Merge pull request #3806 from Infisical/feat/addHerokuSecretSync

feat(secret-sync): Add Heroku Secret Sync

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/HerokuSyncFields.tsx

@@ -0,0 +1,76 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import { THerokuApp } from "@app/hooks/api/appConnections/heroku";
+import { useHerokuConnectionListApps } from "@app/hooks/api/appConnections/heroku/queries";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const HerokuSyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.Heroku }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: apps, isLoading: isAppsLoading } = useHerokuConnectionListApps(connectionId, {
+    enabled: Boolean(connectionId)
+  });
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.app", "");
+          setValue("destinationConfig.appName", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.app"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="App"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the app exists in the connection's Heroku instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the app you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isAppsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={apps?.find((app) => app.id === value) ?? null}
+              onChange={(option) => {
+                onChange((option as SingleValue<THerokuApp>)?.id ?? "");
+                setValue(
+                  "destinationConfig.appName",
+                  (option as SingleValue<THerokuApp>)?.name ?? ""
+                );
+              }}
+              options={apps}
+              placeholder="Select an app..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx

@@ -15,6 +15,7 @@ import { FlyioSyncFields } from "./FlyioSyncFields";
 import { GcpSyncFields } from "./GcpSyncFields";
 import { GitHubSyncFields } from "./GitHubSyncFields";
 import { HCVaultSyncFields } from "./HCVaultSyncFields";
+import { HerokuSyncFields } from "./HerokuSyncFields";
 import { HumanitecSyncFields } from "./HumanitecSyncFields";
 import { OCIVaultSyncFields } from "./OCIVaultSyncFields";
 import { RenderSyncFields } from "./RenderSyncFields";
@@ -63,6 +64,8 @@ export const SecretSyncDestinationFields = () => {
       return <OCIVaultSyncFields />;
     case SecretSync.OnePass:
       return <OnePassSyncFields />;
+    case SecretSync.Heroku:
+      return <HerokuSyncFields />;
     case SecretSync.Render:
       return <RenderSyncFields />;
     case SecretSync.Flyio:

frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx

@@ -52,6 +52,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
     case SecretSync.TeamCity:
     case SecretSync.OnePass:
     case SecretSync.OCIVault:
+    case SecretSync.Heroku:
     case SecretSync.Render:
     case SecretSync.Flyio:
       AdditionalSyncOptionsFieldsComponent = null;

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/HerokuSyncReviewFields.tsx

@@ -0,0 +1,18 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const HerokuSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Heroku }>();
+  const appName = watch("destinationConfig.appName");
+  const appId = watch("destinationConfig.app");
+
+  return (
+    <>
+      <GenericFieldLabel label="App">{appName}</GenericFieldLabel>
+      <GenericFieldLabel label="App ID">{appId}</GenericFieldLabel>
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx

@@ -24,6 +24,7 @@ import { FlyioSyncReviewFields } from "./FlyioSyncReviewFields";
 import { GcpSyncReviewFields } from "./GcpSyncReviewFields";
 import { GitHubSyncReviewFields } from "./GitHubSyncReviewFields";
 import { HCVaultSyncReviewFields } from "./HCVaultSyncReviewFields";
+import { HerokuSyncReviewFields } from "./HerokuSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
 import { OCIVaultSyncReviewFields } from "./OCIVaultSyncReviewFields";
 import { OnePassSyncReviewFields } from "./OnePassSyncReviewFields";
@@ -106,6 +107,9 @@ export const SecretSyncReviewFields = () => {
     case SecretSync.OnePass:
       DestinationFieldsComponent = <OnePassSyncReviewFields />;
       break;
+    case SecretSync.Heroku:
+      DestinationFieldsComponent = <HerokuSyncReviewFields />;
+      break;
     case SecretSync.Render:
       DestinationFieldsComponent = <RenderSyncReviewFields />;
       break;

