Merge branch 'main' into feat/assume-role

2026-10-14 14:34:09 +00:00 · 2025-04-28 06:33:26 -07:00
parent 7b42f666f9 8a0cfa34d2
commit e9aa8b317b
410 changed files with 8559 additions and 1184 deletions
@@ -1,8 +1,6 @@
-import { CredentialDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/CredentialDisplay";
-import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
 import { TAuth0ClientSecretRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/auth0-client-secret-rotation";

-import { ViewRotationGeneratedCredentialsDisplay } from "./shared";
+import { CredentialDisplay, ViewRotationGeneratedCredentialsDisplay } from "./shared";

 type Props = {
  generatedCredentialsResponse: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
@@ -17,40 +15,23 @@ export const ViewAuth0ClientSecretRotationGeneratedCredentials = ({
  const inactiveCredentials = generatedCredentials[inactiveIndex];

  return (
-    <>
-      <ViewRotationGeneratedCredentialsDisplay
-        activeCredentials={
-          <>
-            <CredentialDisplay label="Client ID">{activeCredentials?.clientId}</CredentialDisplay>
-            <CredentialDisplay isSensitive label="Client Secret">
-              {activeCredentials?.clientSecret}
-            </CredentialDisplay>
-          </>
-        }
-        inactiveCredentials={
-          <>
-            <CredentialDisplay label="Client ID">{inactiveCredentials?.clientId}</CredentialDisplay>
-            <CredentialDisplay isSensitive label="Client Secret">
-              {inactiveCredentials?.clientSecret}
-            </CredentialDisplay>
-          </>
-        }
-      />
-      <NoticeBannerV2 title="Auth0 Retired Credentials Behavior">
-        <p className="text-sm text-mineshaft-300">
-          Due to how Auth0 client secrets are rotated, retired credentials will not be able to
-          authenticate with Auth0 during their{" "}
-          <a
-            target="_blank"
-            href="https://infisical.com/docs/documentation/platform/secret-rotation/overview#how-rotation-works"
-            rel="noopener noreferrer"
-            className="underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
-          >
-            inactive period
-          </a>
-          . This is a limitation of the Auth0 platform and cannot be rectified by Infisical.
-        </p>
-      </NoticeBannerV2>
-    </>
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <>
+          <CredentialDisplay label="Client ID">{activeCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay isSensitive label="Client Secret">
+            {activeCredentials?.clientSecret}
+          </CredentialDisplay>
+        </>
+      }
+      inactiveCredentials={
+        <>
+          <CredentialDisplay label="Client ID">{inactiveCredentials?.clientId}</CredentialDisplay>
+          <CredentialDisplay isSensitive label="Client Secret">
+            {inactiveCredentials?.clientSecret}
+          </CredentialDisplay>
+        </>
+      }
+    />
  );
 };
@@ -0,0 +1,42 @@
+import { CredentialDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/CredentialDisplay";
+import { TAwsIamUserSecretRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/aws-iam-user-secret-rotation";
+
+import { ViewRotationGeneratedCredentialsDisplay } from "./shared";
+
+type Props = {
+  generatedCredentialsResponse: TAwsIamUserSecretRotationGeneratedCredentialsResponse;
+};
+
+export const ViewAwsIamUserSecretRotationGeneratedCredentials = ({
+  generatedCredentialsResponse: { generatedCredentials, activeIndex }
+}: Props) => {
+  const inactiveIndex = activeIndex === 0 ? 1 : 0;
+
+  const activeCredentials = generatedCredentials[activeIndex];
+  const inactiveCredentials = generatedCredentials[inactiveIndex];
+
+  return (
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <>
+          <CredentialDisplay label="Access Key ID">
+            {activeCredentials?.accessKeyId}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Secret Access Key">
+            {activeCredentials?.secretAccessKey}
+          </CredentialDisplay>
+        </>
+      }
+      inactiveCredentials={
+        <>
+          <CredentialDisplay label="Access Key ID">
+            {inactiveCredentials?.accessKeyId}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Secret Access Key">
+            {inactiveCredentials?.secretAccessKey}
+          </CredentialDisplay>
+        </>
+      }
+    />
+  );
+};
@@ -0,0 +1,41 @@
+import { TLdapPasswordRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";
+
+import { CredentialDisplay, ViewRotationGeneratedCredentialsDisplay } from "./shared";
+
+type Props = {
+  generatedCredentialsResponse: TLdapPasswordRotationGeneratedCredentialsResponse;
+};
+
+export const ViewLdapPasswordRotationGeneratedCredentials = ({
+  generatedCredentialsResponse: { generatedCredentials, activeIndex }
+}: Props) => {
+  const inactiveIndex = activeIndex === 0 ? 1 : 0;
+
+  const activeCredentials = generatedCredentials[activeIndex];
+  const inactiveCredentials = generatedCredentials[inactiveIndex];
+
+  return (
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <>
+          <CredentialDisplay label="Distinguished Name (DN)">
+            {activeCredentials?.dn}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Password">
+            {activeCredentials?.password}
+          </CredentialDisplay>
+        </>
+      }
+      inactiveCredentials={
+        <>
+          <CredentialDisplay label="Distinguished Name (DN)">
+            {inactiveCredentials?.dn}
+          </CredentialDisplay>
+          <CredentialDisplay isSensitive label="Password">
+            {inactiveCredentials?.password}
+          </CredentialDisplay>
+        </>
+      }
+    />
+  );
+};
@@ -4,8 +4,15 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";

 import { ViewAuth0ClientSecretRotationGeneratedCredentials } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewAuth0ClientSecretRotationGeneratedCredentials";
+import { ViewLdapPasswordRotationGeneratedCredentials } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewLdapPasswordRotationGeneratedCredentials";
 import { Modal, ModalContent, Spinner } from "@app/components/v2";
-import { SECRET_ROTATION_MAP } from "@app/helpers/secretRotationsV2";
+import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
+import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
+import {
+  IS_ROTATION_DUAL_CREDENTIALS,
+  SECRET_ROTATION_CONNECTION_MAP,
+  SECRET_ROTATION_MAP
+} from "@app/helpers/secretRotationsV2";
 import {
  SecretRotation,
  TSecretRotationV2,
@@ -13,6 +20,7 @@ import {
 } from "@app/hooks/api/secretRotationsV2";

 import { ViewSqlCredentialsRotationGeneratedCredentials } from "./shared";
+import { ViewAwsIamUserSecretRotationGeneratedCredentials } from "./ViewAwsIamUserSecretRotationGeneratedCredentials";

 type Props = {
  secretRotation?: TSecretRotationV2;
@@ -67,13 +75,46 @@ const Content = ({ secretRotation }: ContentProps) => {
        />
      );
      break;
+    case SecretRotation.LdapPassword:
+      Component = (
+        <ViewLdapPasswordRotationGeneratedCredentials
+          generatedCredentialsResponse={generatedCredentialsResponse}
+        />
+      );
+      break;
+    case SecretRotation.AwsIamUserSecret:
+      Component = (
+        <ViewAwsIamUserSecretRotationGeneratedCredentials
+          generatedCredentialsResponse={generatedCredentialsResponse}
+        />
+      );
+      break;
    default:
      throw new Error("Unhandled View Generated Credential Rotation Type");
  }

