sync-router";
 import { registerCloudflareWorkersSyncRouter } from "./cloudflare-workers-sync-router";
 import { registerDatabricksSyncRouter } from "./databricks-sync-router";
@@ -23,6 +24,7 @@ import { registerHerokuSyncRouter } from "./heroku-sync-router";
 import { registerHumanitecSyncRouter } from "./humanitec-sync-router";
 import { registerLaravelForgeSyncRouter } from "./laravel-forge-sync-router";
 import { registerNetlifySyncRouter } from "./netlify-sync-router";
+import { registerNorthflankSyncRouter } from "./northflank-sync-router";
 import { registerRailwaySyncRouter } from "./railway-sync-router";
 import { registerRenderSyncRouter } from "./render-sync-router";
 import { registerSupabaseSyncRouter } from "./supabase-sync-router";
@@ -64,6 +66,8 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
   [SecretSync.Checkly]: registerChecklySyncRouter,
   [SecretSync.DigitalOceanAppPlatform]: registerDigitalOceanAppPlatformSyncRouter,
   [SecretSync.Netlify]: registerNetlifySyncRouter,
+  [SecretSync.Northflank]: registerNorthflankSyncRouter,
   [SecretSync.Bitbucket]: registerBitbucketSyncRouter,
-  [SecretSync.LaravelForge]: registerLaravelForgeSyncRouter
+  [SecretSync.LaravelForge]: registerLaravelForgeSyncRouter,
+  [SecretSync.Chef]: registerChefSyncRouter
 };

backend/src/server/routes/v1/secret-sync-routers/northflank-sync-router.ts

@@ -0,0 +1,17 @@
+import {
+  CreateNorthflankSyncSchema,
+  NorthflankSyncSchema,
+  UpdateNorthflankSyncSchema
+} from "@app/services/secret-sync/northflank";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+
+import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
+
+export const registerNorthflankSyncRouter = async (server: FastifyZodProvider) =>
+  registerSyncSecretsEndpoints({
+    destination: SecretSync.Northflank,
+    server,
+    responseSchema: NorthflankSyncSchema,
+    createSchema: CreateNorthflankSyncSchema,
+    updateSchema: UpdateNorthflankSyncSchema
+  });

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -24,6 +24,7 @@ import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/s
 import { BitbucketSyncListItemSchema, BitbucketSyncSchema } from "@app/services/secret-sync/bitbucket";
 import { CamundaSyncListItemSchema, CamundaSyncSchema } from "@app/services/secret-sync/camunda";
 import { ChecklySyncListItemSchema, ChecklySyncSchema } from "@app/services/secret-sync/checkly/checkly-sync-schemas";
+import { ChefSyncListItemSchema, ChefSyncSchema } from "@app/services/secret-sync/chef";
 import {
   CloudflarePagesSyncListItemSchema,
   CloudflarePagesSyncSchema
@@ -46,6 +47,7 @@ import { HerokuSyncListItemSchema, HerokuSyncSchema } from "@app/services/secret
 import { HumanitecSyncListItemSchema, HumanitecSyncSchema } from "@app/services/secret-sync/humanitec";
 import { LaravelForgeSyncListItemSchema, LaravelForgeSyncSchema } from "@app/services/secret-sync/laravel-forge";
 import { NetlifySyncListItemSchema, NetlifySyncSchema } from "@app/services/secret-sync/netlify";
+import { NorthflankSyncListItemSchema, NorthflankSyncSchema } from "@app/services/secret-sync/northflank";
 import { RailwaySyncListItemSchema, RailwaySyncSchema } from "@app/services/secret-sync/railway/railway-sync-schemas";
 import { RenderSyncListItemSchema, RenderSyncSchema } from "@app/services/secret-sync/render/render-sync-schemas";
 import { SupabaseSyncListItemSchema, SupabaseSyncSchema } from "@app/services/secret-sync/supabase";
@@ -85,8 +87,10 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
   ChecklySyncSchema,
   DigitalOceanAppPlatformSyncSchema,
   NetlifySyncSchema,
+  NorthflankSyncSchema,
   BitbucketSyncSchema,
-  LaravelForgeSyncSchema
+  LaravelForgeSyncSchema,
+  ChefSyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
@@ -119,8 +123,10 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   ChecklySyncListItemSchema,
   SupabaseSyncListItemSchema,
   NetlifySyncListItemSchema,
+  NorthflankSyncListItemSchema,
   BitbucketSyncListItemSchema,
-  LaravelForgeSyncListItemSchema
+  LaravelForgeSyncListItemSchema,
+  ChefSyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/sso-router.ts

@@ -7,6 +7,7 @@
 // All the any rules are disabled because passport typesense with fastify is really poor
 
 import { Authenticator } from "@fastify/passport";
+import { requestContext } from "@fastify/request-context";
 import fastifySession from "@fastify/session";
 import RedisStore from "connect-redis";
 import { CronJob } from "cron";
@@ -21,6 +22,7 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { ms } from "@app/lib/ms";
 import { fetchGithubEmails, fetchGithubUser } from "@app/lib/requests/github";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { authRateLimit } from "@app/server/config/rateLimiter";
 import { addAuthOriginDomainCookie } from "@app/server/lib/cookie";
 import { AuthMethod } from "@app/services/auth/auth-type";
@@ -51,30 +53,54 @@ export const registerOauthMiddlewares = (server: FastifyZodProvider) => {
         },
         // eslint-disable-next-line
         async (req, _accessToken, _refreshToken, profile, cb) => {
-          try {
-            // @ts-expect-error this is because this is express type and not fastify
-            const callbackPort = req.session.get("callbackPort");
-            // @ts-expect-error this is because this is express type and not fastify
-            const orgSlug = req.session.get("orgSlug");
+          // @ts-expect-error this is because this is express type and not fastify
+          const callbackPort = req.session.get("callbackPort");
+          // @ts-expect-error this is because this is express type and not fastify
+          const orgSlug = req.session.get("orgSlug");
 
-            const email = profile?.emails?.[0]?.value;
-            if (!email)
-              throw new NotFoundError({
-                message: "Email not found",
-                name: "OauthGoogleRegister"
+          const email = profile?.emails?.[0]?.value;
+          if (!email)
+            throw new NotFoundError({
+              message: "Email not found",
+              name: "OauthGoogleRegister"
+            });
+
+          try {
+            const { isUserCompleted, providerAuthToken, user, orgId, orgName } =
+              await server.services.login.oauth2Login({
+                email,
+                firstName: profile?.name?.givenName || "",
+                lastName: profile?.name?.familyName || "",
+                authMethod: AuthMethod.GOOGLE,
+                callbackPort,
+                orgSlug
               });
 
-            const { isUserCompleted, providerAuthToken } = await server.services.login.oauth2Login({
-              email,
-              firstName: profile?.name?.givenName || "",
-              lastName: profile?.name?.familyName || "",
-              authMethod: AuthMethod.GOOGLE,
-              callbackPort,
-              orgSlug
-            });
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.user.id": user.id,
+                "infisical.organization.id": orgId,
+                "infisical.organization.name": orgName,
+                "infisical.auth.method": AuthAttemptAuthMethod.GOOGLE,
+                "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
+
             cb(null, { isUserCompleted, providerAuthToken });
           } catch (error) {
             logger.error(error);
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.auth.method": AuthAttemptAuthMethod.GOOGLE,
+                "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
             cb(error as Error, false);
           }
         }
@@ -101,27 +127,50 @@ export const registerOauthMiddlewares = (server: FastifyZodProvider) => {
         },
         // eslint-disable-next-line
         async (req: any, accessToken: string, _refreshToken: string, _profile: any, done: Function) => {
+          const ghEmails = await fetchGithubEmails(accessToken);
+          const { email } = ghEmails.filter((gitHubEmail) => gitHubEmail.primary)[0];
+
+          if (!email) throw new Error("No primary email found");
+
           try {
-            const ghEmails = await fetchGithubEmails(accessToken);
-            const { email } = ghEmails.filter((gitHubEmail) => gitHubEmail.primary)[0];
-
-            if (!email) throw new Error("No primary email found");
-
             // profile does not get automatically populated so we need to manually fetch user info
-            const user = await fetchGithubUser(accessToken);
+            const githubUser = await fetchGithubUser(accessToken);
 
             const callbackPort = req.session.get("callbackPort");
 
-            const { isUserCompleted, providerAuthToken } = await server.services.login.oauth2Login({
-              email,
-              firstName: user.name || user.login,
-              lastName: "",
-              authMethod: AuthMethod.GITHUB,
-              callbackPort
-            });
+            const { isUserCompleted, providerAuthToken, user, orgId, orgName } =
+              await server.services.login.oauth2Login({
+                email,
+                firstName: githubUser.name || githubUser.login,
+                lastName: "",
+                authMethod: AuthMethod.GITHUB,
+                callbackPort
+              });
+
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.user.id": user.id,
+                "infisical.organization.id": orgId,
+                "infisical.organization.name": orgName,
+                "infisical.auth.method": AuthAttemptAuthMethod.GITHUB,
+                "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
 
             done(null, { isUserCompleted, providerAuthToken, externalProviderAccessToken: accessToken });
           } catch (err) {
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.auth.method": AuthAttemptAuthMethod.GITHUB,
+                "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
             logger.error(err);
             done(err as Error, false);
           }
@@ -147,20 +196,45 @@ export const registerOauthMiddlewares = (server: FastifyZodProvider) => {
           pkce: true
         },
         async (req: any, _accessToken: string, _refreshToken: string, profile: any, cb: any) => {
+          const email = profile.emails[0].value;
+
           try {
             const callbackPort = req.session.get("callbackPort");
 
-            const email = profile.emails[0].value;
-            const { isUserCompleted, providerAuthToken } = await server.services.login.oauth2Login({
-              email,
-              firstName: profile.displayName || profile.username || "",
-              lastName: "",
-              authMethod: AuthMethod.GITLAB,
-              callbackPort
-            });
+            const { isUserCompleted, providerAuthToken, user, orgId, orgName } =
+              await server.services.login.oauth2Login({
+                email,
+                firstName: profile.displayName || profile.username || "",
+                lastName: "",
+                authMethod: AuthMethod.GITLAB,
+                callbackPort
+              });
+
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.user.id": user.id,
+                "infisical.organization.id": orgId,
+                "infisical.organization.name": orgName,
+                "infisical.auth.method": AuthAttemptAuthMethod.GITLAB,
+                "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
 
             return cb(null, { isUserCompleted, providerAuthToken });
           } catch (error) {
+            if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+              authAttemptCounter.add(1, {
+                "infisical.user.email": email,
+                "infisical.auth.method": AuthAttemptAuthMethod.GITLAB,
+                "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+                "client.address": requestContext.get("ip"),
+                "user_agent.original": requestContext.get("userAgent")
+              });
+            }
+
             logger.error(error);
             cb(error as Error, false);
           }

backend/src/server/routes/v3/certificates-router.ts

@@ -18,6 +18,7 @@ import {
   CertKeyUsageType,
   CertSubjectAlternativeNameType
 } from "@app/services/certificate-common/certificate-constants";
+import { extractCertificateRequestFromCSR } from "@app/services/certificate-common/certificate-csr-utils";
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
 