frontend/src/components/secret-syncs/forms/schemas/heroku-sync-destination-schema.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const HerokuSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.Heroku),
+    destinationConfig: z.object({
+      app: z.string().trim().min(1, "App ID required"),
+      appName: z.string().trim().min(1, "App name required")
+    })
+  })
+);

frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts

@@ -12,6 +12,7 @@ import { FlyioSyncDestinationSchema } from "./flyio-sync-destination-schema";
 import { GcpSyncDestinationSchema } from "./gcp-sync-destination-schema";
 import { GitHubSyncDestinationSchema } from "./github-sync-destination-schema";
 import { HCVaultSyncDestinationSchema } from "./hc-vault-sync-destination-schema";
+import { HerokuSyncDestinationSchema } from "./heroku-sync-destination-schema";
 import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
 import { OCIVaultSyncDestinationSchema } from "./oci-vault-sync-destination-schema";
 import { RenderSyncDestinationSchema } from "./render-sync-destination-schema";
@@ -38,6 +39,7 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
   TeamCitySyncDestinationSchema,
   OCIVaultSyncDestinationSchema,
   OnePassSyncDestinationSchema,
+  HerokuSyncDestinationSchema,
   RenderSyncDestinationSchema,
   FlyioSyncDestinationSchema
 ]);

frontend/src/helpers/appConnections.ts

@@ -37,6 +37,7 @@ import {
   VercelConnectionMethod,
   WindmillConnectionMethod
 } from "@app/hooks/api/appConnections/types";
+import { HerokuConnectionMethod } from "@app/hooks/api/appConnections/types/heroku-connection";
 import { OCIConnectionMethod } from "@app/hooks/api/appConnections/types/oci-connection";
 import { RenderConnectionMethod } from "@app/hooks/api/appConnections/types/render-connection";
 
@@ -81,6 +82,7 @@ export const APP_CONNECTION_MAP: Record<
   [AppConnection.TeamCity]: { name: "TeamCity", image: "TeamCity.png" },
   [AppConnection.OCI]: { name: "OCI", image: "Oracle.png", enterprise: true },
   [AppConnection.OnePass]: { name: "1Password", image: "1Password.png" },
+  [AppConnection.Heroku]: { name: "Heroku", image: "Heroku.png" },
   [AppConnection.Render]: { name: "Render", image: "Render.png" },
   [AppConnection.Flyio]: { name: "Fly.io", image: "Flyio.svg" }
 };
@@ -95,6 +97,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case AzureClientSecretsConnectionMethod.OAuth:
     case AzureDevOpsConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
+    case HerokuConnectionMethod.OAuth:
       return { name: "OAuth", icon: faPassport };
     case AwsConnectionMethod.AccessKey:
     case OCIConnectionMethod.AccessKey:
@@ -129,6 +132,8 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
       return { name: "App Role", icon: faUser };
     case LdapConnectionMethod.SimpleBind:
       return { name: "Simple Bind", icon: faLink };
+    case HerokuConnectionMethod.AuthToken:
+      return { name: "Auth Token", icon: faKey };
     case RenderConnectionMethod.ApiKey:
       return { name: "API Key", icon: faKey };
     default:

frontend/src/helpers/secretSyncs.ts

@@ -62,6 +62,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
     name: "1Password",
     image: "1Password.png"
   },
+  [SecretSync.Heroku]: {
+    name: "Heroku",
+    image: "Heroku.png"
+  },
   [SecretSync.Render]: {
     name: "Render",
     image: "Render.png"
@@ -90,6 +94,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.TeamCity]: AppConnection.TeamCity,
   [SecretSync.OCIVault]: AppConnection.OCI,
   [SecretSync.OnePass]: AppConnection.OnePass,
+  [SecretSync.Heroku]: AppConnection.Heroku,
   [SecretSync.Render]: AppConnection.Render,
   [SecretSync.Flyio]: AppConnection.Flyio
 };

frontend/src/hooks/api/appConnections/enums.ts

@@ -23,6 +23,7 @@ export enum AppConnection {
   TeamCity = "teamcity",
   OCI = "oci",
   OnePass = "1password",
+  Heroku = "heroku",
   Render = "render",
   Flyio = "flyio"
 }

frontend/src/hooks/api/appConnections/heroku/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/heroku/queries.tsx