+  const appName = APP_CONNECTION_MAP[SECRET_ROTATION_CONNECTION_MAP[type]].name;
+
  return (
    <div className="flex flex-col gap-y-4">
      {Component}
+      {!IS_ROTATION_DUAL_CREDENTIALS[type] && (
+        <NoticeBannerV2 title={`${appName} Retired Credentials Behavior`}>
+          <p className="text-sm text-mineshaft-300">
+            Due to {SECRET_ROTATION_MAP[type].name} Rotations utilizing a single credential set,
+            retired credentials will not be able to authenticate with {appName} during their{" "}
+            <a
+              target="_blank"
+              href="https://infisical.com/docs/documentation/platform/secret-rotation/overview#how-rotation-works"
+              rel="noopener noreferrer"
+              className="underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
+            >
+              inactive period
+            </a>
+            . This is a limitation of {appName} and cannot be rectified by Infisical.
+          </p>
+        </NoticeBannerV2>
+      )}
      {nextRotationAt && (
        <div className="flex items-center gap-x-1.5 text-sm text-mineshaft-200">
          <FontAwesomeIcon icon={faRotate} className="text-mineshaft-400" />
@@ -0,0 +1,84 @@
+import { Controller, useFormContext } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { AwsRegionSelect } from "@app/components/secret-syncs/forms/SecretSyncDestinationFields/shared";
+import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import { TAwsIamUserSecret, useListAwsConnectionIamUsers } from "@app/hooks/api/appConnections/aws";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const AwsIamUserSecretRotationParametersFields = () => {
+  const { control, watch } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.AwsIamUserSecret;
+    }
+  >();
+
+  const connectionId = watch("connection.id");
+
+  const { data: clients, isPending: isClientsPending } = useListAwsConnectionIamUsers({
+    connectionId
+  });
+
+  return (
+    <>
+      <Controller
+        name="parameters.userName"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="IAM User"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content={<>Ensure that your connection has the correct permissions.</>}
+              >
+                <div>
+                  <span>Don&#39;t see the IAM user you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isClientsPending && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={clients?.find((client) => client.UserName === value) ?? ""}
+              onChange={(option) => {
+                onChange((option as SingleValue<TAwsIamUserSecret>)?.UserName ?? "");
+              }}
+              options={clients}
+              placeholder="Select an IAM user..."
+              getOptionLabel={(option) =>
+                (option as SingleValue<TAwsIamUserSecret>)?.UserName ?? ""
+              }
+              getOptionValue={(option) =>
+                (option as SingleValue<TAwsIamUserSecret>)?.UserName ?? ""
+              }
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        name="parameters.region"
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isOptional
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Region"
+            tooltipText="Required only if no global scope is set."
+          >
+            <AwsRegionSelect value={value ?? ""} onChange={onChange} />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
@@ -0,0 +1,169 @@
+import { Controller, useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { DEFAULT_PASSWORD_REQUIREMENTS } from "@app/components/secret-rotations-v2/forms/schemas/shared";
+import { FormControl, Input } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const LdapPasswordRotationParametersFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  return (
+    <>
+      <Controller
+        name="parameters.dn"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Distinguished Name (DN)"
+          >
+            <Input
+              value={value}
+              onChange={onChange}
+              placeholder="CN=John,OU=Users,DC=example,DC=com"
+            />
+          </FormControl>
+        )}
+      />
+      <div className="flex flex-col gap-3">
+        <div className="w-full border-b border-mineshaft-600">
+          <span className="text-sm text-mineshaft-300">Password Requirements</span>
+        </div>
+        <div className="grid grid-cols-2 gap-3 rounded border border-mineshaft-600 bg-mineshaft-700 px-3 py-2">
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.length"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.length}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Password Length"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="The length of the password to generate"
+              >
+                <Input
+                  type="number"
+                  min={1}
+                  max={250}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.digits"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.digits}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Digit Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of digits"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.lowercase"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.lowercase}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Lowercase Character Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of lowercase characters"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.uppercase"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.uppercase}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Uppercase Character Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of uppercase characters"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.required.symbols"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.required.symbols}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Symbol Count"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Minimum number of symbols"
+              >
+                <Input
+                  type="number"
+                  min={0}
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(Number(e.target.value))}
+                />
+              </FormControl>
+            )}
+          />
+          <Controller
+            control={control}
+            name="parameters.passwordRequirements.allowedSymbols"
+            defaultValue={DEFAULT_PASSWORD_REQUIREMENTS.allowedSymbols}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Allowed Symbols"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="Symbols to use in generated password"
+              >
+                <Input
+                  placeholder="-_.~!*"
+                  size="sm"
+                  {...field}
+                  onChange={(e) => field.onChange(e.target.value)}
+                />
+              </FormControl>
+            )}
+          />
+        </div>
+      </div>
+    </>
+  );
+};
@@ -4,12 +4,16 @@ import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { TSecretRotationV2Form } from "../schemas";
 import { Auth0ClientSecretRotationParametersFields } from "./Auth0ClientSecretRotationParametersFields";
+import { AwsIamUserSecretRotationParametersFields } from "./AwsIamUserSecretRotationParametersFields";
+import { LdapPasswordRotationParametersFields } from "./LdapPasswordRotationParametersFields";
 import { SqlCredentialsRotationParametersFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationParametersFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationParametersFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationParametersFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationParametersFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationParametersFields,
+  [SecretRotation.AwsIamUserSecret]: AwsIamUserSecretRotationParametersFields
 };

