Add secret sync vercel integration

backend/src/services/app-connection/app-connection-enums.ts

@@ -5,7 +5,8 @@ export enum AppConnection {
   GCP = "gcp",
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
-  Humanitec = "humanitec"
+  Humanitec = "humanitec",
+  Vercel = "vercel"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -40,6 +40,8 @@ import {
   HumanitecConnectionMethod,
   validateHumanitecConnectionCredentials
 } from "./humanitec";
+import { VercelConnectionMethod } from "./vercel";
+import { getVercelConnectionListItem, validateVercelConnectionCredentials } from "./vercel/vercel-connection-fns";
 
 export const listAppConnectionOptions = () => {
   return [
@@ -49,7 +51,8 @@ export const listAppConnectionOptions = () => {
     getAzureKeyVaultConnectionListItem(),
     getAzureAppConfigurationConnectionListItem(),
     getDatabricksConnectionListItem(),
-    getHumanitecConnectionListItem()
+    getHumanitecConnectionListItem(),
+    getVercelConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -114,6 +117,8 @@ export const validateAppConnectionCredentials = async (
       return validateAzureAppConfigurationConnectionCredentials(appConnection);
     case AppConnection.Humanitec:
       return validateHumanitecConnectionCredentials(appConnection);
+    case AppConnection.Vercel:
+      return validateVercelConnectionCredentials(appConnection);
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection ${app}`);
@@ -138,6 +143,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
       return "Service Principal";
     case HumanitecConnectionMethod.API_TOKEN:
       return "API Token";
+    case VercelConnectionMethod.API_TOKEN:
+      return "API Token";
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection Method: ${method}`);

backend/src/services/app-connection/app-connection-maps.ts

@@ -7,5 +7,6 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AzureKeyVault]: "Azure Key Vault",
   [AppConnection.AzureAppConfiguration]: "Azure App Configuration",
   [AppConnection.Databricks]: "Databricks",
-  [AppConnection.Humanitec]: "Humanitec"
+  [AppConnection.Humanitec]: "Humanitec",
+  [AppConnection.Vercel]: "Vercel"
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -37,6 +37,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "./github";
 import { githubConnectionService } from "./github/github-connection-service";
 import { ValidateHumanitecConnectionCredentialsSchema } from "./humanitec";
 import { humanitecConnectionService } from "./humanitec/humanitec-connection-service";
+import { ValidateVercelConnectionCredentialsSchema } from "./vercel";
+import { vercelConnectionService } from "./vercel/vercel-connection-service";
 
 export type TAppConnectionServiceFactoryDep = {
   appConnectionDAL: TAppConnectionDALFactory;
@@ -53,7 +55,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
   [AppConnection.AzureAppConfiguration]: ValidateAzureAppConfigurationConnectionCredentialsSchema,
   [AppConnection.Databricks]: ValidateDatabricksConnectionCredentialsSchema,
-  [AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema
+  [AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema,
+  [AppConnection.Vercel]: ValidateVercelConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -375,6 +378,7 @@ export const appConnectionServiceFactory = ({
     gcp: gcpConnectionService(connectAppConnectionById),
     databricks: databricksConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     aws: awsConnectionService(connectAppConnectionById),
-    humanitec: humanitecConnectionService(connectAppConnectionById)
+    humanitec: humanitecConnectionService(connectAppConnectionById),
+    vercel: vercelConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -38,6 +38,12 @@ import {
   THumanitecConnectionInput,
   TValidateHumanitecConnectionCredentials
 } from "./humanitec";
+import {
+  TValidateVercelConnectionCredentials,
+  TVercelConnection,
+  TVercelConnectionConfig,
+  TVercelConnectionInput
+} from "./vercel";
 
 export type TAppConnection = { id: string } & (
   | TAwsConnection
@@ -47,6 +53,7 @@ export type TAppConnection = { id: string } & (
   | TAzureAppConfigurationConnection
   | TDatabricksConnection
   | THumanitecConnection
+  | TVercelConnection
 );
 