@@ -0,0 +1,36 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { THerokuApp } from "./types";
+
+const herokuConnectionKeys = {
+  all: [...appConnectionKeys.all, "heroku"] as const,
+  listApps: (connectionId: string) => [...herokuConnectionKeys.all, "apps", connectionId] as const
+};
+
+export const useHerokuConnectionListApps = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      THerokuApp[],
+      unknown,
+      THerokuApp[],
+      ReturnType<typeof herokuConnectionKeys.listApps>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: herokuConnectionKeys.listApps(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<THerokuApp[]>(
+        `/api/v1/app-connections/heroku/${connectionId}/apps`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/heroku/types.ts

@@ -0,0 +1,4 @@
+export type THerokuApp = {
+  id: string;
+  name: string;
+};

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -106,6 +106,11 @@ export type TOCIConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.OCI;
 };
 
+export type THerokuConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Heroku;
+  oauthClientId?: string;
+};
+
 export type TOnePassConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.OnePass;
 };
@@ -141,6 +146,7 @@ export type TAppConnectionOption =
   | TTeamCityConnectionOption
   | TOCIConnectionOption
   | TOnePassConnectionOption
+  | THerokuConnectionOption
   | TRenderConnectionOption
   | TFlyioConnectionOption;
 
@@ -169,6 +175,7 @@ export type TAppConnectionOptionMap = {
   [AppConnection.TeamCity]: TTeamCityConnectionOption;
   [AppConnection.OCI]: TOCIConnectionOption;
   [AppConnection.OnePass]: TOnePassConnectionOption;
+  [AppConnection.Heroku]: THerokuConnectionOption;
   [AppConnection.Render]: TRenderConnectionOption;
   [AppConnection.Flyio]: TFlyioConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/heroku-connection.ts

@@ -0,0 +1,22 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum HerokuConnectionMethod {
+  AuthToken = "auth-token",
+  OAuth = "oauth"
+}
+
+export type THerokuConnection = TRootAppConnection & { app: AppConnection.Heroku } & (
+    | {
+        method: HerokuConnectionMethod.AuthToken;
+        credentials: {
+          authToken: string;
+        };
+      }
+    | {
+        method: HerokuConnectionMethod.OAuth;
+        credentials: {
+          code: string;
+        };
+      }
+  );

frontend/src/hooks/api/appConnections/types/index.ts

@@ -14,6 +14,7 @@ import { TGcpConnection } from "./gcp-connection";
 import { TGitHubConnection } from "./github-connection";
 import { TGitHubRadarConnection } from "./github-radar-connection";
 import { THCVaultConnection } from "./hc-vault-connection";
+import { THerokuConnection } from "./heroku-connection";
 import { THumanitecConnection } from "./humanitec-connection";
 import { TLdapConnection } from "./ldap-connection";
 import { TMsSqlConnection } from "./mssql-connection";
@@ -41,6 +42,7 @@ export * from "./gcp-connection";
 export * from "./github-connection";
 export * from "./github-radar-connection";
 export * from "./hc-vault-connection";
+export * from "./heroku-connection";
 export * from "./humanitec-connection";
 export * from "./ldap-connection";
 export * from "./mssql-connection";
@@ -79,6 +81,7 @@ export type TAppConnection =
   | TTeamCityConnection
   | TOCIConnection
   | TOnePassConnection
+  | THerokuConnection
   | TRenderConnection
   | TFlyioConnection;
 
@@ -132,6 +135,7 @@ export type TAppConnectionMap = {
   [AppConnection.TeamCity]: TTeamCityConnection;
   [AppConnection.OCI]: TOCIConnection;
   [AppConnection.OnePass]: TOnePassConnection;
+  [AppConnection.Heroku]: THerokuConnection;
   [AppConnection.Render]: TRenderConnection;
   [AppConnection.Flyio]: TFlyioConnection;
 };