 export const SecretRotationV2ParametersFields = () => {
@@ -0,0 +1,30 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretRotationReviewSection } from "./shared";
+
+export const AwsIamUserSecretRotationReviewFields = () => {
+  const { watch } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.AwsIamUserSecret;
+    }
+  >();
+
+  const [parameters, { accessKeyId, secretAccessKey }] = watch(["parameters", "secretsMapping"]);
+
+  return (
+    <>
+      <SecretRotationReviewSection label="Parameters">
+        <GenericFieldLabel label="Region">{parameters.region}</GenericFieldLabel>
+        <GenericFieldLabel label="User Name">{parameters.userName}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+      <SecretRotationReviewSection label="Secrets Mapping">
+        <GenericFieldLabel label="Secret Access Key ID">{accessKeyId}</GenericFieldLabel>
+        <GenericFieldLabel label="Secret Access Key">{secretAccessKey}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+    </>
+  );
+};
@@ -0,0 +1,29 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretRotationReviewSection } from "./shared";
+
+export const LdapPasswordRotationReviewFields = () => {
+  const { watch } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  const [parameters, { dn, password }] = watch(["parameters", "secretsMapping"]);
+
+  return (
+    <>
+      <SecretRotationReviewSection label="Parameters">
+        <GenericFieldLabel label="Distinguished Name (DN)">{parameters.dn}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+      <SecretRotationReviewSection label="Secrets Mapping">
+        <GenericFieldLabel label="Distinguished Name (DN)">{dn}</GenericFieldLabel>
+        <GenericFieldLabel label="Password">{password}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+    </>
+  );
+};
@@ -7,12 +7,16 @@ import { getRotateAtLocal } from "@app/helpers/secretRotationsV2";
 import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { Auth0ClientSecretRotationReviewFields } from "./Auth0ClientSecretRotationReviewFields";
+import { AwsIamUserSecretRotationReviewFields } from "./AwsIamUserSecretRotationReviewFields";
+import { LdapPasswordRotationReviewFields } from "./LdapPasswordRotationReviewFields";
 import { SqlCredentialsRotationReviewFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationReviewFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationReviewFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationReviewFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationReviewFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationReviewFields,
+  [SecretRotation.AwsIamUserSecret]: AwsIamUserSecretRotationReviewFields
 };

 export const SecretRotationV2ReviewFields = () => {
@@ -0,0 +1,58 @@
+import { Controller, useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { FormControl, Input } from "@app/components/v2";
+import { SecretRotation, useSecretRotationV2Option } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretsMappingTable } from "./shared";
+
+export const AwsIamUserSecretRotationSecretsMappingFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.AwsIamUserSecret;
+    }
+  >();
+
+  const { rotationOption } = useSecretRotationV2Option(SecretRotation.AwsIamUserSecret);
+
+  const items = [
+    {
+      name: "Access Key ID",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.accessKeyId}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.accessKeyId"
+        />
+      )
+    },
+    {
+      name: "Secret Access Key",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.secretAccessKey}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.secretAccessKey"
+        />
+      )
+    }
+  ];
+
+  return <SecretsMappingTable items={items} />;
+};
@@ -0,0 +1,58 @@
+import { Controller, useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { FormControl, Input } from "@app/components/v2";
+import { SecretRotation, useSecretRotationV2Option } from "@app/hooks/api/secretRotationsV2";
+
+import { SecretsMappingTable } from "./shared";
+
+export const LdapPasswordRotationSecretsMappingFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.LdapPassword;
+    }
+  >();
+
+  const { rotationOption } = useSecretRotationV2Option(SecretRotation.LdapPassword);
+
+  const items = [
+    {
+      name: "DN",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.dn}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.dn"
+        />
+      )
+    },
+    {
+      name: "Password",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={rotationOption?.template.secretsMapping.password}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.password"
+        />
+      )
+    }
+  ];
+
+  return <SecretsMappingTable items={items} />;
+};
@@ -4,12 +4,16 @@ import { SecretRotation } from "@app/hooks/api/secretRotationsV2";

 import { TSecretRotationV2Form } from "../schemas";
 import { Auth0ClientSecretRotationSecretsMappingFields } from "./Auth0ClientSecretRotationSecretsMappingFields";
+import { AwsIamUserSecretRotationSecretsMappingFields } from "./AwsIamUserSecretRotationSecretsMappingFields";
+import { LdapPasswordRotationSecretsMappingFields } from "./LdapPasswordRotationSecretsMappingFields";
 import { SqlCredentialsRotationSecretsMappingFields } from "./shared";

 const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
  [SecretRotation.PostgresCredentials]: SqlCredentialsRotationSecretsMappingFields,
  [SecretRotation.MsSqlCredentials]: SqlCredentialsRotationSecretsMappingFields,
-  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationSecretsMappingFields
+  [SecretRotation.Auth0ClientSecret]: Auth0ClientSecretRotationSecretsMappingFields,
+  [SecretRotation.LdapPassword]: LdapPasswordRotationSecretsMappingFields,
+  [SecretRotation.AwsIamUserSecret]: AwsIamUserSecretRotationSecretsMappingFields
 };

 export const SecretRotationV2SecretsMappingFields = () => {
@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const AwsIamUserSecretRotationSchema = z
+  .object({
+    type: z.literal(SecretRotation.AwsIamUserSecret),
+    parameters: z.object({
+      userName: z.string().trim().min(1, "User Name required"),
+      region: z.string().trim().optional()
+    }),
+    secretsMapping: z.object({
+      accessKeyId: z.string().trim().min(1, "Access Key ID required"),
+      secretAccessKey: z.string().trim().min(1, "Secret Access Key required")
+    })
+  })
+  .merge(BaseSecretRotationSchema);
@@ -1,13 +1,17 @@
 import { z } from "zod";

 import { Auth0ClientSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/auth0-client-secret-rotation-schema";
+import { AwsIamUserSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/aws-iam-user-secret-rotation-schema";
+import { LdapPasswordRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/ldap-password-rotation-schema";
 import { MsSqlCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/mssql-credentials-rotation-schema";
 import { PostgresCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/postgres-credentials-rotation-schema";

 const SecretRotationUnionSchema = z.discriminatedUnion("type", [
  PostgresCredentialsRotationSchema,
  MsSqlCredentialsRotationSchema,
-  Auth0ClientSecretRotationSchema
+  Auth0ClientSecretRotationSchema,
+  LdapPasswordRotationSchema,
+  AwsIamUserSecretRotationSchema
 ]);