@@ -84,8 +85,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
               })
             )
             .optional(),
-          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm).optional(),
-          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).optional()
+          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm),
+          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
         })
         .refine(validateTtlAndDateFields, {
           message:
@@ -169,9 +170,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
             .min(1, "TTL cannot be empty")
             .refine((val) => ms(val) > 0, "TTL must be a positive number"),
           notBefore: validateCaDateField.optional(),
-          notAfter: validateCaDateField.optional(),
-          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm).optional(),
-          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).optional()
+          notAfter: validateCaDateField.optional()
         })
         .refine(validateTtlAndDateFields, {
           message:
@@ -192,6 +191,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
+      const certificateRequest = extractCertificateRequestFromCSR(req.body.csr);
+
       const data = await server.services.certificateV3.signCertificateFromProfile({
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -203,9 +204,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
           ttl: req.body.ttl
         },
         notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-        notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-        signatureAlgorithm: req.body.signatureAlgorithm,
-        keyAlgorithm: req.body.keyAlgorithm
+        notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined
       });
 
       await server.services.auditLog.createAuditLog({
@@ -217,7 +216,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
             certificateProfileId: req.body.profileId,
             certificateId: data.certificateId,
             profileName: data.profileName,
-            commonName: ""
+            commonName: certificateRequest.commonName || ""
           }
         }
       });
@@ -260,8 +259,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
           notBefore: validateCaDateField.optional(),
           notAfter: validateCaDateField.optional(),
           commonName: validateTemplateRegexField.optional(),
-          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm).optional(),
-          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).optional()
+          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm),
+          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
         })
         .refine(validateTtlAndDateFields, {
           message:
@@ -343,4 +342,145 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
       return data;
     }
   });
+
+  server.route({
+    method: "POST",
+    url: "/:certificateId/renew",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificates],
+      params: z.object({
+        certificateId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          certificate: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          privateKey: z.string().trim().optional(),
+          serialNumber: z.string().trim(),
+          certificateId: z.string()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const data = await server.services.certificateV3.renewCertificate({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        certificateId: req.params.certificateId
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: data.projectId,
+        event: {
+          type: EventType.RENEW_CERTIFICATE,
+          metadata: {
+            originalCertificateId: req.params.certificateId,
+            newCertificateId: data.certificateId,
+            profileName: data.profileName,
+            commonName: data.commonName
+          }
+        }
+      });
+
+      return data;
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:certificateId/config",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiCertificates],
+      params: z.object({
+        certificateId: z.string().uuid()
+      }),
+      body: z
+        .object({
+          renewBeforeDays: z.number().int().min(1).max(30).optional(),
+          enableAutoRenewal: z.boolean().optional()
+        })
+        .refine((data) => !(data.renewBeforeDays !== undefined && data.enableAutoRenewal === false), {
+          message: "Cannot specify both renewBeforeDays and enableAutoRenewal=false"
+        }),
+      response: {
+        200: z.object({
+          message: z.string(),
+          renewBeforeDays: z.number().optional()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      if (req.body.enableAutoRenewal === false) {
+        const data = await server.services.certificateV3.disableRenewalConfig({
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId,
+          certificateId: req.params.certificateId
+        });
+
+        await server.services.auditLog.createAuditLog({
+          ...req.auditLogInfo,
+          projectId: data.projectId,
+          event: {
+            type: EventType.DISABLE_CERTIFICATE_RENEWAL_CONFIG,
+            metadata: {
+              certificateId: req.params.certificateId,
+              commonName: data.commonName
+            }
+          }
+        });
+
+        return {
+          message: "Auto-renewal disabled successfully"
+        };
+      }
+
+      if (req.body.renewBeforeDays !== undefined) {
+        const data = await server.services.certificateV3.updateRenewalConfig({
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId,
+          certificateId: req.params.certificateId,
+          renewBeforeDays: req.body.renewBeforeDays
+        });
+
+        await server.services.auditLog.createAuditLog({
+          ...req.auditLogInfo,
+          projectId: data.projectId,
+          event: {
+            type: EventType.UPDATE_CERTIFICATE_RENEWAL_CONFIG,
+            metadata: {
+              certificateId: req.params.certificateId,
+              renewBeforeDays: req.body.renewBeforeDays.toString(),
+              commonName: data.commonName
+            }
+          }
+        });
+
+        return {
+          message: "Certificate configuration updated successfully",
+          renewBeforeDays: data.renewBeforeDays
+        };
+      }
+
+      return {
+        message: "No configuration changes requested"
+      };
+    }
+  });
 };

backend/src/server/routes/v3/external-migration-router.ts

@@ -393,6 +393,56 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     }
   });
 
+  server.route({
+    method: "GET",
+    url: "/vault/kubernetes-roles",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      querystring: z.object({
+        namespace: z.string(),
+        mountPath: z.string()
+      }),
+      response: {
+        200: z.object({
+          roles: z.array(
+            z.object({
+              name: z.string(),
+              mountPath: z.string(),
+              allowed_kubernetes_namespaces: z.array(z.string()).nullish(),
+              allowed_kubernetes_namespace_selector: z.string().nullish(),
+              token_max_ttl: z.number().nullish(),
+              token_default_ttl: z.number().nullish(),
+              token_default_audiences: z.array(z.string()).nullish(),
+              service_account_name: z.string().nullish(),
+              kubernetes_role_name: z.string().nullish(),
+              kubernetes_role_type: z.string().nullish(),
+              generated_role_rules: z.string().nullish(),
+              name_template: z.string().nullish(),
+              extra_annotations: z.record(z.string()).nullish(),
+              extra_labels: z.record(z.string()).nullish(),
+              config: z.object({
+                kubernetes_host: z.string(),
+                kubernetes_ca_cert: z.string().nullish()
+              })
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const roles = await server.services.migration.getVaultKubernetesRoles({
+        actor: req.permission,
+        namespace: req.query.namespace,
+        mountPath: req.query.mountPath
+      });
+
+      return { roles };
+    }
+  });
+
   server.route({
     method: "GET",
     url: "/vault/secret-paths",

backend/src/services/app-connection/app-connection-enums.ts

@@ -38,7 +38,9 @@ export enum AppConnection {
   Netlify = "netlify",
   Okta = "okta",
   Redis = "redis",
-  LaravelForge = "laravel-forge"
+  LaravelForge = "laravel-forge",
+  Chef = "chef",
+  Northflank = "northflank"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -68,6 +68,7 @@ import {
 } from "./bitbucket";
 import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
 import { ChecklyConnectionMethod, getChecklyConnectionListItem, validateChecklyConnectionCredentials } from "./checkly";
+import { ChefConnectionMethod, getChefConnectionListItem, validateChefConnectionCredentials } from "./chef";
 import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
 import {
   getCloudflareConnectionListItem,
@@ -113,6 +114,11 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
 import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
 import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getNetlifyConnectionListItem, validateNetlifyConnectionCredentials } from "./netlify";
+import {
+  getNorthflankConnectionListItem,
+  NorthflankConnectionMethod,
+  validateNorthflankConnectionCredentials
+} from "./northflank";
 import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
@@ -203,8 +209,10 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getSupabaseConnectionListItem(),
     getDigitalOceanConnectionListItem(),
     getNetlifyConnectionListItem(),
+    getNorthflankConnectionListItem(),
     getOktaConnectionListItem(),
-    getRedisConnectionListItem()
+    getRedisConnectionListItem(),
+    getChefConnectionListItem()
   ]
     .filter((option) => {
       switch (projectType) {
@@ -332,8 +340,10 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Checkly]: validateChecklyConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Supabase]: validateSupabaseConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.DigitalOcean]: validateDigitalOceanConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Northflank]: validateNorthflankConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Chef]: validateChefConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
@@ -376,6 +386,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case BitbucketConnectionMethod.ApiToken:
     case ZabbixConnectionMethod.ApiToken:
     case DigitalOceanConnectionMethod.ApiToken:
+    case NorthflankConnectionMethod.ApiToken:
     case OktaConnectionMethod.ApiToken:
     case LaravelForgeConnectionMethod.ApiToken:
       return "API Token";
@@ -401,6 +412,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case RenderConnectionMethod.ApiKey:
     case ChecklyConnectionMethod.ApiKey:
       return "API Key";
+    case ChefConnectionMethod.UserKey:
+      return "User Key";
     case SupabaseConnectionMethod.AccessToken:
       return "Access Token";
     default:
@@ -472,9 +485,11 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Supabase]: platformManagedCredentialsNotSupported,
   [AppConnection.DigitalOcean]: platformManagedCredentialsNotSupported,
   [AppConnection.Netlify]: platformManagedCredentialsNotSupported,
+  [AppConnection.Northflank]: platformManagedCredentialsNotSupported,
   [AppConnection.Okta]: platformManagedCredentialsNotSupported,
   [AppConnection.Redis]: platformManagedCredentialsNotSupported,
-  [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported
+  [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported,
+  [AppConnection.Chef]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (