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -16,6 +16,7 @@ export enum SecretSync {
   TeamCity = "teamcity",
   OCIVault = "oci-vault",
   OnePass = "1password",
+  Heroku = "heroku",
   Render = "render",
   Flyio = "flyio"
 }

frontend/src/hooks/api/secretSyncs/types/heroku-sync.ts

@@ -0,0 +1,16 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type THerokuSync = TRootSecretSync & {
+  destination: SecretSync.Heroku;
+  destinationConfig: {
+    app: string;
+    appName: string;
+  };
+  connection: {
+    app: AppConnection.Heroku;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -14,6 +14,7 @@ import { TFlyioSync } from "./flyio-sync";
 import { TGcpSync } from "./gcp-sync";
 import { TGitHubSync } from "./github-sync";
 import { THCVaultSync } from "./hc-vault-sync";
+import { THerokuSync } from "./heroku-sync";
 import { THumanitecSync } from "./humanitec-sync";
 import { TOCIVaultSync } from "./oci-vault-sync";
 import { TTeamCitySync } from "./teamcity-sync";
@@ -46,6 +47,7 @@ export type TSecretSync =
   | TTeamCitySync
   | TOCIVaultSync
   | TOnePassSync
+  | THerokuSync
   | TRenderSync
   | TFlyioSync;
 

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx

@@ -23,6 +23,7 @@ import { GcpConnectionForm } from "./GcpConnectionForm";
 import { GitHubConnectionForm } from "./GitHubConnectionForm";
 import { GitHubRadarConnectionForm } from "./GitHubRadarConnectionForm";
 import { HCVaultConnectionForm } from "./HCVaultConnectionForm";
+import { HerokuConnectionForm } from "./HerokuAppConnectionForm";
 import { HumanitecConnectionForm } from "./HumanitecConnectionForm";
 import { LdapConnectionForm } from "./LdapConnectionForm";
 import { MsSqlConnectionForm } from "./MsSqlConnectionForm";
@@ -121,6 +122,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
       return <OCIConnectionForm onSubmit={onSubmit} />;
     case AppConnection.OnePass:
       return <OnePassConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.Heroku:
+      return <HerokuConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Render:
       return <RenderConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Flyio:
@@ -209,6 +212,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
       return <OCIConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.OnePass:
       return <OnePassConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+    case AppConnection.Heroku:
+      return <HerokuConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.Render:
       return <RenderConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.Flyio:

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/HerokuAppConnectionForm.tsx