 export const SecretRotationV2FormSchema = SecretRotationUnionSchema;
@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
+import { PasswordRequirementsSchema } from "@app/components/secret-rotations-v2/forms/schemas/shared";
+import { DistinguishedNameRegex } from "@app/helpers/string";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+
+export const LdapPasswordRotationSchema = z
+  .object({
+    type: z.literal(SecretRotation.LdapPassword),
+    parameters: z.object({
+      dn: z
+        .string()
+        .trim()
+        .regex(DistinguishedNameRegex, "Invalid Distinguished Name format")
+        .min(1, "Distinguished Name (DN) required"),
+      passwordRequirements: PasswordRequirementsSchema.optional()
+    }),
+    secretsMapping: z.object({
+      dn: z.string().trim().min(1, "Distinguished Name (DN) required"),
+      password: z.string().trim().min(1, "Password required")
+    })
+  })
+  .merge(BaseSecretRotationSchema);
@@ -1 +1,2 @@
+export * from "./password-requirements-schema";
 export * from "./sql-credentials-rotation-schema";
@@ -0,0 +1,47 @@
+import { z } from "zod";
+
+export const PasswordRequirementsSchema = z
+  .object({
+    length: z
+      .number()
+      .min(1, "Password length must be a positive number")
+      .max(250, "Password length must be less than 250"),
+    required: z.object({
+      digits: z.number().min(0, "Digit count must be non-negative"),
+      lowercase: z.number().min(0, "Lowercase count must be non-negative"),
+      uppercase: z.number().min(0, "Uppercase count must be non-negative"),
+      symbols: z.number().min(0, "Symbol count must be non-negative")
+    }),
+    allowedSymbols: z
+      .string()
+      .regex(/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?~]/, "Invalid symbols")
+      .optional()
+      .transform((value) => value || "-_.~!*")
+  })
+  .refine(
+    (data) => {
+      return Object.values(data.required).some((count) => count > 0);
+    },
+    {
+      message: "At least one character type must be required",
+      path: ["required.digits"]
+    }
+  )
+  .refine(
+    (data) => {
+      const total = Object.values(data.required).reduce((sum, count) => sum + count, 0);
+      return total <= data.length;
+    },
+    { message: "Sum of required characters cannot exceed the total length", path: ["length"] }
+  );
+
+export const DEFAULT_PASSWORD_REQUIREMENTS = {
+  length: 48,
+  required: {
+    lowercase: 1,
+    uppercase: 1,
+    digits: 1,
+    symbols: 0
+  },
+  allowedSymbols: "-_.~!*"
+};
@@ -12,6 +12,7 @@ import { DatabricksSyncFields } from "./DatabricksSyncFields";
 import { GcpSyncFields } from "./GcpSyncFields";
 import { GitHubSyncFields } from "./GitHubSyncFields";
 import { HumanitecSyncFields } from "./HumanitecSyncFields";
+import { TeamCitySyncFields } from "./TeamCitySyncFields";
 import { TerraformCloudSyncFields } from "./TerraformCloudSyncFields";
 import { VercelSyncFields } from "./VercelSyncFields";
 import { WindmillSyncFields } from "./WindmillSyncFields";
@@ -46,6 +47,8 @@ export const SecretSyncDestinationFields = () => {
      return <VercelSyncFields />;
    case SecretSync.Windmill:
      return <WindmillSyncFields />;
+    case SecretSync.TeamCity:
+      return <TeamCitySyncFields />;
    default:
      throw new Error(`Unhandled Destination Config Field: ${destination}`);
  }
@@ -0,0 +1,128 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import {
+  TTeamCityProjectWithBuildTypes,
+  useTeamCityConnectionListProjects
+} from "@app/hooks/api/appConnections/teamcity";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const TeamCitySyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.TeamCity }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: projects, isLoading: isProjectsLoading } = useTeamCityConnectionListProjects(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  // For Build Config dropdown
+  const selectedProjectId = useWatch({ name: "destinationConfig.project", control });
+  const selectedProject = projects?.find((proj) => proj.id === selectedProjectId);
+
+  const buildTypes = selectedProject?.buildTypes?.buildType || [];
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.project", "");
+          setValue("destinationConfig.buildConfig", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.project"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Project"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the project exists in the connection's TeamCity instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the project you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={projects?.find((proj) => proj.id === value) ?? null}
+              onChange={(option) => {
+                onChange((option as SingleValue<TTeamCityProjectWithBuildTypes>)?.id ?? null);
+                setValue("destinationConfig.buildConfig", "");
+              }}
+              options={projects}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+
+      <Controller
+        name="destinationConfig.buildConfig"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            isOptional
+            label="Build Configuration"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content='Ensure the configuration exists in the selected project and that your Access Token has the "View build configuration settings" permission.'
+              >
+                <div>
+                  <span>Don&#39;t see the configuration you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId || !selectedProject}
+              value={buildTypes.find((buildType) => buildType.id === value) ?? null}
+              onChange={(option) => {
+                const selectedOption = option as SingleValue<{ id: string; name: string }>;
+                onChange(selectedOption?.id ?? "");
+              }}
+              options={buildTypes}
+              isClearable
+              placeholder="Select a build configuration..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+
+      <span className="text-sm text-bunker-300">
+        Not selecting a Build Configuration will sync your secrets to the entire project.
+      </span>
+    </>
+  );
+};
@@ -43,6 +43,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
    case SecretSync.Camunda:
    case SecretSync.Vercel:
    case SecretSync.Windmill:
+    case SecretSync.TeamCity:
      AdditionalSyncOptionsFieldsComponent = null;
      break;
    default:
@@ -22,6 +22,7 @@ import { DatabricksSyncReviewFields } from "./DatabricksSyncReviewFields";
 import { GcpSyncReviewFields } from "./GcpSyncReviewFields";
 import { GitHubSyncReviewFields } from "./GitHubSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
+import { TeamCitySyncReviewFields } from "./TeamCitySyncReviewFields";
 import { TerraformCloudSyncReviewFields } from "./TerraformCloudSyncReviewFields";
 import { VercelSyncReviewFields } from "./VercelSyncReviewFields";
 import { WindmillSyncReviewFields } from "./WindmillSyncReviewFields";
@@ -88,6 +89,9 @@ export const SecretSyncReviewFields = () => {
    case SecretSync.Windmill:
      DestinationFieldsComponent = <WindmillSyncReviewFields />;
      break;
+    case SecretSync.TeamCity:
+      DestinationFieldsComponent = <TeamCitySyncReviewFields />;
+      break;
    default:
      throw new Error(`Unhandled Destination Review Fields: ${destination}`);
  }
@@ -0,0 +1,18 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const TeamCitySyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.TeamCity }>();
+  const project = watch("destinationConfig.project");
+  const buildConfig = watch("destinationConfig.buildConfig");
+
+  return (
+    <>
+      <GenericFieldLabel label="Project">{project}</GenericFieldLabel>
+      <GenericFieldLabel label="Build Configuration">{buildConfig}</GenericFieldLabel>
+    </>
+  );
+};
@@ -9,6 +9,7 @@ import { DatabricksSyncDestinationSchema } from "./databricks-sync-destination-s
 import { GcpSyncDestinationSchema } from "./gcp-sync-destination-schema";
 import { GitHubSyncDestinationSchema } from "./github-sync-destination-schema";
 import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
+import { TeamCitySyncDestinationSchema } from "./teamcity-sync-destination-schema";
 import { TerraformCloudSyncDestinationSchema } from "./terraform-cloud-destination-schema";
 import { VercelSyncDestinationSchema } from "./vercel-sync-destination-schema";
 import { WindmillSyncDestinationSchema } from "./windmill-sync-destination-schema";
@@ -25,7 +26,8 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
  TerraformCloudSyncDestinationSchema,
  CamundaSyncDestinationSchema,
  VercelSyncDestinationSchema,
-  WindmillSyncDestinationSchema
+  WindmillSyncDestinationSchema,
+  TeamCitySyncDestinationSchema
 ]);