backend/src/services/app-connection/app-connection-maps.ts

@@ -40,7 +40,9 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.DigitalOcean]: "DigitalOcean App Platform",
   [AppConnection.Netlify]: "Netlify",
   [AppConnection.Okta]: "Okta",
-  [AppConnection.Redis]: "Redis"
+  [AppConnection.Redis]: "Redis",
+  [AppConnection.Chef]: "Chef",
+  [AppConnection.Northflank]: "Northflank"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -83,5 +85,7 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.DigitalOcean]: AppConnectionPlanType.Regular,
   [AppConnection.Netlify]: AppConnectionPlanType.Regular,
   [AppConnection.Okta]: AppConnectionPlanType.Regular,
-  [AppConnection.Redis]: AppConnectionPlanType.Regular
+  [AppConnection.Redis]: AppConnectionPlanType.Regular,
+  [AppConnection.Chef]: AppConnectionPlanType.Regular,
+  [AppConnection.Northflank]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -67,6 +67,8 @@ import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
 import { ValidateChecklyConnectionCredentialsSchema } from "./checkly";
 import { checklyConnectionService } from "./checkly/checkly-connection-service";
+import { ValidateChefConnectionCredentialsSchema } from "./chef";
+import { chefConnectionService } from "./chef/chef-connection-service";
 import { ValidateCloudflareConnectionCredentialsSchema } from "./cloudflare/cloudflare-connection-schema";
 import { cloudflareConnectionService } from "./cloudflare/cloudflare-connection-service";
 import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
@@ -96,6 +98,8 @@ import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
 import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidateNetlifyConnectionCredentialsSchema } from "./netlify";
 import { netlifyConnectionService } from "./netlify/netlify-connection-service";
+import { ValidateNorthflankConnectionCredentialsSchema } from "./northflank";
+import { northflankConnectionService } from "./northflank/northflank-connection-service";
 import { ValidateOktaConnectionCredentialsSchema } from "./okta";
 import { oktaConnectionService } from "./okta/okta-connection-service";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
@@ -170,8 +174,10 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Supabase]: ValidateSupabaseConnectionCredentialsSchema,
   [AppConnection.DigitalOcean]: ValidateDigitalOceanConnectionCredentialsSchema,
   [AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
+  [AppConnection.Northflank]: ValidateNorthflankConnectionCredentialsSchema,
   [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
-  [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema
+  [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema,
+  [AppConnection.Chef]: ValidateChefConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -876,7 +882,9 @@ export const appConnectionServiceFactory = ({
     supabase: supabaseConnectionService(connectAppConnectionById),
     digitalOcean: digitalOceanAppPlatformConnectionService(connectAppConnectionById),
     netlify: netlifyConnectionService(connectAppConnectionById),
+    northflank: northflankConnectionService(connectAppConnectionById),
     okta: oktaConnectionService(connectAppConnectionById),
-    laravelForge: laravelForgeConnectionService(connectAppConnectionById)
+    laravelForge: laravelForgeConnectionService(connectAppConnectionById),
+    chef: chefConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -82,6 +82,12 @@ import {
   TChecklyConnectionInput,
   TValidateChecklyConnectionCredentialsSchema
 } from "./checkly";
+import {
+  TChefConnection,
+  TChefConnectionConfig,
+  TChefConnectionInput,
+  TValidateChefConnectionCredentialsSchema
+} from "./chef";
 import {
   TCloudflareConnection,
   TCloudflareConnectionConfig,
@@ -168,6 +174,12 @@ import {
   TNetlifyConnectionInput,
   TValidateNetlifyConnectionCredentialsSchema
 } from "./netlify";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankConnectionInput,
+  TValidateNorthflankConnectionCredentialsSchema
+} from "./northflank";
 import {
   TOktaConnection,
   TOktaConnectionConfig,
@@ -273,8 +285,10 @@ export type TAppConnection = { id: string } & (
   | TSupabaseConnection
   | TDigitalOceanConnection
   | TNetlifyConnection
+  | TNorthflankConnection
   | TOktaConnection
   | TRedisConnection
+  | TChefConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -320,8 +334,10 @@ export type TAppConnectionInput = { id: string } & (
   | TSupabaseConnectionInput
   | TDigitalOceanConnectionInput
   | TNetlifyConnectionInput
+  | TNorthflankConnectionInput
   | TOktaConnectionInput
   | TRedisConnectionInput
+  | TChefConnectionInput
 );
 
 export type TSqlConnectionInput =
@@ -385,8 +401,10 @@ export type TAppConnectionConfig =
   | TSupabaseConnectionConfig
   | TDigitalOceanConnectionConfig
   | TNetlifyConnectionConfig
+  | TNorthflankConnectionConfig
   | TOktaConnectionConfig
-  | TRedisConnectionConfig;
+  | TRedisConnectionConfig
+  | TChefConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -427,8 +445,10 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateSupabaseConnectionCredentialsSchema
   | TValidateDigitalOceanCredentialsSchema
   | TValidateNetlifyConnectionCredentialsSchema
+  | TValidateNorthflankConnectionCredentialsSchema
   | TValidateOktaConnectionCredentialsSchema
-  | TValidateRedisConnectionCredentialsSchema;
+  | TValidateRedisConnectionCredentialsSchema
+  | TValidateChefConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/chef/chef-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum ChefConnectionMethod {
+  UserKey = "user-key"
+}

backend/src/services/app-connection/chef/chef-connection-fns.ts

@@ -0,0 +1,288 @@
+import { AxiosError } from "axios";
+import crypto from "crypto";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { removeTrailingSlash } from "@app/lib/fn";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { TChefDataBagItemContent } from "../../secret-sync/chef/chef-sync-types";
+import { AppConnection } from "../app-connection-enums";
+import { ChefConnectionMethod } from "./chef-connection-enums";
+import {
+  TChefConnection,
+  TChefConnectionConfig,
+  TChefDataBag,
+  TChefDataBagItem,
+  TGetChefDataBagItem,
+  TUpdateChefDataBagItem
+} from "./chef-connection-types";
+
+export const getChefServerUrl = async (serverUrl?: string) => {
+  const chefServerUrl = serverUrl ? removeTrailingSlash(serverUrl) : IntegrationUrls.CHEF_API_URL;
+
+  await blockLocalAndPrivateIpAddresses(chefServerUrl);
+
+  return chefServerUrl;
+};
+
+// Helper to ensure private key is in proper PEM format
+const formatPrivateKey = (key: string): string => {
+  let formattedKey = key.trim();
+
+  // Ensure proper line breaks in PEM format (handle escaped newlines)
+  formattedKey = formattedKey.replace(/\\n/g, "\n");
+
+  // Remove any extra whitespace between lines
+  formattedKey = formattedKey.replace(/\n\s+/g, "\n");
+
+  // If key doesn't have headers, add PKCS#1 RSA headers
+  if (!formattedKey.includes("BEGIN")) {
+    formattedKey = `-----BEGIN RSA PRIVATE KEY-----\n${formattedKey}\n-----END RSA PRIVATE KEY-----`;
+  }
+
+  // Ensure the key has proper line breaks after headers and before footers
+  formattedKey = formattedKey.replace(/(-----BEGIN[^-]+-----)\s*/g, "$1\n").replace(/\s*(-----END[^-]+-----)/g, "\n$1");
+
+  // Remove any duplicate newlines
+  formattedKey = formattedKey.replace(/\n{3,}/g, "\n\n");
+
+  return formattedKey;
+};
+
+const getChefAuthHeaders = (
+  method: string,
+  path: string,
+  body: string,
+  userId: string,
+  privateKey: string,
+  apiVersion: "1.0" | "1.3" = "1.3"
+) => {
+  const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, "Z"); // Remove milliseconds from timestamp
+
+  // Calculate content hash based on version
+  let contentHash: string;
+  if (apiVersion === "1.3") {
+    contentHash = crypto.createHash("sha256").update(body).digest("base64");
+  } else {
+    contentHash = crypto.createHash("sha1").update(body).digest("base64");
+  }
+
+  // Build canonical request based on version
+  let canonicalRequest: string;
+  if (apiVersion === "1.3") {
+    canonicalRequest = [
+      `Method:${method}`,
+      `Path:${path}`,
+      `X-Ops-Content-Hash:${contentHash}`,
+      "X-Ops-Sign:version=1.3",
+      `X-Ops-Timestamp:${timestamp}`,
+      `X-Ops-UserId:${userId}`,
+      "X-Ops-Server-API-Version:1"
+    ].join("\n");
+  } else {
+    const hashedPath = crypto.createHash("sha1").update(path).digest("base64");
+    canonicalRequest = [
+      `Method:${method}`,
+      `Hashed Path:${hashedPath}`,
+      `X-Ops-Content-Hash:${contentHash}`,
+      `X-Ops-Timestamp:${timestamp}`,
+      `X-Ops-UserId:${userId}`
+    ].join("\n");
+  }
+
+  // Format the private key properly
+  const formattedKey = formatPrivateKey(privateKey);
+
+  // Sign the canonical request
+  const sign = crypto.createSign(apiVersion === "1.3" ? "RSA-SHA256" : "RSA-SHA1");
+  sign.update(canonicalRequest);
+  const signature = sign.sign(formattedKey, "base64");
+
+  // Split signature into 60-character chunks
+  const authHeaders: Record<string, string> = {};
+  const signatureLines = signature.match(/.{1,60}/g) || [];
+  signatureLines.forEach((line, index) => {
+    authHeaders[`X-Ops-Authorization-${index + 1}`] = line;
+  });
+
+  return {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+    "X-Chef-Version": "14.0.0",
+    "X-Ops-Timestamp": timestamp,
+    "X-Ops-UserId": userId,
+    "X-Ops-Sign": apiVersion === "1.3" ? "version=1.3" : "algorithm=sha1;version=1.0",
+    "X-Ops-Content-Hash": contentHash,
+    ...(apiVersion === "1.3" && { "X-Ops-Server-API-Version": "1" }),
+    ...authHeaders
+  };
+};
+
+export const getChefConnectionListItem = () => {
+  return {
+    name: "Chef" as const,
+    app: AppConnection.Chef as const,
+    methods: Object.values(ChefConnectionMethod) as [ChefConnectionMethod.UserKey]
+  };
+};
+
+export const validateChefConnectionCredentials = async (config: TChefConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  try {
+    const path = `/organizations/${inputCredentials.orgName}/users/${inputCredentials.userName}`;
+
+    const hostServerUrl = await getChefServerUrl(inputCredentials.serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, "", inputCredentials.userName, inputCredentials.privateKey);
+
+    await request.get(`${hostServerUrl}${path}`, {
+      headers
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate Chef credentials: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate Chef connection: verify credentials"
+    });
+  }
+
+  return inputCredentials;
+};
+
+export const listChefDataBags = async (appConnection: TChefConnection): Promise<TChefDataBag[]> => {
+  const {
+    credentials: { serverUrl, userName, privateKey, orgName }
+  } = appConnection;
+
+  try {
+    const path = `/organizations/${orgName}/data`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<Record<string, string>>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return Object.keys(res.data).map((name) => ({
+      name
+    }));
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Chef data bags: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list Chef data bags"
+    });
+  }
+};
+
+export const listChefDataBagItems = async (
+  appConnection: TChefConnection,
+  dataBagName: string
+): Promise<TChefDataBagItem[]> => {
+  const {
+    credentials: { serverUrl, userName, privateKey, orgName }
+  } = appConnection;
+
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<Record<string, string>>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return Object.keys(res.data).map((name) => ({
+      name
+    }));
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Chef data bag items: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list Chef data bag items"
+    });
+  }
+};
+
+export const getChefDataBagItem = async ({
+  serverUrl,
+  userName,
+  privateKey,
+  orgName,
+  dataBagName,
+  dataBagItemName
+}: TGetChefDataBagItem): Promise<TChefDataBagItemContent> => {
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}/${dataBagItemName}`;
+    const body = "";
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("GET", path, body, userName, privateKey);
+
+    const res = await request.get<TChefDataBagItemContent>(`${hostServerUrl}${path}`, {
+      headers
+    });
+
+    return res.data;
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to get Chef data bag item: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to get Chef data bag item"
+    });
+  }
+};
+
+export const updateChefDataBagItem = async ({
+  serverUrl,
+  userName,
+  privateKey,
+  orgName,
+  dataBagName,
+  dataBagItemName,
+  data
+}: TUpdateChefDataBagItem): Promise<void> => {
+  try {
+    const path = `/organizations/${orgName}/data/${dataBagName}/${dataBagItemName}`;
+    const body = JSON.stringify(data);
+
+    const hostServerUrl = await getChefServerUrl(serverUrl);
+
+    const headers = getChefAuthHeaders("PUT", path, body, userName, privateKey);
+
+    await request.put(`${hostServerUrl}${path}`, data, {
+      headers
+    });
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to update Chef data bag item: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to update Chef data bag item"
+    });
+  }
+};