@@ -0,0 +1,253 @@
+/* eslint-disable no-case-declarations */
+/* eslint-disable no-nested-ternary */
+import crypto from "crypto";
+
+import { useState } from "react";
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { isInfisicalCloud } from "@app/helpers/platform";
+import { useGetAppConnectionOption } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  HerokuConnectionMethod,
+  THerokuConnection
+} from "@app/hooks/api/appConnections/types/heroku-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: THerokuConnection;
+  onSubmit: (formData: FormData) => Promise<void>;
+};
+
+const formSchema = z.discriminatedUnion("method", [
+  genericAppConnectionFieldsSchema.extend({
+    app: z.literal(AppConnection.Heroku),
+    method: z.literal(HerokuConnectionMethod.AuthToken),
+    credentials: z.object({
+      authToken: z.string().min(1, "Auth token is required")
+    })
+  }),
+  genericAppConnectionFieldsSchema.extend({
+    app: z.literal(AppConnection.Heroku),
+    method: z.literal(HerokuConnectionMethod.OAuth),
+    credentials: z.object({
+      code: z.string().min(1, "Code is required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const HerokuConnectionForm = ({ appConnection, onSubmit: formSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+  const [isRedirecting, setIsRedirecting] = useState(false);
+
+  const {
+    option: { oauthClientId },
+    isLoading
+  } = useGetAppConnectionOption(AppConnection.Heroku);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues:
+      appConnection?.method === HerokuConnectionMethod.OAuth
+        ? { ...appConnection, credentials: { code: "custom" } }
+        : (appConnection ??
+          ({
+            app: AppConnection.Heroku,
+            method: HerokuConnectionMethod.AuthToken,
+            credentials: {
+              authToken: ""
+            }
+          } as FormData))
+  });
+
+  const {
+    handleSubmit,
+    control,
+    watch,
+    setValue,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  const selectedMethod = watch("method");
+
+  const onSubmit = async (formData: FormData) => {
+    try {
+      switch (formData.method) {
+        case HerokuConnectionMethod.AuthToken:
+          await formSubmit(formData);
+          break;
+
+        case HerokuConnectionMethod.OAuth:
+          if (!oauthClientId) {
+            return;
+          }
+          setIsRedirecting(true);
+
+          // Generate CSRF token
+          const state = crypto.randomBytes(16).toString("hex");
+
+          // Store state and form data for callback
+          localStorage.setItem("latestCSRFToken", state);
+          localStorage.setItem(
+            "herokuConnectionFormData",
+            JSON.stringify({
+              ...formData,
+              connectionId: appConnection?.id,
+              isUpdate
+            })
+          );
+
+          // Redirect to Heroku OAuth
+          const oauthUrl = new URL("https://id.heroku.com/oauth/authorize");
+          oauthUrl.searchParams.set("client_id", oauthClientId);
+          oauthUrl.searchParams.set("response_type", "code");
+          oauthUrl.searchParams.set("scope", "write-protected");
+          oauthUrl.searchParams.set("state", state);
+
+          window.location.assign(oauthUrl.toString());
+          break;
+
+        default:
+          throw new Error("Unhandled Heroku Connection method");
+      }
+    } catch (error) {
+      console.error("Error handling form submission:", error);
+      setIsRedirecting(false);
+    }
+  };
+
+  let isMissingConfig: boolean;
+
+  switch (selectedMethod) {
+    case HerokuConnectionMethod.OAuth:
+      isMissingConfig = !oauthClientId;
+      break;
+    case HerokuConnectionMethod.AuthToken:
+      isMissingConfig = false;
+      break;
+    default:
+      throw new Error(`Unhandled Heroku Connection method: ${selectedMethod}`);
+  }
+
+  const methodDetails = getAppConnectionMethodDetails(selectedMethod);
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Heroku].name
+              }. This field cannot be changed after creation.`}
+              errorText={
+                !isLoading && isMissingConfig && selectedMethod === HerokuConnectionMethod.OAuth
+                  ? `Environment variables have not been configured. ${
+                      isInfisicalCloud()
+                        ? "Please contact Infisical."
+                        : `See Docs to configure Heroku ${methodDetails.name} Connections.`
+                    }`
+                  : error?.message
+              }
+              isError={Boolean(error?.message) || isMissingConfig}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => {
+                  console.log("val", val === HerokuConnectionMethod.OAuth);
+                  onChange(val);
+                  if (val === HerokuConnectionMethod.OAuth) {
+                    setValue("credentials.code", "custom");
+                  }
+                }}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(HerokuConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                      {method === HerokuConnectionMethod.AuthToken ? " (Recommended)" : ""}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+
+        {selectedMethod === HerokuConnectionMethod.AuthToken && (
+          <Controller
+            name="credentials.authToken"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                label="Auth Token"
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                tooltipText="Your Heroku Auth Token"
+              >
+                <SecretInput
+                  containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                  value={value}
+                  onChange={(e) => onChange(e.target.value)}
+                />
+              </FormControl>
+            )}
+          />
+        )}
+
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting || isRedirecting}
+            isDisabled={
+              isSubmitting ||
+              (!isUpdate && !isDirty) ||
+              (isMissingConfig && selectedMethod === HerokuConnectionMethod.OAuth) ||
+              isRedirecting
+            }
+          >
+            {isRedirecting && selectedMethod === HerokuConnectionMethod.OAuth
+              ? "Redirecting to Heroku..."
+              : isUpdate
+                ? "Reconnect to Heroku"
+                : "Connect to Heroku"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/HerokuSyncDestinationCol.tsx