 export const SecretSyncFormSchema = SecretSyncUnionSchema;
@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const TeamCitySyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.TeamCity),
+    destinationConfig: z.object({
+      project: z.string().trim().min(1, "Project required"),
+      buildConfig: z.string().trim().optional()
+    })
+  })
+);
@@ -31,7 +31,7 @@ interface CheckPasswordParams {
 * - Contains at least 1 number (0-9) or special character (emojis included)
 * - Does not contain 3 repeat, consecutive characters
 * - Does not contain any escape characters/sequences
- * - Does not contain PII and/or low entropy data (eg. email address, URL, phone number, DoB, SSN, driver's license, passport)
+ * - Does not contain PII and/or low entropy data (eg. email address, URL, SSN)
 * - Is not in a database of breached passwords
 *
 * The function returns whether or not the password [password]
@@ -20,18 +20,6 @@ export const lowEntropyRegexes = [
  // URL (incl. subdomains, paths, top-level domains & query params)
  /^(?:(?:https?|ftp):\/\/)?(?:\w+\.)?[a-zA-Z0-9.-]+\.(?:com|org|net|edu)(?:\/\S*)?(?:\?\S*)?$/,

-  // Date in various formats
-  /(\b\d{1,4}[-/.]?\d{1,2}[-/.]?\d{1,4}\b)|(\b\d{1,4}[-/.]?\w{3}[-/.]?\d{1,4}\b)/,
-
-  // Phone numbers (generalized)
-  /(?:\+(?:[1-9]\d{0,2})\s?)?(?:\(\d{1,4}\)\s?)?(?:\d[-.\s]?){5,}\d/,
-
-  // Passport numbers (generalized)
-  /\b(?:[A-Z0-9]{6,9}|[A-Z0-9]{8,9}|[A-Z0-9]{9}|[A-Z0-9]{10,11})\b/,
-
-  // Driver's license numbers (generalized)
-  /\b(?:[A-Z0-9]{7,10}|[A-Z0-9]{10,11}|[A-Z0-9]{7,10})\b/,
-
  // US social security number
  /\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/
 ];
@@ -281,6 +281,14 @@ export const ROUTE_PATHS = Object.freeze({
      "/cert-manager/$projectId/overview",
      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/overview"
    ),
+    CertificateAuthoritiesPage: setRoute(
+      "/cert-manager/$projectId/certificate-authorities",
+      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/certificate-authorities"
+    ),
+    AlertingPage: setRoute(
+      "/cert-manager/$projectId/alerting",
+      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/alerting"
+    ),
    PkiCollectionDetailsByIDPage: setRoute(
      "/cert-manager/$projectId/pki-collections/$collectionId",
      "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/pki-collections/$collectionId"
@@ -1,5 +1,12 @@
 import { faGithub } from "@fortawesome/free-brands-svg-icons";
-import { faKey, faLock, faPassport, faServer, faUser } from "@fortawesome/free-solid-svg-icons";
+import {
+  faKey,
+  faLink,
+  faLock,
+  faPassport,
+  faServer,
+  faUser
+} from "@fortawesome/free-solid-svg-icons";

 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import {
@@ -12,9 +19,11 @@ import {
  GcpConnectionMethod,
  GitHubConnectionMethod,
  HumanitecConnectionMethod,
+  LdapConnectionMethod,
  MsSqlConnectionMethod,
  PostgresConnectionMethod,
  TAppConnection,
+  TeamCityConnectionMethod,
  TerraformCloudConnectionMethod,
  VercelConnectionMethod,
  WindmillConnectionMethod
@@ -43,7 +52,9 @@ export const APP_CONNECTION_MAP: Record<
  [AppConnection.MsSql]: { name: "Microsoft SQL Server", image: "MsSql.png" },
  [AppConnection.Camunda]: { name: "Camunda", image: "Camunda.png" },
  [AppConnection.Windmill]: { name: "Windmill", image: "Windmill.png" },
-  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 }
+  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 },
+  [AppConnection.LDAP]: { name: "LDAP", image: "LDAP.png", size: 65 },
+  [AppConnection.TeamCity]: { name: "TeamCity", image: "TeamCity.png" }
 };

 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
@@ -71,10 +82,13 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
    case PostgresConnectionMethod.UsernameAndPassword:
    case MsSqlConnectionMethod.UsernameAndPassword:
      return { name: "Username & Password", icon: faLock };
+    case TeamCityConnectionMethod.AccessToken:
    case WindmillConnectionMethod.AccessToken:
      return { name: "Access Token", icon: faKey };
    case Auth0ConnectionMethod.ClientCredentials:
      return { name: "Client Credentials", icon: faServer };
+    case LdapConnectionMethod.SimpleBind:
+      return { name: "Simple Bind", icon: faLink };
    default:
      throw new Error(`Unhandled App Connection Method: ${method}`);
  }
@@ -19,20 +19,34 @@ export const SECRET_ROTATION_MAP: Record<
    name: "Auth0 Client Secret",
    image: "Auth0.png",
    size: 35
+  },
+  [SecretRotation.LdapPassword]: {
+    name: "LDAP Password",
+    image: "LDAP.png",
+    size: 65
+  },
+  [SecretRotation.AwsIamUserSecret]: {
+    name: "AWS IAM User Secret",
+    image: "Amazon Web Services.png",
+    size: 50
  }
 };

 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
  [SecretRotation.PostgresCredentials]: AppConnection.Postgres,
  [SecretRotation.MsSqlCredentials]: AppConnection.MsSql,
-  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0
+  [SecretRotation.Auth0ClientSecret]: AppConnection.Auth0,
+  [SecretRotation.LdapPassword]: AppConnection.LDAP,
+  [SecretRotation.AwsIamUserSecret]: AppConnection.AWS
 };