 export type TAppConnectionInput = { id: string } & (
@@ -57,6 +64,7 @@ export type TAppConnectionInput = { id: string } & (
   | TAzureAppConfigurationConnectionInput
   | TDatabricksConnectionInput
   | THumanitecConnectionInput
+  | TVercelConnectionInput
 );
 
 export type TCreateAppConnectionDTO = Pick<
@@ -75,7 +83,8 @@ export type TAppConnectionConfig =
   | TAzureKeyVaultConnectionConfig
   | TAzureAppConfigurationConnectionConfig
   | TDatabricksConnectionConfig
-  | THumanitecConnectionConfig;
+  | THumanitecConnectionConfig
+  | TVercelConnectionConfig;
 
 export type TValidateAppConnectionCredentials =
   | TValidateAwsConnectionCredentials
@@ -84,7 +93,8 @@ export type TValidateAppConnectionCredentials =
   | TValidateAzureKeyVaultConnectionCredentials
   | TValidateAzureAppConfigurationConnectionCredentials
   | TValidateDatabricksConnectionCredentials
-  | TValidateHumanitecConnectionCredentials;
+  | TValidateHumanitecConnectionCredentials
+  | TValidateVercelConnectionCredentials;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/vercel/index.ts

@@ -0,0 +1,4 @@
+export * from "./vercel-connection-enums";
+export * from "./vercel-connection-fns";
+export * from "./vercel-connection-schemas";
+export * from "./vercel-connection-types";

backend/src/services/app-connection/vercel/vercel-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum VercelConnectionMethod {
+  API_TOKEN = "api-token"
+}