backend/src/services/app-connection/chef/chef-connection-schemas.ts

@@ -0,0 +1,77 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { ChefConnectionMethod } from "./chef-connection-enums";
+
+export const ChefConnectionUserKeyCredentialsSchema = z.object({
+  serverUrl: z
+    .string()
+    .trim()
+    .url("Valid Chef Server URL required")
+    .optional()
+    .describe(AppConnections.CREDENTIALS.CHEF.serverUrl),
+  orgName: z
+    .string()
+    .trim()
+    .min(1, "Organization name required")
+    .max(256, "Organization name cannot exceed 256 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.orgName),
+  userName: z
+    .string()
+    .trim()
+    .min(1, "User name required")
+    .max(256, "User name cannot exceed 256 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.userName),
+  privateKey: z
+    .string()
+    .trim()
+    .min(1, "Private key required")
+    .max(16384, "Private key cannot exceed 16384 characters")
+    .describe(AppConnections.CREDENTIALS.CHEF.privateKey)
+});
+
+const BaseChefConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Chef) });
+
+export const ChefConnectionSchema = BaseChefConnectionSchema.extend({
+  method: z.literal(ChefConnectionMethod.UserKey),
+  credentials: ChefConnectionUserKeyCredentialsSchema
+});
+
+export const SanitizedChefConnectionSchema = z.discriminatedUnion("method", [
+  BaseChefConnectionSchema.extend({
+    method: z.literal(ChefConnectionMethod.UserKey),
+    credentials: ChefConnectionUserKeyCredentialsSchema.pick({ serverUrl: true, orgName: true, userName: true })
+  })
+]);
+
+export const ValidateChefConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(ChefConnectionMethod.UserKey).describe(AppConnections.CREATE(AppConnection.Chef).method),
+    credentials: ChefConnectionUserKeyCredentialsSchema.describe(AppConnections.CREATE(AppConnection.Chef).credentials)
+  })
+]);
+
+export const CreateChefConnectionSchema = ValidateChefConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Chef)
+);
+
+export const UpdateChefConnectionSchema = z
+  .object({
+    credentials: ChefConnectionUserKeyCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Chef).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Chef));
+
+export const ChefConnectionListItemSchema = z.object({
+  name: z.literal("Chef"),
+  app: z.literal(AppConnection.Chef),
+  methods: z.nativeEnum(ChefConnectionMethod).array()
+});

backend/src/services/app-connection/chef/chef-connection-service.ts

@@ -0,0 +1,39 @@
+import { ForbiddenRequestError } from "@app/lib/errors";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listChefDataBagItems, listChefDataBags } from "./chef-connection-fns";
+import { TChefConnection } from "./chef-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TChefConnection>;
+
+export const chefConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listDataBags = async (appConnectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
+
+    if (!appConnection) {
+      throw new ForbiddenRequestError({ message: "App connection not found" });
+    }
+
+    return listChefDataBags(appConnection);
+  };
+
+  const listDataBagItems = async (appConnectionId: string, dataBagName: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
+
+    if (!appConnection) {
+      throw new ForbiddenRequestError({ message: "App connection not found" });
+    }
+
+    return listChefDataBagItems(appConnection, dataBagName);
+  };
+
+  return {
+    listDataBags,
+    listDataBagItems
+  };
+};

backend/src/services/app-connection/chef/chef-connection-types.ts

@@ -0,0 +1,50 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+import { TChefDataBagItemContent } from "@app/services/secret-sync/chef";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  ChefConnectionSchema,
+  CreateChefConnectionSchema,
+  ValidateChefConnectionCredentialsSchema
+} from "./chef-connection-schemas";
+
+export type TChefConnection = z.infer<typeof ChefConnectionSchema>;
+
+export type TChefConnectionInput = z.infer<typeof CreateChefConnectionSchema> & {
+  app: AppConnection.Chef;
+};
+
+export type TValidateChefConnectionCredentialsSchema = typeof ValidateChefConnectionCredentialsSchema;
+
+export type TChefConnectionConfig = DiscriminativePick<TChefConnectionInput, "method" | "app" | "credentials"> & {
+  orgName: string;
+};
+
+export type TChefDataBag = {
+  name: string;
+};
+
+export type TChefDataBagItem = {
+  name: string;
+};
+
+export type TGetChefDataBagItem = {
+  serverUrl?: string;
+  userName: string;
+  privateKey: string;
+  orgName: string;
+  dataBagName: string;
+  dataBagItemName: string;
+};
+
+export type TUpdateChefDataBagItem = {
+  serverUrl?: string;
+  userName: string;
+  privateKey: string;
+  orgName: string;
+  dataBagName: string;
+  dataBagItemName: string;
+  data: TChefDataBagItemContent;
+};

backend/src/services/app-connection/chef/index.ts

@@ -0,0 +1,4 @@
+export * from "./chef-connection-enums";
+export * from "./chef-connection-fns";
+export * from "./chef-connection-schemas";
+export * from "./chef-connection-types";

backend/src/services/app-connection/gitlab/gitlab-connection-enums.ts

@@ -5,5 +5,6 @@ export enum GitLabConnectionMethod {
 
 export enum GitLabAccessTokenType {
   Project = "project",
-  Personal = "personal"
+  Personal = "personal",
+  Group = "group"
 }

backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts

@@ -21,6 +21,8 @@ import {
   THCVaultKubernetesAuthConfig,
   THCVaultKubernetesAuthRole,
   THCVaultKubernetesAuthRoleWithConfig,
+  THCVaultKubernetesRole,
+  THCVaultKubernetesSecretsConfig,
   THCVaultMount,
   THCVaultMountResponse
 } from "./hc-vault-connection-types";
@@ -816,3 +818,122 @@ export const getHCVaultKubernetesAuthRoles = async (
     });
   }
 };
+
+export const getHCVaultKubernetesRoles = async (
+  namespace: string,
+  mountPath: string,
+  connection: THCVaultConnection,
+  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">
+): Promise<THCVaultKubernetesRole[]> => {
+  // Remove trailing slash from mount path
+  const cleanMountPath = mountPath.endsWith("/") ? mountPath.slice(0, -1) : mountPath;
+
+  try {
+    const instanceUrl = await getHCVaultInstanceUrl(connection);
+    const accessToken = await getHCVaultAccessToken(connection, gatewayService);
+    // 1. Get the Kubernetes secrets engine configuration for this mount
+    const { data: configResponse } = await requestWithHCVaultGateway<{ data: THCVaultKubernetesSecretsConfig }>(
+      connection,
+      gatewayService,
+      {
+        url: `${instanceUrl}/v1/${cleanMountPath}/config`,
+        method: "GET",
+        headers: {
+          "X-Vault-Token": accessToken,
+          "X-Vault-Namespace": namespace
+        }
+      }
+    );
+
+    const kubernetesConfig = configResponse.data;
+
+    // 2. List all roles in this mount
+    let roleNames: string[] = [];
+    try {
+      const { data: roleListResponse } = await requestWithHCVaultGateway<{ data: { keys: string[] } }>(
+        connection,
+        gatewayService,
+        {
+          url: `${instanceUrl}/v1/${cleanMountPath}/roles?list=true`,
+          method: "GET",
+          headers: {
+            "X-Vault-Token": accessToken,
+            "X-Vault-Namespace": namespace
+          }
+        }
+      );
+      roleNames = roleListResponse.data.keys || [];
+    } catch (error) {
+      // Vault returns 404 when no roles are configured yet
+      if (error && typeof error === "object" && "response" in error) {
+        const axiosError = error as { response?: { status?: number } };
+        if (axiosError.response?.status === 404) {
+          return [];
+        }
+      }
+
+      throw error;
+    }
+
+    if (!roleNames || roleNames.length === 0) {
+      return [];
+    }
+
+    // 3. Fetch details for each role with concurrency control
+    const limiter = createConcurrencyLimiter(HC_VAULT_CONCURRENCY_LIMIT);
+
+    const roleDetailsPromises = roleNames.map((roleName) =>
+      limiter(async () => {
+        const { data: roleResponse } = await requestWithHCVaultGateway<{
+          data: {
+            allowed_kubernetes_namespaces?: string[];
+            allowed_kubernetes_namespace_selector?: string;
+            token_max_ttl?: number;
+            token_default_ttl?: number;
+            token_default_audiences?: string[];
+            service_account_name?: string;
+            kubernetes_role_name?: string;
+            kubernetes_role_type?: string;
+            generated_role_rules?: string;
+            name_template?: string;
+            extra_annotations?: Record<string, string>;
+            extra_labels?: Record<string, string>;
+          };
+        }>(connection, gatewayService, {
+          url: `${instanceUrl}/v1/${cleanMountPath}/roles/${roleName}`,
+          method: "GET",
+          headers: {
+            "X-Vault-Token": accessToken,
+            "X-Vault-Namespace": namespace
+          }
+        });
+
+        // 4. Merge the role with the config
+        return {
+          ...roleResponse.data,
+          name: roleName,
+          config: kubernetesConfig,
+          mountPath: cleanMountPath
+        } as THCVaultKubernetesRole;
+      })
+    );
+
+    const roles = await Promise.all(roleDetailsPromises);
+
+    return roles;
+  } catch (error: unknown) {
+    logger.error(error, "Unable to list HC Vault Kubernetes secrets engine roles");
+
+    if (error instanceof AxiosError) {
+      const errorMessage =
+        (error.response?.data as { errors?: string[] })?.errors?.[0] || error.message || "Unknown error";
+      throw new BadRequestError({
+        message: `Failed to list Kubernetes secrets engine roles: ${errorMessage}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Kubernetes secrets engine roles from HashiCorp Vault"
+    });
+  }
+};