@@ -0,0 +1,14 @@
+import { THerokuSync } from "@app/hooks/api/secretSyncs/types/heroku-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: THerokuSync;
+};
+
+export const HerokuSyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx

@@ -12,6 +12,7 @@ import { FlyioSyncDestinationCol } from "./FlyioSyncDestinationCol";
 import { GcpSyncDestinationCol } from "./GcpSyncDestinationCol";
 import { GitHubSyncDestinationCol } from "./GitHubSyncDestinationCol";
 import { HCVaultSyncDestinationCol } from "./HCVaultSyncDestinationCol";
+import { HerokuSyncDestinationCol } from "./HerokuSyncDestinationCol";
 import { HumanitecSyncDestinationCol } from "./HumanitecSyncDestinationCol";
 import { OCIVaultSyncDestinationCol } from "./OCIVaultSyncDestinationCol";
 import { RenderSyncDestinationCol } from "./RenderSyncDestinationCol";
@@ -60,6 +61,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
       return <OnePassSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.AzureDevOps:
       return <AzureDevOpsSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.Heroku:
+      return <HerokuSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.Render:
       return <RenderSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.Flyio:

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts

@@ -116,6 +116,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
       primaryText = destinationConfig.devopsProjectName;
       secondaryText = destinationConfig.devopsProjectId;
       break;
+    case SecretSync.Heroku:
+      primaryText = destinationConfig.appName;
+      secondaryText = destinationConfig.app;
+      break;
     case SecretSync.Render:
       primaryText = destinationConfig.serviceName ?? destinationConfig.serviceId;
       secondaryText = "Service";

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/HerokuSyncDestinationSection.tsx

@@ -0,0 +1,19 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { THerokuSync } from "@app/hooks/api/secretSyncs/types/heroku-sync";
+
+type Props = {
+  secretSync: THerokuSync;
+};
+
+export const HerokuSyncDestinationSection = ({ secretSync }: Props) => {
+  const {
+    destinationConfig: { app, appName }
+  } = secretSync;
+
+  return (
+    <>
+      <GenericFieldLabel label="App Name">{appName}</GenericFieldLabel>
+      <GenericFieldLabel label="App ID">{app}</GenericFieldLabel>
+    </>
+  );
+};

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx

@@ -23,6 +23,7 @@ import { FlyioSyncDestinationSection } from "./FlyioSyncDestinationSection";
 import { GcpSyncDestinationSection } from "./GcpSyncDestinationSection";
 import { GitHubSyncDestinationSection } from "./GitHubSyncDestinationSection";
 import { HCVaultSyncDestinationSection } from "./HCVaultSyncDestinationSection";
+import { HerokuSyncDestinationSection } from "./HerokuSyncDestinationSection";
 import { HumanitecSyncDestinationSection } from "./HumanitecSyncDestinationSection";
 import { OCIVaultSyncDestinationSection } from "./OCIVaultSyncDestinationSection";
 import { RenderSyncDestinationSection } from "./RenderSyncDestinationSection";
@@ -96,6 +97,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
     case SecretSync.AzureDevOps:
       DestinationComponents = <AzureDevOpsSyncDestinationSection secretSync={secretSync} />;
       break;
+    case SecretSync.Heroku:
+      DestinationComponents = <HerokuSyncDestinationSection secretSync={secretSync} />;
+      break;
     case SecretSync.Render:
       DestinationComponents = <RenderSyncDestinationSection secretSync={secretSync} />;
       break;

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx

@@ -55,6 +55,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
     case SecretSync.TeamCity:
     case SecretSync.OCIVault:
     case SecretSync.OnePass:
+    case SecretSync.Heroku:
     case SecretSync.Render:
     case SecretSync.Flyio:
       AdditionalSyncOptionsComponent = null;

frontend/src/pages/secret-manager/integrations/HerokuOauthCallbackPage/HerokuOauthCallbackPage.tsx