backend/src/services/app-connection/vercel/vercel-connection-fns.ts

@@ -0,0 +1,261 @@
+/* eslint-disable no-await-in-loop */
+import { AxiosError, AxiosResponse } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError, InternalServerError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { TVercelBranches } from "@app/services/integration-auth/integration-auth-types";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { VercelConnectionMethod } from "./vercel-connection-enums";
+import {
+  TVercelConnectionConfig,
+  TVercelConnectionInput,
+  VercelApp,
+  VercelEnvironment,
+  VercelOrgWithApps
+} from "./vercel-connection-types";
+
+export const getVercelConnectionListItem = () => {
+  return {
+    name: "Vercel" as const,
+    app: AppConnection.Vercel as const,
+    methods: Object.values(VercelConnectionMethod) as [VercelConnectionMethod.API_TOKEN]
+  };
+};
+
+export const validateVercelConnectionCredentials = async (config: TVercelConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  let response: AxiosResponse<VercelApp[]> | null = null;
+
+  try {
+    response = await request.get<VercelApp[]>(`${IntegrationUrls.VERCEL_API_URL}/v9/projects`, {
+      headers: {
+        Authorization: `Bearer ${inputCredentials.apiToken}`
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate connection - verify credentials"
+    });
+  }
+
+  if (!response?.data) {
+    throw new InternalServerError({
+      message: "Failed to get organizations: Response was empty"
+    });
+  }
+
+  return inputCredentials;
+};
+
+interface ApiResponse<T> {
+  pagination?: {
+    count: number;
+    next: number;
+  };
+  data: T[];
+  [key: string]: unknown;
+}
+
+async function fetchAllPages<T>(
+  apiUrl: string,
+  apiToken: string,
+  initialParams: Record<string, string | number> = {},
+  dataPath?: string
+): Promise<T[]> {
+  const allItems: T[] = [];
+  let hasMoreItems = true;
+  let params: Record<string, string | number> = { ...initialParams, limit: 100 };
+
+  while (hasMoreItems) {
+    try {
+      const response = await request.get<ApiResponse<T>>(apiUrl, {
+        params,
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          "Accept-Encoding": "application/json"
+        }
+      });
+
+      if (!response?.data) {
+        throw new InternalServerError({
+          message: `Failed to fetch data from ${apiUrl}: Response was empty or malformed`
+        });
+      }
+
+      let itemsData: T[];
+
+      if (dataPath && dataPath in response.data) {
+        itemsData = response.data[dataPath] as T[];
+      } else {
+        itemsData = response.data.data;
+      }
+
+      if (!Array.isArray(itemsData)) {
+        throw new InternalServerError({
+          message: `Failed to fetch data from ${apiUrl}: Expected array but got ${typeof itemsData}`
+        });
+      }
+
+      allItems.push(...itemsData);
+
+      if (response.data.pagination?.next) {
+        params = { ...params, since: response.data.pagination.next };
+      } else {
+        hasMoreItems = false;
+      }
+    } catch (error) {
+      if (error instanceof AxiosError) {
+        throw new BadRequestError({
+          message: `Failed to fetch data from ${apiUrl}: ${error.message || "Unknown error"}`
+        });
+      }
+      throw error;
+    }
+  }
+
+  return allItems;
+}
+
+async function fetchOrgProjects(orgId: string, apiToken: string): Promise<VercelApp[]> {
+  return fetchAllPages<VercelApp>(
+    `${IntegrationUrls.VERCEL_API_URL}/v9/projects`,
+    apiToken,
+    { teamId: orgId },
+    "projects"
+  );
+}
+
+async function fetchProjectEnvironments(projectId: string, apiToken: string): Promise<VercelEnvironment[]> {
+  return fetchAllPages<VercelEnvironment>(
+    `${IntegrationUrls.VERCEL_API_URL}/v9/projects/${projectId}/custom-environments`,
+    apiToken,
+    {},
+    "environments"
+  );
+}
+
+async function fetchPreviewBranches(projectId: string, apiToken: string): Promise<string[]> {
+  const { data } = await request.get<TVercelBranches[]>(
+    `${IntegrationUrls.VERCEL_API_URL}/v1/integrations/git-branches`,
+    {
+      params: {
+        projectId
+      },
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Accept-Encoding": "application/json"
+      }
+    }
+  );
+  return data.map((b) => b.ref);
+}
+
+type VercelTeam = {
+  id: string;
+  name: string;
+  slug: string;
+};
+
+type VercelUserResponse = {
+  user: {
+    id: string;
+    name: string;
+    username: string;
+  };
+};
+
+export const listProjects = async (appConnection: TVercelConnectionInput): Promise<VercelOrgWithApps[]> => {
+  const { credentials } = appConnection;
+  const { apiToken } = credentials;
+
+  const orgs = await fetchAllPages<VercelTeam>(`${IntegrationUrls.VERCEL_API_URL}/v2/teams`, apiToken, {}, "teams");
+
+  const personalAccountResponse = await request.get<VercelUserResponse>(`${IntegrationUrls.VERCEL_API_URL}/v2/user`, {
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      "Accept-Encoding": "application/json"
+    }
+  });
+
+  if (personalAccountResponse?.data?.user) {
+    const { user } = personalAccountResponse.data;
+    orgs.push({
+      id: user.id,
+      name: user.name || "Personal Account",
+      slug: user.username || "personal"
+    });
+  }
+
+  const orgsWithApps: VercelOrgWithApps[] = [];
+
+  const orgPromises = orgs.map(async (org) => {
+    try {
+      const projects = await fetchOrgProjects(org.id, apiToken);
+
+      const enhancedProjectsPromises = projects.map(async (project) => {
+        try {
+          const [environments, previewBranches] = await Promise.all([
+            fetchProjectEnvironments(project.id, apiToken),
+            fetchPreviewBranches(project.id, apiToken)
+          ]);
+
+          return {
+            name: project.name,
+            id: project.id,
+            envs: environments,
+            previewBranches
+          };
+        } catch (error) {
+          return {
+            name: project.name,
+            id: project.id,
+            envs: [],
+            previewBranches: []
+          };
+        }
+      });
+
+      const enhancedProjects = await Promise.all(enhancedProjectsPromises);
+
+      return {
+        ...org,
+        apps: enhancedProjects
+      };
+    } catch (error) {
+      return null;
+    }
+  });
+
+  const results = await Promise.all(orgPromises);
+
+  results.forEach((result) => {
+    if (result !== null) {
+      orgsWithApps.push(result);
+    }
+  });
+
+  return orgsWithApps;
+};
+
+export const getProjectEnvironmentVariables = (project: VercelApp): Record<string, string> => {
+  const envVars: Record<string, string> = {};
+
+  if (!project.envs) return envVars;
+
+  project.envs.forEach((env) => {
+    if (env.value && env.type !== "gitBranch") {
+      const { key, value } = env;
+      envVars[key] = value;
+    }
+  });
+
+  return envVars;
+};