backend/src/services/app-connection/hc-vault/hc-vault-connection-types.ts

@@ -95,3 +95,26 @@ export type THCVaultKubernetesAuthRoleWithConfig = THCVaultKubernetesAuthRole &
   config: THCVaultKubernetesAuthConfig;
   mountPath: string;
 };
+
+export type THCVaultKubernetesSecretsConfig = {
+  kubernetes_host: string;
+  kubernetes_ca_cert?: string;
+};
+
+export type THCVaultKubernetesRole = {
+  name: string;
+  allowed_kubernetes_namespaces?: string[];
+  allowed_kubernetes_namespace_selector?: string;
+  token_max_ttl?: number;
+  token_default_ttl?: number;
+  token_default_audiences?: string[];
+  service_account_name?: string;
+  kubernetes_role_name?: string;
+  kubernetes_role_type?: string;
+  generated_role_rules?: string;
+  name_template?: string;
+  extra_annotations?: Record<string, string>;
+  extra_labels?: Record<string, string>;
+  config: THCVaultKubernetesSecretsConfig;
+  mountPath: string;
+};

backend/src/services/app-connection/northflank/index.ts

@@ -0,0 +1,5 @@
+export * from "./northflank-connection-enums";
+export * from "./northflank-connection-fns";
+export * from "./northflank-connection-schemas";
+export * from "./northflank-connection-service";
+export * from "./northflank-connection-types";

backend/src/services/app-connection/northflank/northflank-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum NorthflankConnectionMethod {
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/northflank/northflank-connection-fns.ts

@@ -0,0 +1,114 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankProject,
+  TNorthflankSecretGroup
+} from "./northflank-connection-types";
+
+const NORTHFLANK_API_URL = "https://api.northflank.com";
+
+export const getNorthflankConnectionListItem = () => {
+  return {
+    name: "Northflank" as const,
+    app: AppConnection.Northflank as const,
+    methods: Object.values(NorthflankConnectionMethod)
+  };
+};
+
+export const validateNorthflankConnectionCredentials = async (config: TNorthflankConnectionConfig) => {
+  const { credentials } = config;
+
+  try {
+    await request.get(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate Northflank credentials: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: `Failed to validate Northflank credentials - verify API token is correct`
+    });
+  }
+
+  return credentials;
+};
+
+export const listProjects = async (appConnection: TNorthflankConnection): Promise<TNorthflankProject[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { projects }
+      }
+    } = await request.get<{ data: { projects: TNorthflankProject[] } }>(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+
+    return projects;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank projects: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank projects",
+      error
+    });
+  }
+};
+
+export const listSecretGroups = async (
+  appConnection: TNorthflankConnection,
+  projectId: string
+): Promise<TNorthflankSecretGroup[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { secrets }
+      }
+    } = await request.get<{ data: { secrets: TNorthflankSecretGroup[] } }>(
+      `${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets`,
+      {
+        headers: {
+          Authorization: `Bearer ${credentials.apiToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+
+    return secrets;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank secret groups: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank secret groups",
+      error
+    });
+  }
+};

backend/src/services/app-connection/northflank/northflank-connection-schemas.ts

@@ -0,0 +1,60 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+
+export const NorthflankConnectionApiTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.NORTHFLANK.apiToken)
+});
+
+const BaseNorthflankConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.Northflank)
+});
+
+export const NorthflankConnectionSchema = BaseNorthflankConnectionSchema.extend({
+  method: z.literal(NorthflankConnectionMethod.ApiToken),
+  credentials: NorthflankConnectionApiTokenCredentialsSchema
+});
+
+export const SanitizedNorthflankConnectionSchema = z.discriminatedUnion("method", [
+  BaseNorthflankConnectionSchema.extend({
+    method: z.literal(NorthflankConnectionMethod.ApiToken),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.pick({})
+  })
+]);
+
+export const ValidateNorthflankConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(NorthflankConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.Northflank).method),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Northflank).credentials
+    )
+  })
+]);
+
+export const CreateNorthflankConnectionSchema = ValidateNorthflankConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Northflank)
+);
+
+export const UpdateNorthflankConnectionSchema = z
+  .object({
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Northflank).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Northflank));
+
+export const NorthflankConnectionListItemSchema = z.object({
+  name: z.literal("Northflank"),
+  app: z.literal(AppConnection.Northflank),
+  methods: z.nativeEnum(NorthflankConnectionMethod).array()
+});

backend/src/services/app-connection/northflank/northflank-connection-service.ts

@@ -0,0 +1,50 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  listProjects as getNorthflankProjects,
+  listSecretGroups as getNorthflankSecretGroups
+} from "./northflank-connection-fns";
+import { TNorthflankConnection, TNorthflankSecretGroup } from "./northflank-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TNorthflankConnection>;
+
+export const northflankConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const projects = await getNorthflankProjects(appConnection);
+
+      return projects;
+    } catch (error) {
+      logger.error({ error, connectionId, actor: actor.type }, "Failed to establish connection with Northflank");
+      return [];
+    }
+  };
+
+  const listSecretGroups = async (
+    connectionId: string,
+    projectId: string,
+    actor: OrgServiceActor
+  ): Promise<TNorthflankSecretGroup[]> => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const secretGroups = await getNorthflankSecretGroups(appConnection, projectId);
+
+      return secretGroups;
+    } catch (error) {
+      logger.error({ error, connectionId, projectId, actor: actor.type }, "Failed to list Northflank secret groups");
+      return [];
+    }
+  };
+
+  return {
+    listProjects,
+    listSecretGroups
+  };
+};

backend/src/services/app-connection/northflank/northflank-connection-types.ts

@@ -0,0 +1,35 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateNorthflankConnectionSchema,
+  NorthflankConnectionSchema,
+  ValidateNorthflankConnectionCredentialsSchema
+} from "./northflank-connection-schemas";
+
+export type TNorthflankConnection = z.infer<typeof NorthflankConnectionSchema>;
+
+export type TNorthflankConnectionInput = z.infer<typeof CreateNorthflankConnectionSchema> & {
+  app: AppConnection.Northflank;
+};
+
+export type TValidateNorthflankConnectionCredentialsSchema = typeof ValidateNorthflankConnectionCredentialsSchema;
+
+export type TNorthflankConnectionConfig = DiscriminativePick<
+  TNorthflankConnection,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TNorthflankProject = {
+  id: string;
+  name: string;
+};
+
+export type TNorthflankSecretGroup = {
+  id: string;
+  name: string;
+};

backend/src/services/auth-token/auth-token-service.ts

@@ -210,6 +210,7 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
     if (!user || !user.isAccepted) throw new NotFoundError({ message: `User with ID '${session.userId}' not found` });
 
     let orgId = "";
+    let orgName = "";
     let rootOrgId = "";
     let parentOrgId = "";
     if (token.organizationId) {
@@ -235,9 +236,11 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
           throw new ForbiddenRequestError({ message: "User organization membership is inactive" });
         }
         orgId = subOrganization.id;
+        orgName = subOrganization.name;
         rootOrgId = token.organizationId;
         parentOrgId = subOrganization.parentOrgId as string;
       } else {
+        const organization = await orgDAL.findOne({ id: token.organizationId });
         const orgMembership = await membershipUserDAL.findOne({
           actorUserId: user.id,
           scopeOrgId: token.organizationId,
@@ -253,12 +256,13 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, membershipUserDAL, orgD
         }
 
         orgId = token.organizationId;
+        orgName = organization.name;
         rootOrgId = token.organizationId;
         parentOrgId = token.organizationId;
       }
     }
 
-    return { user, tokenVersionId: token.tokenVersionId, orgId, rootOrgId, parentOrgId };
+    return { user, tokenVersionId: token.tokenVersionId, orgId, orgName, rootOrgId, parentOrgId };
   };
 
   return {

backend/src/services/auth/auth-login-service.ts

@@ -16,6 +16,7 @@ import { getUserPrivateKey } from "@app/lib/crypto/srp";
 import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 import { getMinExpiresIn, removeTrailingSlash } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
+import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 
@@ -385,63 +386,94 @@ export const authLoginServiceFactory = ({
     providerAuthToken?: string;
     captchaToken?: string;
   }) => {
-    const usersByUsername = await userDAL.findUserEncKeyByUsername({
-      username: email
-    });
-    const userEnc =
-      usersByUsername?.length > 1 ? usersByUsername.find((el) => el.username === email) : usersByUsername?.[0];
+    const appCfg = getConfig();
 
-    if (!userEnc) throw new BadRequestError({ message: "User not found" });
+    try {
+      const usersByUsername = await userDAL.findUserEncKeyByUsername({
+        username: email
+      });
+      const userEnc =
+        usersByUsername?.length > 1 ? usersByUsername.find((el) => el.username === email) : usersByUsername?.[0];
 
-    if (userEnc.encryptionVersion !== UserEncryption.V2) {
-      throw new BadRequestError({ message: "Legacy encryption scheme not supported", name: "LegacyEncryptionScheme" });
-    }
+      if (!userEnc) throw new BadRequestError({ message: "User not found" });
 
-    if (!userEnc.hashedPassword) {
-      if (userEnc.authMethods?.includes(AuthMethod.EMAIL)) {
+      if (userEnc.encryptionVersion !== UserEncryption.V2) {
         throw new BadRequestError({
           message: "Legacy encryption scheme not supported",
           name: "LegacyEncryptionScheme"
         });
       }
 
-      throw new BadRequestError({ message: "No password found" });
-    }
-
-    const { authMethod, organizationId } = getAuthMethodAndOrgId(email, providerAuthToken);
-    await verifyCaptcha(userEnc, captchaToken);
-
-    if (!(await crypto.hashing().compareHash(password, userEnc.hashedPassword))) {
-      await userDAL.update(
-        { id: userEnc.userId },
-        {
-          $incr: {
-            consecutiveFailedPasswordAttempts: 1
-          }
+      if (!userEnc.hashedPassword) {
+        if (userEnc.authMethods?.includes(AuthMethod.EMAIL)) {
+          throw new BadRequestError({
+            message: "Legacy encryption scheme not supported",
+            name: "LegacyEncryptionScheme"
+          });
         }
-      );
 