 // if a rotation can potentially have downtime due to rotating a single credential set this to false
 export const IS_ROTATION_DUAL_CREDENTIALS: Record<SecretRotation, boolean> = {
  [SecretRotation.PostgresCredentials]: true,
  [SecretRotation.MsSqlCredentials]: true,
-  [SecretRotation.Auth0ClientSecret]: false
+  [SecretRotation.Auth0ClientSecret]: false,
+  [SecretRotation.LdapPassword]: false,
+  [SecretRotation.AwsIamUserSecret]: true
 };

 export const getRotateAtLocal = ({ hours, minutes }: TSecretRotationV2["rotateAtUtc"]) => {
@@ -39,6 +39,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
  [SecretSync.Windmill]: {
    name: "Windmill",
    image: "Windmill.png"
+  },
+  [SecretSync.TeamCity]: {
+    name: "TeamCity",
+    image: "TeamCity.png"
  }
 };

@@ -54,7 +58,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
  [SecretSync.TerraformCloud]: AppConnection.TerraformCloud,
  [SecretSync.Camunda]: AppConnection.Camunda,
  [SecretSync.Vercel]: AppConnection.Vercel,
-  [SecretSync.Windmill]: AppConnection.Windmill
+  [SecretSync.Windmill]: AppConnection.Windmill,
+  [SecretSync.TeamCity]: AppConnection.TeamCity
 };

 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<
@@ -12,3 +12,6 @@ export const isValidPath = (val: string): boolean => {
  const validPathRegex = /^[a-zA-Z0-9-_.:]+(?:\/[a-zA-Z0-9-_.:]+)*$/;
  return validPathRegex.test(val);
 };
+
+export const DistinguishedNameRegex =
+  /^(?:(?:[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)(?:(?:\\+[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)*)(?:,(?:[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)(?:(?:\\+[a-zA-Z0-9]+=[^,+="<>#;\\\\]+)*))*)?$/;
@@ -4,15 +4,20 @@ import { apiRequest } from "@app/config/request";
 import { appConnectionKeys } from "@app/hooks/api/appConnections";

 import {
+  TAwsConnectionIamUser,
  TAwsConnectionKmsKey,
+  TAwsConnectionListIamUsersResponse,
  TAwsConnectionListKmsKeysResponse,
+  TListAwsConnectionIamUsers,
  TListAwsConnectionKmsKeys
 } from "./types";

 const awsConnectionKeys = {
  all: [...appConnectionKeys.all, "aws"] as const,
  listKmsKeys: (params: TListAwsConnectionKmsKeys) =>
-    [...awsConnectionKeys.all, "kms-keys", params] as const
+    [...awsConnectionKeys.all, "kms-keys", params] as const,
+  listIamUsers: (params: TListAwsConnectionIamUsers) =>
+    [...awsConnectionKeys.all, "iam-users", params] as const
 };

 export const useListAwsConnectionKmsKeys = (
@@ -40,3 +45,28 @@ export const useListAwsConnectionKmsKeys = (
    ...options
  });
 };
+
+export const useListAwsConnectionIamUsers = (
+  { connectionId }: TListAwsConnectionIamUsers,
+  options?: Omit<
+    UseQueryOptions<
+      TAwsConnectionIamUser[],
+      unknown,
+      TAwsConnectionIamUser[],
+      ReturnType<typeof awsConnectionKeys.listIamUsers>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: awsConnectionKeys.listIamUsers({ connectionId }),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TAwsConnectionListIamUsersResponse>(
+        `/api/v1/app-connections/aws/${connectionId}/users`
+      );
+
+      return data.iamUsers;
+    },
+    ...options
+  });
+};
@@ -14,3 +14,18 @@ export type TAwsConnectionKmsKey = {
 export type TAwsConnectionListKmsKeysResponse = {
  kmsKeys: TAwsConnectionKmsKey[];
 };
+
+export type TListAwsConnectionIamUsers = {
+  connectionId: string;
+};
+
+export type TAwsConnectionIamUser = {
+  arn: string;
+  UserName: string;
+};
+
+export type TAwsConnectionListIamUsersResponse = {
+  iamUsers: TAwsConnectionIamUser[];
+};
+
+export type TAwsIamUserSecret = TAwsConnectionIamUser;
@@ -12,5 +12,7 @@ export enum AppConnection {
  MsSql = "mssql",
  Camunda = "camunda",
  Windmill = "windmill",
-  Auth0 = "auth0"
+  Auth0 = "auth0",
+  LDAP = "ldap",
+  TeamCity = "teamcity"
 }
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TTeamCityProjectWithBuildTypes } from "./types";
+
+const teamcityConnectionKeys = {
+  all: [...appConnectionKeys.all, "teamcity"] as const,
+  listProjects: (connectionId: string) =>
+    [...teamcityConnectionKeys.all, "projects", connectionId] as const
+};
+
+export const useTeamCityConnectionListProjects = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TTeamCityProjectWithBuildTypes[],
+      unknown,
+      TTeamCityProjectWithBuildTypes[],
+      ReturnType<typeof teamcityConnectionKeys.listProjects>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: teamcityConnectionKeys.listProjects(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TTeamCityProjectWithBuildTypes[]>(
+        `/api/v1/app-connections/teamcity/${connectionId}/projects`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
@@ -0,0 +1,13 @@
+export type TTeamCityProject = {
+  id: string;
+  name: string;
+};
+
+export type TTeamCityProjectWithBuildTypes = TTeamCityProject & {
+  buildTypes: {
+    buildType: {
+      id: string;
+      name: string;
+    }[];
+  };
+};
@@ -67,6 +67,14 @@ export type TAuth0ConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Auth0;
 };

+export type TLdapConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.LDAP;
+};
+
+export type TTeamCityConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.TeamCity;
+};
+
 export type TAppConnectionOption =
  | TAwsConnectionOption
  | TGitHubConnectionOption
@@ -81,7 +89,8 @@ export type TAppConnectionOption =
  | TMsSqlConnectionOption
  | TCamundaConnectionOption
  | TWindmillConnectionOption
-  | TAuth0ConnectionOption;
+  | TAuth0ConnectionOption
+  | TTeamCityConnectionOption;

 export type TAppConnectionOptionMap = {
  [AppConnection.AWS]: TAwsConnectionOption;
@@ -98,4 +107,6 @@ export type TAppConnectionOptionMap = {
  [AppConnection.Camunda]: TCamundaConnectionOption;
  [AppConnection.Windmill]: TWindmillConnectionOption;
  [AppConnection.Auth0]: TAuth0ConnectionOption;
+  [AppConnection.LDAP]: TLdapConnectionOption;
+  [AppConnection.TeamCity]: TTeamCityConnectionOption;
 };
@@ -9,8 +9,10 @@ import { TDatabricksConnection } from "./databricks-connection";
 import { TGcpConnection } from "./gcp-connection";
 import { TGitHubConnection } from "./github-connection";
 import { THumanitecConnection } from "./humanitec-connection";
+import { TLdapConnection } from "./ldap-connection";
 import { TMsSqlConnection } from "./mssql-connection";
 import { TPostgresConnection } from "./postgres-connection";
+import { TTeamCityConnection } from "./teamcity-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
 import { TVercelConnection } from "./vercel-connection";
 import { TWindmillConnection } from "./windmill-connection";
@@ -24,8 +26,10 @@ export * from "./databricks-connection";
 export * from "./gcp-connection";
 export * from "./github-connection";
 export * from "./humanitec-connection";
+export * from "./ldap-connection";
 export * from "./mssql-connection";
 export * from "./postgres-connection";
+export * from "./teamcity-connection";
 export * from "./terraform-cloud-connection";
 export * from "./vercel-connection";
 export * from "./windmill-connection";
@@ -44,7 +48,9 @@ export type TAppConnection =
  | TMsSqlConnection
  | TCamundaConnection
  | TWindmillConnection
-  | TAuth0Connection;
+  | TAuth0Connection
+  | TLdapConnection
+  | TTeamCityConnection;