backend/src/services/app-connection/vercel/vercel-connection-schemas.ts

@@ -0,0 +1,56 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { VercelConnectionMethod } from "./vercel-connection-enums";
+
+export const VercelConnectionAccessTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required")
+});
+
+const BaseVercelConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Vercel) });
+
+export const VercelConnectionSchema = BaseVercelConnectionSchema.extend({
+  method: z.literal(VercelConnectionMethod.API_TOKEN),
+  credentials: VercelConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedVercelConnectionSchema = z.discriminatedUnion("method", [
+  BaseVercelConnectionSchema.extend({
+    method: z.literal(VercelConnectionMethod.API_TOKEN),
+    credentials: VercelConnectionAccessTokenCredentialsSchema.pick({})
+  })
+]);
+
+export const ValidateVercelConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(VercelConnectionMethod.API_TOKEN).describe(AppConnections?.CREATE(AppConnection.Vercel).method),
+    credentials: VercelConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Vercel).credentials
+    )
+  })
+]);
+
+export const CreateVercelConnectionSchema = ValidateVercelConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Vercel)
+);
+
+export const UpdateVercelConnectionSchema = z
+  .object({
+    credentials: VercelConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Vercel).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Vercel));
+
+export const VercelConnectionListItemSchema = z.object({
+  name: z.literal("Vercel"),
+  app: z.literal(AppConnection.Vercel),
+  methods: z.nativeEnum(VercelConnectionMethod).array()
+});

backend/src/services/app-connection/vercel/vercel-connection-service.ts

@@ -0,0 +1,29 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listProjects as getVercelProjects } from "./vercel-connection-fns";
+import { TVercelConnection } from "./vercel-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TVercelConnection>;
+
+export const vercelConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Vercel, connectionId, actor);
+    try {
+      const projects = await getVercelProjects(appConnection);
+      return projects;
+    } catch (error) {
+      logger.error(error, "Failed to establish connection with Vercel");
+      return [];
+    }
+  };
+
+  return {
+    listProjects
+  };
+};

backend/src/services/app-connection/vercel/vercel-connection-types.ts

@@ -0,0 +1,73 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateVercelConnectionSchema,
+  ValidateVercelConnectionCredentialsSchema,
+  VercelConnectionSchema
+} from "./vercel-connection-schemas";
+
+export type TVercelConnection = z.infer<typeof VercelConnectionSchema>;
+
+export type TVercelConnectionInput = z.infer<typeof CreateVercelConnectionSchema> & {
+  app: AppConnection.Vercel;
+};
+
+export type TValidateVercelConnectionCredentials = typeof ValidateVercelConnectionCredentialsSchema;
+
+export type TVercelConnectionConfig = DiscriminativePick<TVercelConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
+
+export type VercelTeam = {
+  id: string;
+  name: string;
+  slug: string;
+};
+
+export type VercelEnvironment = {
+  key: string;
+  value: string;
+  type: string;
+  target?: string[];
+  gitBranch?: string;
+  createdAt?: number;
+  updatedAt?: number;
+};
+
+export type VercelAppMeta = {
+  githubCommitRef?: string;
+  githubCommitSha?: string;
+  githubCommitMessage?: string;
+  githubCommitAuthorName?: string;
+};
+
+export type VercelDeployment = {
+  id: string;
+  name: string;
+  url: string;
+  created: number;
+  meta?: VercelAppMeta;
+  target?: "production" | "preview" | "development";
+};
+
+export type VercelApp = {
+  name: string;
+  id: string;
+  envs?: VercelEnvironment[];
+  previewBranches?: string[];
+};
+
+export type VercelOrgWithApps = VercelTeam & {
+  apps: VercelApp[];
+};
+
+export type VercelUserResponse = {
+  user: {
+    id: string;
+    name: string;
+    username: string;
+  };
+};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -6,7 +6,8 @@ export enum SecretSync {
   AzureKeyVault = "azure-key-vault",
   AzureAppConfiguration = "azure-app-configuration",
   Databricks = "databricks",
-  Humanitec = "humanitec"
+  Humanitec = "humanitec",
+  Vercel = "vercel"
 }
 