-      throw new BadRequestError({ message: "Invalid username or email" });
+        throw new BadRequestError({ message: "No password found" });
+      }
+
+      const { authMethod, organizationId } = getAuthMethodAndOrgId(email, providerAuthToken);
+      await verifyCaptcha(userEnc, captchaToken);
+
+      if (!(await crypto.hashing().compareHash(password, userEnc.hashedPassword))) {
+        await userDAL.update(
+          { id: userEnc.userId },
+          {
+            $incr: {
+              consecutiveFailedPasswordAttempts: 1
+            }
+          }
+        );
+
+        throw new BadRequestError({ message: "Invalid username or email" });
+      }
+
+      const token = await generateUserTokens({
+        user: {
+          ...userEnc,
+          id: userEnc.userId
+        },
+        ip,
+        userAgent,
+        authMethod,
+        organizationId
+      });
+
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.organization.id": organizationId,
+          "infisical.user.email": email,
+          "infisical.user.id": userEnc.userId,
+          "infisical.auth.method": AuthAttemptAuthMethod.EMAIL,
+          "infisical.auth.result": AuthAttemptAuthResult.SUCCESS,
+          "client.address": ip,
+          "user_agent.original": userAgent
+        });
+      }
+
+      return {
+        tokens: {
+          accessToken: token.access,
+          refreshToken: token.refresh
+        },
+        user: userEnc
+      } as const;
+    } catch (error) {
+      if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
+        authAttemptCounter.add(1, {
+          "infisical.user.email": email,
+          "infisical.auth.method": AuthAttemptAuthMethod.EMAIL,
+          "infisical.auth.result": AuthAttemptAuthResult.FAILURE,
+          "client.address": ip,
+          "user_agent.original": userAgent
+        });
+      }
+
+      throw error;
     }
-
-    const token = await generateUserTokens({
-      user: {
-        ...userEnc,
-        id: userEnc.userId
-      },
-      ip,
-      userAgent,
-      authMethod,
-      organizationId
-    });
-
-    return {
-      tokens: {
-        accessToken: token.access,
-        refreshToken: token.refresh
-      },
-      user: userEnc
-    } as const;
   };
 
   const selectOrganization = async ({
@@ -965,7 +997,8 @@ export const authLoginServiceFactory = ({
         expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME
       }
     );
-    return { isUserCompleted, providerAuthToken };
+
+    return { isUserCompleted, providerAuthToken, user, orgId, orgName };
   };
 
   /**

backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts

@@ -192,7 +192,7 @@ export const castDbEntryToAzureAdCsCertificateAuthority = (
   ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
 ): TAzureAdCsCertificateAuthority & { credentials: unknown } => {
   if (!ca.externalCa?.id) {
-    throw new BadRequestError({ message: "Malformed Azure AD Certificate Service certificate authority" });
+    throw new BadRequestError({ message: "Malformed Active Directory Certificate Service certificate authority" });
   }
 
   if (!ca.externalCa.dnsAppConnectionId) {
@@ -776,7 +776,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
 
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(subscriber.caId);
     if (!ca.externalCa || ca.externalCa.type !== CaType.AZURE_AD_CS) {
-      throw new BadRequestError({ message: "CA is not an Azure AD Certificate Service CA" });
+      throw new BadRequestError({ message: "CA is not an Active Directory Certificate Service CA" });
     }
 
     const azureCa = castDbEntryToAzureAdCsCertificateAuthority(ca);

backend/src/services/certificate-authority/certificate-authority-maps.ts

@@ -2,8 +2,8 @@ import { CaCapability, CaType } from "./certificate-authority-enums";
 
 export const CERTIFICATE_AUTHORITIES_TYPE_MAP: Record<CaType, string> = {
   [CaType.INTERNAL]: "Internal",
-  [CaType.ACME]: "ACME",
-  [CaType.AZURE_AD_CS]: "Azure AD Certificate Service"
+  [CaType.ACME]: "ACME-compatible CA",
+  [CaType.AZURE_AD_CS]: "Active Directory Certificate Service"
 };
 
 export const CERTIFICATE_AUTHORITIES_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -2,12 +2,14 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 import slugify from "@sindresorhus/slugify";
+import { Knex } from "knex";
 
 import { ActionProjectType, TableName, TCertificateAuthorities, TCertificateTemplates } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionActions,
   ProjectPermissionCertificateActions,
+  ProjectPermissionCertificateProfileActions,
   ProjectPermissionPkiTemplateActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
@@ -1180,7 +1182,9 @@ export const internalCertificateAuthorityServiceFactory = ({
     extendedKeyUsages,
     signatureAlgorithm,
     keyAlgorithm,
-    isFromProfile
+    isFromProfile,
+    internal = false,
+    tx
   }: TIssueCertFromCaDTO) => {
     let ca: TCertificateAuthorityWithAssociatedCa | undefined;
     let certificateTemplate: TCertificateTemplates | undefined;
@@ -1210,19 +1214,28 @@ export const internalCertificateAuthorityServiceFactory = ({
       throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
     }
 
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId: ca.projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.CertificateManager
-    });
+    if (!internal) {
+      const { permission } = await permissionService.getProjectPermission({
+        actor,
+        actorId,
+        projectId: ca.projectId,
+        actorAuthMethod,
+        actorOrgId,
+        actionProjectType: ActionProjectType.CertificateManager
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionCertificateActions.Create,
-      ProjectPermissionSub.Certificates
-    );
+      if (isFromProfile) {
+        ForbiddenError.from(permission).throwUnlessCan(
+          ProjectPermissionCertificateProfileActions.IssueCert,
+          ProjectPermissionSub.CertificateProfiles
+        );
+      } else {
+        ForbiddenError.from(permission).throwUnlessCan(
+          ProjectPermissionCertificateActions.Create,
+          ProjectPermissionSub.Certificates
+        );
+      }
+    }
 
     if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.internalCa.activeCaCertId)
@@ -1473,7 +1486,7 @@ export const internalCertificateAuthorityServiceFactory = ({
       plainText: Buffer.from(certificateChainPem)
     });
 
-    await certificateDAL.transaction(async (tx) => {
+    const executeIssueCertOperations = async (transaction: Knex) => {
       const cert = await certificateDAL.create(
         {
           caId: (ca as TCertificateAuthorities).id,
@@ -1488,9 +1501,11 @@ export const internalCertificateAuthorityServiceFactory = ({
           notAfter: notAfterDate,
           keyUsages: selectedKeyUsages,
           extendedKeyUsages: selectedExtendedKeyUsages,
-          projectId: ca!.projectId
+          projectId: ca!.projectId,
+          keyAlgorithm: effectiveKeyAlgorithm,
+          signatureAlgorithm: signatureAlgorithm || ca!.internalCa!.keyAlgorithm
         },
-        tx
+        transaction
       );
 
       await certificateBodyDAL.create(
@@ -1499,7 +1514,7 @@ export const internalCertificateAuthorityServiceFactory = ({
           encryptedCertificate,
           encryptedCertificateChain
         },
-        tx
+        transaction
       );
 
       await certificateSecretDAL.create(
@@ -1507,7 +1522,7 @@ export const internalCertificateAuthorityServiceFactory = ({
           certId: cert.id,
           encryptedPrivateKey
         },
-        tx
+        transaction
       );
 
       if (collectionId) {
@@ -1516,12 +1531,18 @@ export const internalCertificateAuthorityServiceFactory = ({
             pkiCollectionId: collectionId,
             certId: cert.id
           },
-          tx
+          transaction
         );
       }
 
       return cert;
-    });
+    };
+
+    if (tx) {
+      await executeIssueCertOperations(tx);
+    } else {
+      await certificateDAL.transaction(executeIssueCertOperations);
+    }
 
     return {
       certificate: leafCert.toString("pem"),
@@ -1593,10 +1614,17 @@ export const internalCertificateAuthorityServiceFactory = ({
         actionProjectType: ActionProjectType.CertificateManager
       });
 
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionCertificateActions.Create,
-        ProjectPermissionSub.Certificates
-      );
+      if (dto.isFromProfile && dto.profileId) {
+        ForbiddenError.from(permission).throwUnlessCan(
+          ProjectPermissionCertificateProfileActions.IssueCert,
+          ProjectPermissionSub.CertificateProfiles
+        );
+      } else {
+        ForbiddenError.from(permission).throwUnlessCan(
+          ProjectPermissionCertificateActions.Create,
+          ProjectPermissionSub.Certificates
+        );
+      }
     }
 
     if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
@@ -1700,7 +1728,8 @@ export const internalCertificateAuthorityServiceFactory = ({
       certificateAuthorityDAL,
       certificateAuthoritySecretDAL,
       projectDAL,
-      kmsService
+      kmsService,
+      signatureAlgorithm: alg
     });
 
     const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });
@@ -1917,7 +1946,9 @@ export const internalCertificateAuthorityServiceFactory = ({
           notAfter: notAfterDate,
           keyUsages: selectedKeyUsages,
           extendedKeyUsages: selectedExtendedKeyUsages,
-          projectId: ca!.projectId
+          projectId: ca!.projectId,
+          keyAlgorithm: keyAlgorithm || ca!.internalCa!.keyAlgorithm,
+          signatureAlgorithm: signatureAlgorithm || ca!.internalCa!.keyAlgorithm
         },
         tx
       );

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -1,3 +1,4 @@
+import { Knex } from "knex";
 import { z } from "zod";
 
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
@@ -139,6 +140,9 @@ export type TIssueCertFromCaDTO = {
   signatureAlgorithm?: CertSignatureAlgorithm;
   keyAlgorithm?: CertKeyAlgorithm;
   isFromProfile?: boolean;
+  profileId?: string;
+  internal?: boolean;
+  tx?: Knex;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TSignCertFromCaDTO =
@@ -159,6 +163,7 @@ export type TSignCertFromCaDTO =
       signatureAlgorithm?: string;
       keyAlgorithm?: string;
       isFromProfile?: boolean;
+      profileId?: string;
     }
   | ({
       isInternal: false;
@@ -177,6 +182,7 @@ export type TSignCertFromCaDTO =
       signatureAlgorithm?: string;
       keyAlgorithm?: string;
       isFromProfile?: boolean;
+      profileId?: string;
     } & Omit<TProjectPermission, "projectId">);
 
 export type TGetCaCertificateTemplatesDTO = {

backend/src/services/certificate-common/certificate-constants.ts

@@ -175,6 +175,26 @@ export enum CertSignatureAlgorithm {
   ECDSA_SHA512 = "ECDSA-SHA512"
 }
 