 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;

@@ -86,4 +92,6 @@ export type TAppConnectionMap = {
  [AppConnection.Camunda]: TCamundaConnection;
  [AppConnection.Windmill]: TWindmillConnection;
  [AppConnection.Auth0]: TAuth0Connection;
+  [AppConnection.LDAP]: TLdapConnection;
+  [AppConnection.TeamCity]: TTeamCityConnection;
 };
@@ -0,0 +1,21 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum LdapConnectionMethod {
+  SimpleBind = "simple-bind"
+}
+
+export enum LdapConnectionProvider {
+  ActiveDirectory = "active-directory"
+}
+
+export type TLdapConnection = TRootAppConnection & { app: AppConnection.LDAP } & {
+  method: LdapConnectionMethod.SimpleBind;
+  credentials: {
+    provider: LdapConnectionProvider;
+    url: string;
+    dn: string;
+    sslRejectUnauthorized?: boolean;
+    sslCertificate?: string;
+  };
+};
@@ -0,0 +1,14 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum TeamCityConnectionMethod {
+  AccessToken = "access-token"
+}
+
+export type TTeamCityConnection = TRootAppConnection & { app: AppConnection.TeamCity } & {
+  method: TeamCityConnectionMethod.AccessToken;
+  credentials: {
+    accessToken: string;
+    instanceUrl: string;
+  };
+};
@@ -84,6 +84,7 @@ export const eventToNameMap: { [K in EventType]: string } = {
  [EventType.ADD_PKI_COLLECTION_ITEM]: "Add PKI collection item",
  [EventType.DELETE_PKI_COLLECTION_ITEM]: "Delete PKI collection item",
  [EventType.ORG_ADMIN_ACCESS_PROJECT]: "Org admin accessed project",
+  [EventType.ORG_ADMIN_BYPASS_SSO]: "Org admin bypassed SSO enforcement",
  [EventType.CREATE_CERTIFICATE_TEMPLATE]: "Create certificate template",
  [EventType.UPDATE_CERTIFICATE_TEMPLATE]: "Update certificate template",
  [EventType.DELETE_CERTIFICATE_TEMPLATE]: "Delete certificate template",
@@ -90,6 +90,7 @@ export enum EventType {
  ADD_PKI_COLLECTION_ITEM = "add-pki-collection-item",
  DELETE_PKI_COLLECTION_ITEM = "delete-pki-collection-item",
  ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project",
+  ORG_ADMIN_BYPASS_SSO = "org-admin-bypassed-sso",
  CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template",
  UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template",
  DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template",
@@ -718,6 +718,11 @@ interface OrgAdminAccessProjectEvent {
  }; // no metadata yet
 }

+interface OrgAdminBypassSSOEvent {
+  type: EventType.ORG_ADMIN_BYPASS_SSO;
+  metadata: Record<string, string>; // no metadata yet
+}
+
 interface CreateCertificateTemplate {
  type: EventType.CREATE_CERTIFICATE_TEMPLATE;
  metadata: {
@@ -885,6 +890,7 @@ export type Event =
  | AddPkiCollectionItem
  | DeletePkiCollectionItem
  | OrgAdminAccessProjectEvent
+  | OrgAdminBypassSSOEvent
  | CreateCertificateTemplate
  | UpdateCertificateTemplate
  | GetCertificateTemplate
@@ -1,7 +1,9 @@
 export enum SecretRotation {
  PostgresCredentials = "postgres-credentials",
  MsSqlCredentials = "mssql-credentials",
-  Auth0ClientSecret = "auth0-client-secret"
+  Auth0ClientSecret = "auth0-client-secret",
+  LdapPassword = "ldap-password",
+  AwsIamUserSecret = "aws-iam-user-secret"
 }

 export enum SecretRotationStatus {
@@ -0,0 +1,38 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export type TAwsIamUserSecretRotation = TSecretRotationV2Base & {
+  type: SecretRotation.AwsIamUserSecret;
+  parameters: {
+    region?: string;
+    userName: string;
+  };
+  secretsMapping: {
+    accessKeyId: string;
+    secretAccessKey: string;
+  };
+};
+
+export type TAwsIamUserSecretRotationGeneratedCredentials = {
+  accessKeyId: string;
+  secretAccessKey: string;
+};
+
+export type TAwsIamUserSecretRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.AwsIamUserSecret,
+    TAwsIamUserSecretRotationGeneratedCredentials
+  >;
+
+export type TAwsIamUserSecretRotationOption = {
+  name: string;
+  type: SecretRotation.AwsIamUserSecret;
+  connection: AppConnection.AWS;
+  template: {
+    secretsMapping: TAwsIamUserSecretRotation["secretsMapping"];
+  };
+};
@@ -4,6 +4,16 @@ import {
  TAuth0ClientSecretRotationGeneratedCredentialsResponse,
  TAuth0ClientSecretRotationOption
 } from "@app/hooks/api/secretRotationsV2/types/auth0-client-secret-rotation";
+import {
+  TAwsIamUserSecretRotation,
+  TAwsIamUserSecretRotationGeneratedCredentialsResponse,
+  TAwsIamUserSecretRotationOption
+} from "@app/hooks/api/secretRotationsV2/types/aws-iam-user-secret-rotation";
+import {
+  TLdapPasswordRotation,
+  TLdapPasswordRotationGeneratedCredentialsResponse,
+  TLdapPasswordRotationOption
+} from "@app/hooks/api/secretRotationsV2/types/ldap-password-rotation";
 import {
  TMsSqlCredentialsRotation,
  TMsSqlCredentialsRotationGeneratedCredentialsResponse
@@ -20,13 +30,17 @@ export type TSecretRotationV2 = (
  | TPostgresCredentialsRotation
  | TMsSqlCredentialsRotation
  | TAuth0ClientSecretRotation
+  | TLdapPasswordRotation
+  | TAwsIamUserSecretRotation
 ) & {
  secrets: (SecretV3RawSanitized | null)[];
 };

 export type TSecretRotationV2Option =
  | TSqlCredentialsRotationOption
-  | TAuth0ClientSecretRotationOption;
+  | TAuth0ClientSecretRotationOption
+  | TLdapPasswordRotationOption
+  | TAwsIamUserSecretRotationOption;

 export type TListSecretRotationV2Options = { secretRotationOptions: TSecretRotationV2Option[] };