 export enum SecretSyncInitialSyncBehavior {

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -26,6 +26,7 @@ import { GCP_SYNC_LIST_OPTION } from "./gcp";
 import { GcpSyncFns } from "./gcp/gcp-sync-fns";
 import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
+import { VERCEL_SYNC_LIST_OPTION, VercelSyncFns } from "./vercel";
 
 const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.AWSParameterStore]: AWS_PARAMETER_STORE_SYNC_LIST_OPTION,
@@ -35,7 +36,8 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.AzureKeyVault]: AZURE_KEY_VAULT_SYNC_LIST_OPTION,
   [SecretSync.AzureAppConfiguration]: AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION,
   [SecretSync.Databricks]: DATABRICKS_SYNC_LIST_OPTION,
-  [SecretSync.Humanitec]: HUMANITEC_SYNC_LIST_OPTION
+  [SecretSync.Humanitec]: HUMANITEC_SYNC_LIST_OPTION,
+  [SecretSync.Vercel]: VERCEL_SYNC_LIST_OPTION
 };
 
 export const listSecretSyncOptions = () => {
@@ -121,6 +123,8 @@ export const SecretSyncFns = {
         }).syncSecrets(secretSync, secretMap);
       case SecretSync.Humanitec:
         return HumanitecSyncFns.syncSecrets(secretSync, secretMap);
+      case SecretSync.Vercel:
+        return VercelSyncFns.syncSecrets(secretSync, secretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -165,6 +169,9 @@ export const SecretSyncFns = {
       case SecretSync.Humanitec:
         secretMap = await HumanitecSyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Vercel:
+        secretMap = await VercelSyncFns.getSecrets(secretSync);
+        break;
       default:
         throw new Error(
           `Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -207,6 +214,8 @@ export const SecretSyncFns = {
         }).removeSecrets(secretSync, secretMap);
       case SecretSync.Humanitec:
         return HumanitecSyncFns.removeSecrets(secretSync, secretMap);
+      case SecretSync.Vercel:
+        return VercelSyncFns.removeSecrets(secretSync, secretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -9,7 +9,8 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.AzureKeyVault]: "Azure Key Vault",
   [SecretSync.AzureAppConfiguration]: "Azure App Configuration",
   [SecretSync.Databricks]: "Databricks",
-  [SecretSync.Humanitec]: "Humanitec"
+  [SecretSync.Humanitec]: "Humanitec",
+  [SecretSync.Vercel]: "Vercel"
 };
 
 export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -20,5 +21,6 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
   [SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration,
   [SecretSync.Databricks]: AppConnection.Databricks,
-  [SecretSync.Humanitec]: AppConnection.Humanitec
+  [SecretSync.Humanitec]: AppConnection.Humanitec,
+  [SecretSync.Vercel]: AppConnection.Vercel
 };

backend/src/services/secret-sync/secret-sync-types.ts

@@ -49,6 +49,7 @@ import {
   THumanitecSyncListItem,
   THumanitecSyncWithCredentials
 } from "./humanitec";
+import { TVercelSync, TVercelSyncInput, TVercelSyncListItem, TVercelSyncWithCredentials } from "./vercel";
 
 export type TSecretSync =
   | TAwsParameterStoreSync
@@ -58,7 +59,8 @@ export type TSecretSync =
   | TAzureKeyVaultSync
   | TAzureAppConfigurationSync
   | TDatabricksSync
-  | THumanitecSync;
+  | THumanitecSync
+  | TVercelSync;
 