+export enum CertificateRenewalErrorType {
+  TEMPLATE_VALIDATION_FAILED = "TEMPLATE_VALIDATION_FAILED",
+  CA_NOT_FOUND = "CA_NOT_FOUND",
+  CA_INACTIVE = "CA_INACTIVE",
+  CERTIFICATE_OUTLIVES_CA = "CERTIFICATE_OUTLIVES_CA",
+  TTL_TOO_SHORT = "TTL_TOO_SHORT",
+  NOT_ELIGIBLE = "NOT_ELIGIBLE",
+  VALIDITY_EXCEEDS_MAXIMUM = "VALIDITY_EXCEEDS_MAXIMUM",
+  NOT_ALLOWED_BY_TEMPLATE = "NOT_ALLOWED_BY_TEMPLATE",
+  UNKNOWN_ERROR = "UNKNOWN_ERROR"
+}
+
+export const CERTIFICATE_RENEWAL_CONFIG = {
+  MIN_RENEW_BEFORE_DAYS: 1,
+  MAX_RENEW_BEFORE_DAYS: 30,
+  QUEUE_BATCH_SIZE: 100,
+  DAILY_CRON_SCHEDULE: "0 0 * * *",
+  QUEUE_START_DELAY_MS: 5000
+} as const;
+
 export const SAN_TYPE_OPTIONS = Object.values(CertSubjectAlternativeNameType);
 export const KEY_USAGE_OPTIONS = Object.values(CertKeyUsageType);
 export const EXTENDED_KEY_USAGE_OPTIONS = Object.values(CertExtendedKeyUsageType);

backend/src/services/certificate-common/certificate-csr-utils.ts

@@ -0,0 +1,183 @@
+import * as x509 from "@peculiar/x509";
+
+import { BadRequestError } from "@app/lib/errors";
+
+import {
+  CertExtendedKeyUsageOIDToName,
+  CertKeyAlgorithm,
+  CertKeyUsage,
+  CertSignatureAlgorithm,
+  mapLegacyAltNameType,
+  TAltNameMapping,
+  TAltNameType
+} from "../certificate/certificate-types";
+import { parseDistinguishedName } from "../certificate-authority/certificate-authority-fns";
+import { validateAndMapAltNameType } from "../certificate-authority/certificate-authority-validators";
+import { TCertificateRequest } from "../certificate-template-v2/certificate-template-v2-types";
+import { mapLegacyExtendedKeyUsageToStandard, mapLegacyKeyUsageToStandard } from "./certificate-constants";
+
+/**
+ * Extracts certificate request data from a CSR string
+ * @param csr - The CSR in PEM format
+ * @returns TCertificateRequest object with parsed CSR data
+ */
+export const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => {
+  const csrObj = new x509.Pkcs10CertificateRequest(csr);
+  const subject = parseDistinguishedName(csrObj.subject);
+
+  const certificateRequest: TCertificateRequest = {
+    commonName: subject.commonName,
+    organization: subject.organization,
+    organizationUnit: subject.ou,
+    locality: subject.locality,
+    state: subject.province,
+    country: subject.country
+  };
+
+  const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
+  if (csrKeyUsageExtension) {
+    const csrKeyUsages = Object.values(CertKeyUsage).filter(
+      // eslint-disable-next-line no-bitwise
+      (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
+    );
+    certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard);
+  }
+
+  const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
+  if (csrExtendedKeyUsageExtension) {
+    const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages.map(
+      (ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string]
+    );
+    certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard);
+  }
+
+  const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
+  if (sanExtension) {
+    const sanNames = new x509.GeneralNames(sanExtension.value);
+    const altNamesArray: TAltNameMapping[] = sanNames.items
+      .filter(
+        (value) =>
+          value.type === TAltNameType.EMAIL ||
+          value.type === TAltNameType.DNS ||
+          value.type === TAltNameType.IP ||
+          value.type === TAltNameType.URL
+      )
+      .map((name): TAltNameMapping => {
+        const altNameType = validateAndMapAltNameType(name.value);
+        if (!altNameType) {
+          throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` });
+        }
+        return altNameType;
+      });
+
+    certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({
+      type: mapLegacyAltNameType(altName.type),
+      value: altName.value
+    }));
+  }
+
+  return certificateRequest;
+};
+
+/**
+ * Extracts the key algorithm and signature algorithm from a CSR
+ * @param csr - The CSR in PEM format
+ * @returns Object containing keyAlgorithm and signatureAlgorithm
+ */
+export const extractAlgorithmsFromCSR = (csr: string) => {
+  const csrObj = new x509.Pkcs10CertificateRequest(csr);
+
+  // Extract key algorithm from public key
+  const { publicKey } = csrObj;
+  let keyAlgorithm: CertKeyAlgorithm;
+
+  if (publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+    const rsaPublicKey = publicKey as unknown as { algorithm: { modulusLength: number } };
+    const keySize = rsaPublicKey.algorithm.modulusLength;
+    switch (keySize) {
+      case 2048:
+        keyAlgorithm = CertKeyAlgorithm.RSA_2048;
+        break;
+      case 3072:
+        keyAlgorithm = CertKeyAlgorithm.RSA_3072;
+        break;
+      case 4096:
+        keyAlgorithm = CertKeyAlgorithm.RSA_4096;
+        break;
+      default:
+        throw new BadRequestError({
+          message: `Unsupported RSA key size in CSR: ${keySize}. Supported: 2048, 3072, 4096`
+        });
+    }
+  } else if (publicKey.algorithm.name === "ECDSA") {
+    const ecPublicKey = publicKey as unknown as { algorithm: { namedCurve: string } };
+    const { namedCurve } = ecPublicKey.algorithm;
+    switch (namedCurve) {
+      case "P-256":
+        keyAlgorithm = CertKeyAlgorithm.ECDSA_P256;
+        break;
+      case "P-384":
+        keyAlgorithm = CertKeyAlgorithm.ECDSA_P384;
+        break;
+      case "P-521":
+        keyAlgorithm = CertKeyAlgorithm.ECDSA_P521;
+        break;
+      default:
+        throw new BadRequestError({
+          message: `Unsupported ECDSA curve in CSR: ${namedCurve}. Supported: P-256, P-384, P-521`
+        });
+    }
+  } else {
+    throw new BadRequestError({
+      message: `Unsupported key algorithm in CSR: ${publicKey.algorithm.name}. Supported: RSASSA-PKCS1-v1_5, ECDSA`
+    });
+  }
+
+  const signatureAlgorithm = csrObj.signatureAlgorithm.name;
+  const hashName = (csrObj.signatureAlgorithm as unknown as { hash?: { name: string } }).hash?.name;
+
+  let normalizedSignatureAlg: CertSignatureAlgorithm;
+
+  if (signatureAlgorithm === "RSASSA-PKCS1-v1_5") {
+    switch (hashName) {
+      case "SHA-256":
+        normalizedSignatureAlg = CertSignatureAlgorithm.RSA_SHA256;
+        break;
+      case "SHA-384":
+        normalizedSignatureAlg = CertSignatureAlgorithm.RSA_SHA384;
+        break;
+      case "SHA-512":
+        normalizedSignatureAlg = CertSignatureAlgorithm.RSA_SHA512;
+        break;
+      default:
+        throw new BadRequestError({
+          message: `Unsupported RSA hash algorithm in CSR: ${hashName}. Supported: SHA-256, SHA-384, SHA-512`
+        });
+    }
+  } else if (signatureAlgorithm === "ECDSA") {
+    switch (hashName) {
+      case "SHA-256":
+        normalizedSignatureAlg = CertSignatureAlgorithm.ECDSA_SHA256;
+        break;
+      case "SHA-384":
+        normalizedSignatureAlg = CertSignatureAlgorithm.ECDSA_SHA384;
+        break;
+      case "SHA-512":
+        normalizedSignatureAlg = CertSignatureAlgorithm.ECDSA_SHA512;
+        break;
+      default:
+        throw new BadRequestError({
+          message: `Unsupported ECDSA hash algorithm in CSR: ${hashName}. Supported: SHA-256, SHA-384, SHA-512`
+        });
+    }
+  } else {
+    throw new BadRequestError({
+      message: `Unsupported signature algorithm in CSR: ${signatureAlgorithm}. Supported: RSASSA-PKCS1-v1_5, ECDSA`
+    });
+  }
+
+  return {
+    keyAlgorithm,
+    signatureAlgorithm: normalizedSignatureAlg
+  };
+};

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

@@ -3,31 +3,15 @@ import * as x509 from "@peculiar/x509";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
 import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { isCertChainValid } from "@app/services/certificate/certificate-fns";
-import {
-  CertExtendedKeyUsageOIDToName,
-  CertKeyUsage,
-  mapLegacyAltNameType,
-  TAltNameMapping,
-  TAltNameType
-} from "@app/services/certificate/certificate-types";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
-import {
-  getCaCertChain,
-  getCaCertChains,
-  parseDistinguishedName
-} from "@app/services/certificate-authority/certificate-authority-fns";
-import { validateAndMapAltNameType } from "@app/services/certificate-authority/certificate-authority-validators";
+import { getCaCertChain, getCaCertChains } from "@app/services/certificate-authority/certificate-authority-fns";
 import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
-import {
-  mapLegacyExtendedKeyUsageToStandard,
-  mapLegacyKeyUsageToStandard
-} from "@app/services/certificate-common/certificate-constants";
+import { extractCertificateRequestFromCSR } from "@app/services/certificate-common/certificate-csr-utils";
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
 import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
-import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
 import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
@@ -61,63 +45,6 @@ export const certificateEstV3ServiceFactory = ({
   certificateProfileDAL,
   estEnrollmentConfigDAL
 }: TCertificateEstV3ServiceFactoryDep) => {
-  const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => {
-    const csrObj = new x509.Pkcs10CertificateRequest(csr);
-    const subject = parseDistinguishedName(csrObj.subject);
-
-    const certificateRequest: TCertificateRequest = {
-      commonName: subject.commonName,
-      organization: subject.organization,
-      organizationUnit: subject.ou,
-      locality: subject.locality,
-      state: subject.province,
-      country: subject.country
-    };
-
-    const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
-    if (csrKeyUsageExtension) {
-      const csrKeyUsages = Object.values(CertKeyUsage).filter(
-        // eslint-disable-next-line no-bitwise
-        (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
-      );
-      certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard);
-    }
-
-    const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
-    if (csrExtendedKeyUsageExtension) {
-      const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages.map(
-        (ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string]
-      );
-      certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard);
-    }
-
-    const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
-    if (sanExtension) {
-      const sanNames = new x509.GeneralNames(sanExtension.value);
-      const altNamesArray: TAltNameMapping[] = sanNames.items
-        .filter(
-          (value) =>
-            value.type === TAltNameType.EMAIL ||
-            value.type === TAltNameType.DNS ||
-            value.type === TAltNameType.IP ||
-            value.type === TAltNameType.URL
-        )
-        .map((name): TAltNameMapping => {
-          const altNameType = validateAndMapAltNameType(name.value);
-          if (!altNameType) {
-            throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` });
-          }
-          return altNameType;
-        });
-
-      certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({
-        type: mapLegacyAltNameType(altName.type),
-        value: altName.value
-      }));
-    }
-
-    return certificateRequest;
-  };
   const simpleEnrollByProfile = async ({
     csr,
     profileId,