@@ -3,43 +3,99 @@ import { useNavigate, useSearch } from "@tanstack/react-router";
 
 import { ROUTE_PATHS } from "@app/const/routes";
 import { useWorkspace } from "@app/context";
-import { useAuthorizeIntegration } from "@app/hooks/api";
+import { useCreateAppConnection, useUpdateAppConnection } from "@app/hooks/api/appConnections";
+import { HerokuConnectionMethod } from "@app/hooks/api/appConnections/types/heroku-connection";
 
 export const HerokuOAuthCallbackPage = () => {
   const navigate = useNavigate();
-  const { mutateAsync } = useAuthorizeIntegration();
+  const { mutateAsync: createAppConnection } = useCreateAppConnection();
+  const { mutateAsync: updateAppConnection } = useUpdateAppConnection();
 
   const { code, state } = useSearch({
     from: ROUTE_PATHS.SecretManager.Integratons.HerokuOauthCallbackPage.id
   });
+
   const { currentWorkspace } = useWorkspace();
 
   useEffect(() => {
     (async () => {
       try {
-        // validate state
-        if (state !== localStorage.getItem("latestCSRFToken")) return;
-        localStorage.removeItem("latestCSRFToken");
-        const integrationAuth = await mutateAsync({
-          workspaceId: currentWorkspace.id,
-          code: code as string,
-          integration: "heroku"
-        });
+        // Validate CSRF state token
+        const storedState = localStorage.getItem("latestCSRFToken");
+        if (state !== storedState) {
+          console.error("CSRF token mismatch");
+          navigate({
+            to: "/organization/app-connections",
+            search: { error: "invalid_state" }
+          });
+          return;
+        }
 
+        // Clean up CSRF token
+        localStorage.removeItem("latestCSRFToken");
+
+        // Retrieve stored form data
+        const storedFormData = localStorage.getItem("herokuConnectionFormData");
+        if (!storedFormData) {
+          console.error("No stored form data found");
+          navigate({
+            to: "/organization/app-connections",
+            search: { error: "missing_form_data" }
+          });
+          return;
+        }
+
+        const formData = JSON.parse(storedFormData);
+        localStorage.removeItem("herokuConnectionFormData");
+
+        // Prepare app connection data with OAuth credentials
+        const connectionData = {
+          ...formData,
+          method: HerokuConnectionMethod.OAuth,
+          credentials: {
+            code: code as string
+          }
+        };
+
+        let appConnection;
+
+        // Create or update app connection
+        if (formData.isUpdate && formData.connectionId) {
+          appConnection = await updateAppConnection({
+            connectionId: formData.connectionId,
+            ...connectionData
+          });
+        } else {
+          appConnection = await createAppConnection({
+            workspaceId: currentWorkspace.id,
+            ...connectionData
+          });
+        }
+
+        // Navigate to success page or app connections list
         navigate({
-          to: "/secret-manager/$projectId/integrations/heroku/create",
-          params: {
-            projectId: currentWorkspace.id
-          },
+          to: "/organization/app-connections",
           search: {
-            integrationAuthId: integrationAuth.id
+            success: formData.isUpdate ? "connection_updated" : "connection_created",
+            connectionId: appConnection.id
           }
         });
       } catch (err) {
-        console.error(err);
+        console.error("Error handling Heroku OAuth callback:", err);
+        navigate({
+          to: "/organization/app-connections",
+          search: { error: "connection_failed" }
+        });
       }
     })();
-  }, []);
+  }, [code, state, navigate, createAppConnection, updateAppConnection, currentWorkspace.id]);
 
-  return <div />;
+  return (
+    <div className="flex h-screen items-center justify-center">
+      <div className="text-center">
+        <div className="mx-auto mb-4 h-8 w-8 animate-spin rounded-full border-b-2 border-primary" />
+        <p className="text-gray-600">Connecting to Heroku...</p>
+      </div>
+    </div>
+  );
 };