 export type TSecretSyncWithCredentials =
   | TAwsParameterStoreSyncWithCredentials
@@ -68,7 +70,8 @@ export type TSecretSyncWithCredentials =
   | TAzureKeyVaultSyncWithCredentials
   | TAzureAppConfigurationSyncWithCredentials
   | TDatabricksSyncWithCredentials
-  | THumanitecSyncWithCredentials;
+  | THumanitecSyncWithCredentials
+  | TVercelSyncWithCredentials;
 
 export type TSecretSyncInput =
   | TAwsParameterStoreSyncInput
@@ -78,7 +81,8 @@ export type TSecretSyncInput =
   | TAzureKeyVaultSyncInput
   | TAzureAppConfigurationSyncInput
   | TDatabricksSyncInput
-  | THumanitecSyncInput;
+  | THumanitecSyncInput
+  | TVercelSyncInput;
 
 export type TSecretSyncListItem =
   | TAwsParameterStoreSyncListItem
@@ -88,7 +92,8 @@ export type TSecretSyncListItem =
   | TAzureKeyVaultSyncListItem
   | TAzureAppConfigurationSyncListItem
   | TDatabricksSyncListItem
-  | THumanitecSyncListItem;
+  | THumanitecSyncListItem
+  | TVercelSyncListItem;
 
 export type TSyncOptionsConfig = {
   canImportSecrets: boolean;

backend/src/services/secret-sync/vercel/index.ts

@@ -0,0 +1,5 @@
+export * from "./vercel-sync-constants";
+export * from "./vercel-sync-enums";
+export * from "./vercel-sync-fns";
+export * from "./vercel-sync-schemas";
+export * from "./vercel-sync-types";

backend/src/services/secret-sync/vercel/vercel-sync-constants.ts

@@ -0,0 +1,10 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const VERCEL_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Vercel",
+  destination: SecretSync.Vercel,
+  connection: AppConnection.Vercel,
+  canImportSecrets: false
+};

backend/src/services/secret-sync/vercel/vercel-sync-enums.ts

@@ -0,0 +1,12 @@
+export enum VercelSyncScope {
+  Application = "application",
+  Environment = "environment"
+}
+
+export const VercelEnvironmentType = {
+  Development: "development",
+  Preview: "preview",
+  Production: "production"
+} as const;
+
+export type VercelEnvironment = (typeof VercelEnvironmentType)[keyof typeof VercelEnvironmentType];