backend/src/services/certificate-profile/certificate-profile-dal.ts

@@ -10,10 +10,8 @@ import {
   TCertificateProfile,
   TCertificateProfileCertificate,
   TCertificateProfileInsert,
-  TCertificateProfileMetrics,
   TCertificateProfileUpdate,
-  TCertificateProfileWithConfigs,
-  TCertificateProfileWithRawMetrics
+  TCertificateProfileWithConfigs
 } from "./certificate-profile-types";
 
 export type TCertificateProfileDALFactory = ReturnType<typeof certificateProfileDALFactory>;
@@ -109,7 +107,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           db.ref("encryptedCaChain").withSchema(TableName.PkiEstEnrollmentConfig).as("estConfigEncryptedCaChain"),
           db.ref("id").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigId"),
           db.ref("autoRenew").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigAutoRenew"),
-          db.ref("autoRenewDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigAutoRenewDays")
+          db.ref("renewBeforeDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigRenewBeforeDays")
         )
         .where(`${TableName.PkiCertificateProfile}.id`, id)
         .first();
@@ -132,7 +130,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         ? ({
             id: result.apiConfigId,
             autoRenew: !!result.apiConfigAutoRenew,
-            autoRenewDays: result.apiConfigAutoRenewDays || undefined
+            renewBeforeDays: result.apiConfigRenewBeforeDays || undefined
           } as TCertificateProfileWithConfigs["apiConfig"])
         : undefined;
 
@@ -203,21 +201,11 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
       search?: string;
       enrollmentType?: EnrollmentType;
       caId?: string;
-      includeMetrics?: boolean;
-      expiringDays?: number;
     } = {},
     tx?: Knex
-  ): Promise<TCertificateProfile[] | TCertificateProfileWithRawMetrics[] | TCertificateProfileWithConfigs[]> => {
+  ): Promise<TCertificateProfile[] | TCertificateProfileWithConfigs[]> => {
     try {
-      const {
-        offset = 0,
-        limit = 20,
-        search,
-        enrollmentType,
-        caId,
-        includeMetrics = false,
-        expiringDays = 7
-      } = options;
+      const { offset = 0, limit = 20, search, enrollmentType, caId } = options;
 
       let baseQuery = (tx || db)(TableName.PkiCertificateProfile).where(
         `${TableName.PkiCertificateProfile}.projectId`,
@@ -242,7 +230,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         baseQuery = baseQuery.where(`${TableName.PkiCertificateProfile}.caId`, caId);
       }
 
-      let query = baseQuery
+      const query = baseQuery
         .leftJoin(
           TableName.PkiEstEnrollmentConfig,
           `${TableName.PkiCertificateProfile}.estConfigId`,
@@ -264,55 +252,9 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           db.ref("encryptedCaChain").withSchema(TableName.PkiEstEnrollmentConfig).as("estEncryptedCaChain"),
           db.ref("id").withSchema(TableName.PkiApiEnrollmentConfig).as("apiId"),
           db.ref("autoRenew").withSchema(TableName.PkiApiEnrollmentConfig).as("apiAutoRenew"),
-          db.ref("autoRenewDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiAutoRenewDays")
+          db.ref("renewBeforeDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiRenewBeforeDays")
         );
 
-      if (includeMetrics) {
-        query = query.leftJoin(
-          TableName.Certificate,
-          `${TableName.PkiCertificateProfile}.id`,
-          `${TableName.Certificate}.profileId`
-        );
-
-        const now = new Date();
-        const expiringDate = new Date();
-        expiringDate.setDate(now.getDate() + expiringDays);
-
-        query = query
-          .select(
-            selectAllTableCols(TableName.PkiCertificateProfile),
-            db.ref("id").withSchema(TableName.PkiEstEnrollmentConfig).as("estId"),
-            db
-              .ref("disableBootstrapCaValidation")
-              .withSchema(TableName.PkiEstEnrollmentConfig)
-              .as("estDisableBootstrapCaValidation"),
-            db.ref("hashedPassphrase").withSchema(TableName.PkiEstEnrollmentConfig).as("estHashedPassphrase"),
-            db.ref("encryptedCaChain").withSchema(TableName.PkiEstEnrollmentConfig).as("estEncryptedCaChain"),
-            db.ref("id").withSchema(TableName.PkiApiEnrollmentConfig).as("apiId"),
-            db.ref("autoRenew").withSchema(TableName.PkiApiEnrollmentConfig).as("apiAutoRenew"),
-            db.ref("autoRenewDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiAutoRenewDays"),
-            db.raw("COUNT(certificates.id) as total_certificates"),
-            db.raw(
-              'COUNT(CASE WHEN certificates."revokedAt" IS NULL AND certificates."notAfter" > ? THEN 1 END) as active_certificates',
-              [expiringDate]
-            ),
-            db.raw(
-              'COUNT(CASE WHEN certificates."revokedAt" IS NULL AND certificates."notAfter" <= ? THEN 1 END) as expired_certificates',
-              [now]
-            ),
-            db.raw(
-              'COUNT(CASE WHEN certificates."revokedAt" IS NULL AND certificates."notAfter" > ? AND certificates."notAfter" <= ? THEN 1 END) as expiring_certificates',
-              [now, expiringDate]
-            ),
-            db.raw('COUNT(CASE WHEN certificates."revokedAt" IS NOT NULL THEN 1 END) as revoked_certificates')
-          )
-          .groupBy(
-            `${TableName.PkiCertificateProfile}.id`,
-            `${TableName.PkiEstEnrollmentConfig}.id`,
-            `${TableName.PkiApiEnrollmentConfig}.id`
-          );
-      }
-
       const results = (await query
         .orderBy(`${TableName.PkiCertificateProfile}.createdAt`, "desc")
         .offset(offset)
@@ -333,7 +275,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           ? {
               id: result.apiId as string,
               autoRenew: !!result.apiAutoRenew,
-              autoRenewDays: (result.apiAutoRenewDays as number) || undefined
+              renewBeforeDays: (result.apiRenewBeforeDays as number) || undefined
             }
           : undefined;
 
@@ -353,17 +295,6 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           apiConfig
         };
 
-        if (includeMetrics) {
-          return {
-            ...baseProfile,
-            total_certificates: result.total_certificates,
-            active_certificates: result.active_certificates,
-            expired_certificates: result.expired_certificates,
-            expiring_certificates: result.expiring_certificates,
-            revoked_certificates: result.revoked_certificates
-          } as TCertificateProfileWithRawMetrics & TCertificateProfileWithConfigs;
-        }
-
         return baseProfile as TCertificateProfileWithConfigs;
       });
     } catch (error) {
@@ -485,45 +416,6 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
     }
   };
 
-  const getProfileMetrics = async (
-    profileId: string,
-    expiringDays: number = 7,
-    tx?: Knex
-  ): Promise<TCertificateProfileMetrics> => {
-    try {
-      const now = new Date();
-      const expiringDate = new Date();
-      expiringDate.setDate(now.getDate() + expiringDays);
-
-      const metrics = await (tx || db)(TableName.Certificate)
-        .where("profileId", profileId)
-        .select(
-          db.raw("COUNT(*) as total_certificates"),
-          db.raw('COUNT(CASE WHEN "revokedAt" IS NULL AND "notAfter" > ? THEN 1 END) as active_certificates', [
-            expiringDate
-          ]),
-          db.raw('COUNT(CASE WHEN "revokedAt" IS NULL AND "notAfter" <= ? THEN 1 END) as expired_certificates', [now]),
-          db.raw(
-            'COUNT(CASE WHEN "revokedAt" IS NULL AND "notAfter" > ? AND "notAfter" <= ? THEN 1 END) as expiring_certificates',
-            [now, expiringDate]
-          ),
-          db.raw('COUNT(CASE WHEN "revokedAt" IS NOT NULL THEN 1 END) as revoked_certificates')
-        )
-        .first();
-
-      return {
-        profileId,
-        totalCertificates: parseInt(String((metrics as Record<string, unknown>)?.total_certificates || 0), 10),
-        activeCertificates: parseInt(String((metrics as Record<string, unknown>)?.active_certificates || 0), 10),
-        expiredCertificates: parseInt(String((metrics as Record<string, unknown>)?.expired_certificates || 0), 10),
-        expiringCertificates: parseInt(String((metrics as Record<string, unknown>)?.expiring_certificates || 0), 10),
-        revokedCertificates: parseInt(String((metrics as Record<string, unknown>)?.revoked_certificates || 0), 10)
-      };
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Get certificate profile metrics" });
-    }
-  };
-
   const isProfileInUse = async (profileId: string, tx?: Knex) => {
     try {
       const doc = await (tx || db)(TableName.Certificate).where("profileId", profileId).count("*").first();
@@ -546,7 +438,6 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
     countByProjectId,
     findByNameAndProjectId,
     getCertificatesByProfile,
-    getProfileMetrics,
     isProfileInUse
   };
 };

backend/src/services/certificate-profile/certificate-profile-schemas.ts

@@ -25,7 +25,7 @@ export const createCertificateProfileSchema = z
     apiConfig: z
       .object({
         autoRenew: z.boolean().default(false),
-        autoRenewDays: z.number().min(1).max(365).optional()
+        renewBeforeDays: z.number().min(1).max(30).optional()
       })
       .optional()
   })
@@ -75,7 +75,7 @@ export const updateCertificateProfileSchema = z
     apiConfig: z
       .object({
         autoRenew: z.boolean().default(false),
-        autoRenewDays: z.number().min(1).max(365).optional()
+        renewBeforeDays: z.number().min(1).max(30).optional()
       })
       .optional()
   })
@@ -127,8 +127,3 @@ export const listCertificatesByProfileSchema = z.object({
   status: z.enum(["active", "expired", "revoked"]).optional(),
   search: z.string().optional()
 });
-
-export const getCertificateProfileMetricsSchema = z.object({
-  profileId: z.string().uuid(),
-  expiringDays: z.coerce.number().min(1).max(365).default(30)
-});