backend/src/services/secret-sync/vercel/vercel-sync-fns.ts

@@ -0,0 +1,222 @@
+/* eslint-disable @typescript-eslint/no-unsafe-assignment */
+import { request } from "@app/lib/config/request";
+import { logger } from "@app/lib/logger";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
+import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import { VercelEnvironmentType } from "./vercel-sync-enums";
+import { TVercelSyncWithCredentials, VercelApiSecret } from "./vercel-sync-types";
+
+const getVercelSecrets = async (secretSync: TVercelSyncWithCredentials) => {
+  const {
+    destinationConfig,
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  const params: { [key: string]: string } = {
+    decrypt: "true",
+    ...(destinationConfig.branch ? { gitBranch: destinationConfig.branch } : {})
+  };
+
+  const { data } = await request.get<{ envs: VercelApiSecret[] }>(
+    `${IntegrationUrls.VERCEL_API_URL}/v9/projects/${destinationConfig.app}/env`,
+    {
+      params,
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Accept-Encoding": "application/json"
+      }
+    }
+  );
+
+  const filteredSecrets = data.envs.filter((secret) => {
+    // For environment-specific filtering
+    if (secret.target.includes(destinationConfig.env)) {
+      // If it's preview environment with a branch specified
+      if (
+        destinationConfig.env === VercelEnvironmentType.Preview &&
+        destinationConfig.branch &&
+        secret.gitBranch &&
+        secret.gitBranch !== destinationConfig.branch
+      ) {
+        return false;
+      }
+      return true;
+    }
+    return false;
+  });
+
+  // For secrets of type "encrypted", we need to get their decrypted value
+  const secretsWithValues = await Promise.all(
+    filteredSecrets.map(async (secret) => {
+      if (secret.type === "encrypted") {
+        const { data: decryptedSecret } = await request.get(
+          `${IntegrationUrls.VERCEL_API_URL}/v9/projects/${destinationConfig.app}/env/${secret.id}`,
+          {
+            params,
+            headers: {
+              Authorization: `Bearer ${apiToken}`,
+              "Accept-Encoding": "application/json"
+            }
+          }
+        );
+        return decryptedSecret as VercelApiSecret;
+      }
+      return secret;
+    })
+  );
+
+  return secretsWithValues;
+};
+
+const deleteSecret = async (secretSync: TVercelSyncWithCredentials, vercelSecret: VercelApiSecret) => {
+  const {
+    destinationConfig,
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  try {
+    await request.delete(
+      `${IntegrationUrls.VERCEL_API_URL}/v9/projects/${destinationConfig.app}/env/${vercelSecret.id}`,
+      {
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          "Accept-Encoding": "application/json"
+        }
+      }
+    );
+  } catch (error) {
+    throw new SecretSyncError({
+      error,
+      secretKey: vercelSecret.key
+    });
+  }
+};
+
+const createSecret = async (secretSync: TVercelSyncWithCredentials, secretMap: TSecretMap, key: string) => {
+  try {
+    const {
+      destinationConfig,
+      connection: {
+        credentials: { apiToken }
+      }
+    } = secretSync;
+
+    await request.post(
+      `${IntegrationUrls.VERCEL_API_URL}/v10/projects/${destinationConfig.app}/env`,
+      {
+        key,
+        value: secretMap[key].value,
+        type: "encrypted",
+        target: [destinationConfig.env],
+        ...(destinationConfig.env === VercelEnvironmentType.Preview && destinationConfig.branch
+          ? { gitBranch: destinationConfig.branch }
+          : {})
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          "Accept-Encoding": "application/json"
+        }
+      }
+    );
+  } catch (error) {
+    throw new SecretSyncError({
+      error,
+      secretKey: key
+    });
+  }
+};
+
+const updateSecret = async (
+  secretSync: TVercelSyncWithCredentials,
+  secretMap: TSecretMap,
+  vercelSecret: VercelApiSecret
+) => {
+  try {
+    const {
+      destinationConfig,
+      connection: {
+        credentials: { apiToken }
+      }
+    } = secretSync;
+
+    // Only update if not sensitive type
+    if (vercelSecret.type !== "sensitive") {
+      await request.patch(
+        `${IntegrationUrls.VERCEL_API_URL}/v9/projects/${destinationConfig.app}/env/${vercelSecret.id}`,
+        {
+          key: vercelSecret.key,
+          value: secretMap[vercelSecret.key].value,
+          type: vercelSecret.type,
+          target: vercelSecret.target.includes(destinationConfig.env)
+            ? [...vercelSecret.target]
+            : [...vercelSecret.target, destinationConfig.env],
+          ...(destinationConfig.env === VercelEnvironmentType.Preview && destinationConfig.branch
+            ? { gitBranch: destinationConfig.branch }
+            : {})
+        },
+        {
+          headers: {
+            Authorization: `Bearer ${apiToken}`,
+            "Accept-Encoding": "application/json"
+          }
+        }
+      );
+    } else {
+      logger.info(`Vercel secret ${vercelSecret.key} is of type 'sensitive' and cannot be updated through the API`);
+    }
+  } catch (error) {
+    throw new SecretSyncError({
+      error,
+      secretKey: vercelSecret.key
+    });
+  }
+};
+
+export const VercelSyncFns = {
+  syncSecrets: async (secretSync: TVercelSyncWithCredentials, secretMap: TSecretMap) => {
+    const vercelSecrets = await getVercelSecrets(secretSync);
+    const vercelSecretsMap = new Map(vercelSecrets.map((s) => [s.key, s]));
+
+    // Create or update secrets
+    for await (const key of Object.keys(secretMap)) {
+      const existingSecret = vercelSecretsMap.get(key);
+
+      if (!existingSecret) {
+        await createSecret(secretSync, secretMap, key);
+      } else if (existingSecret.value !== secretMap[key].value) {
+        await updateSecret(secretSync, secretMap, existingSecret);
+      }
+    }
+
+    // Delete secrets if disableSecretDeletion is not set
+    if (secretSync.syncOptions.disableSecretDeletion) return;
+
+    for await (const vercelSecret of vercelSecrets) {
+      if (!secretMap[vercelSecret.key]) {
+        await deleteSecret(secretSync, vercelSecret);
+      }
+    }
+  },
+
+  getSecrets: async (secretSync: TVercelSyncWithCredentials): Promise<TSecretMap> => {
+    throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
+  },
+
+  removeSecrets: async (secretSync: TVercelSyncWithCredentials, secretMap: TSecretMap) => {
+    const vercelSecrets = await getVercelSecrets(secretSync);
+
+    for await (const vercelSecret of vercelSecrets) {
+      if (vercelSecret.key in secretMap) {
+        await deleteSecret(secretSync, vercelSecret);
+      }
+    }
+  }
+};

backend/src/services/secret-sync/vercel/vercel-sync-schemas.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+import { VercelEnvironmentType } from "./vercel-sync-enums";
+
+const VercelSyncDestinationConfigSchema = z
+  .object({
+    app: z.string().min(1, "App ID is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.app),
+    appName: z.string().min(1, "App Name is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.appName),
+    env: z
+      .enum([VercelEnvironmentType.Development, VercelEnvironmentType.Preview, VercelEnvironmentType.Production])
+      .describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.env),
+    branch: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.branch)
+  })
+  .refine(
+    (data) => {
+      if (data.env === VercelEnvironmentType.Preview) {
+        return !!data.branch && data.branch.trim().length > 0;
+      }
+      return true;
+    },
+    {
+      message: "Branch is required for Preview environments",
+      path: ["branch"]
+    }
+  );
+
+const VercelSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
+
+export const VercelSyncSchema = BaseSecretSyncSchema(SecretSync.Vercel, VercelSyncOptionsConfig).extend({
+  destination: z.literal(SecretSync.Vercel),
+  destinationConfig: VercelSyncDestinationConfigSchema
+});
+
+export const CreateVercelSyncSchema = GenericCreateSecretSyncFieldsSchema(
+  SecretSync.Vercel,
+  VercelSyncOptionsConfig
+).extend({
+  destinationConfig: VercelSyncDestinationConfigSchema
+});
+
+export const UpdateVercelSyncSchema = GenericUpdateSecretSyncFieldsSchema(
+  SecretSync.Vercel,
+  VercelSyncOptionsConfig
+).extend({
+  destinationConfig: VercelSyncDestinationConfigSchema.optional()
+});
+
+export const VercelSyncListItemSchema = z.object({
+  name: z.literal("Vercel"),
+  connection: z.literal(AppConnection.Vercel),
+  destination: z.literal(SecretSync.Vercel),
+  canImportSecrets: z.literal(false)
+});

backend/src/services/secret-sync/vercel/vercel-sync-types.ts

@@ -0,0 +1,36 @@
+import z from "zod";
+
+import { TVercelConnection } from "@app/services/app-connection/vercel";
+
+import { CreateVercelSyncSchema, VercelSyncListItemSchema, VercelSyncSchema } from "./vercel-sync-schemas";
+
+export type TVercelSyncListItem = z.infer<typeof VercelSyncListItemSchema>;
+
+export type TVercelSync = z.infer<typeof VercelSyncSchema>;
+
+export type TVercelSyncInput = z.infer<typeof CreateVercelSyncSchema>;
+
+export type TVercelSyncWithCredentials = TVercelSync & {
+  connection: TVercelConnection;
+};
+
+export type VercelSecret = {
+  description: string;
+  is_secret: boolean;
+  key: string;
+  source: "app" | "env";
+  value: string;
+};
+
+export interface VercelApiSecret {
+  id: string;
+  key: string;
+  value: string;
+  type: string;
+  target: string[];
+  gitBranch?: string;
+  createdAt?: number;
+  updatedAt?: number;
+  configurationId?: string;
+  system?: boolean;
+}