@@ -35,7 +49,9 @@ export type TSecretRotationV2Response = { secretRotation: TSecretRotationV2 };
 export type TViewSecretRotationGeneratedCredentialsResponse =
  | TPostgresCredentialsRotationGeneratedCredentialsResponse
  | TMsSqlCredentialsRotationGeneratedCredentialsResponse
-  | TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  | TAuth0ClientSecretRotationGeneratedCredentialsResponse
+  | TLdapPasswordRotationGeneratedCredentialsResponse
+  | TAwsIamUserSecretRotationGeneratedCredentialsResponse;

 export type TCreateSecretRotationV2DTO = DiscriminativePick<
  TSecretRotationV2,
@@ -82,10 +98,14 @@ export type TSecretRotationOptionMap = {
  [SecretRotation.PostgresCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.MsSqlCredentials]: TSqlCredentialsRotationOption;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationOption;
+  [SecretRotation.LdapPassword]: TLdapPasswordRotationOption;
+  [SecretRotation.AwsIamUserSecret]: TAwsIamUserSecretRotationOption;
 };

 export type TSecretRotationGeneratedCredentialsResponseMap = {
  [SecretRotation.PostgresCredentials]: TPostgresCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.MsSqlCredentials]: TMsSqlCredentialsRotationGeneratedCredentialsResponse;
  [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  [SecretRotation.LdapPassword]: TLdapPasswordRotationGeneratedCredentialsResponse;
+  [SecretRotation.AwsIamUserSecret]: TAwsIamUserSecretRotationGeneratedCredentialsResponse;
 };
@@ -0,0 +1,37 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export type TLdapPasswordRotation = TSecretRotationV2Base & {
+  type: SecretRotation.LdapPassword;
+  parameters: {
+    dn: string;
+  };
+  secretsMapping: {
+    dn: string;
+    password: string;
+  };
+};
+
+export type TLdapPasswordRotationGeneratedCredentials = {
+  dn: string;
+  password: string;
+};
+
+export type TLdapPasswordRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.LdapPassword,
+    TLdapPasswordRotationGeneratedCredentials
+  >;
+
+export type TLdapPasswordRotationOption = {
+  name: string;
+  type: SecretRotation.LdapPassword;
+  connection: AppConnection.LDAP;
+  template: {
+    secretsMapping: TLdapPasswordRotation["secretsMapping"];
+  };
+};
@@ -10,7 +10,8 @@ export enum SecretSync {
  TerraformCloud = "terraform-cloud",
  Camunda = "camunda",
  Vercel = "vercel",
-  Windmill = "windmill"
+  Windmill = "windmill",
+  TeamCity = "teamcity"
 }

 export enum SecretSyncStatus {
@@ -10,6 +10,7 @@ import { TDatabricksSync } from "./databricks-sync";
 import { TGcpSync } from "./gcp-sync";
 import { TGitHubSync } from "./github-sync";
 import { THumanitecSync } from "./humanitec-sync";
+import { TTeamCitySync } from "./teamcity-sync";
 import { TTerraformCloudSync } from "./terraform-cloud-sync";
 import { TVercelSync } from "./vercel-sync";
 import { TWindmillSync } from "./windmill-sync";
@@ -32,7 +33,8 @@ export type TSecretSync =
  | TTerraformCloudSync
  | TCamundaSync
  | TVercelSync
-  | TWindmillSync;
+  | TWindmillSync
+  | TTeamCitySync;

 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };

@@ -0,0 +1,16 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TTeamCitySync = TRootSecretSync & {
+  destination: SecretSync.TeamCity;
+  destinationConfig: {
+    project: string;
+    buildConfig?: string;
+  };
+  connection: {
+    app: AppConnection.TeamCity;
+    name: string;
+    id: string;
+  };
+};
@@ -1,6 +1,7 @@
 export {
  useAddUserToWsE2EE,
  useAddUserToWsNonE2EE,
+  useRevokeMySessionById,
  useSendEmailVerificationCode,
  useVerifyEmailVerificationCode
 } from "./mutation";
@@ -171,3 +171,16 @@ export const useResendOrgMemberInvitation = () => {
    }
  });
 };
+
+export const useRevokeMySessionById = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (sessionId: string) => {
+      const { data } = await apiRequest.delete(`/api/v2/users/me/sessions/${sessionId}`);
+      return data;
+    },
+    onSuccess() {
+      queryClient.invalidateQueries({ queryKey: userKeys.mySessions });
+    }
+  });
+};
@@ -4,7 +4,8 @@ export {
  useLeaveProject,
  useMigrateProjectToV3,
  useRequestProjectAccess,
-  useUpdateGroupWorkspaceRole
+  useUpdateGroupWorkspaceRole,
+  useUpdateProjectSshConfig
 } from "./mutations";
 export {
  useAddIdentityToWorkspace,
@@ -14,6 +15,7 @@ export {
  useDeleteUserFromWorkspace,
  useDeleteWorkspace,
  useDeleteWsEnvironment,
+  useGetProjectSshConfig,
  useGetUpgradeProjectStatus,
  useGetUserWorkspaceMemberships,
  useGetUserWorkspaces,
@@ -4,7 +4,11 @@ import { apiRequest } from "@app/config/request";

 import { userKeys } from "../users/query-keys";
 import { workspaceKeys } from "./query-keys";
-import { TUpdateWorkspaceGroupRoleDTO } from "./types";
+import {
+  TProjectSshConfig,
+  TUpdateProjectSshConfigDTO,
+  TUpdateWorkspaceGroupRoleDTO
+} from "./types";

 export const useAddGroupToWorkspace = () => {
  const queryClient = useQueryClient();
@@ -117,3 +121,20 @@ export const useRequestProjectAccess = () => {
    }
  });
 };
+
+export const useUpdateProjectSshConfig = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TProjectSshConfig, object, TUpdateProjectSshConfigDTO>({
+    mutationFn: ({ projectId, defaultUserSshCaId, defaultHostSshCaId }) => {
+      return apiRequest.patch(`/api/v1/workspace/${projectId}/ssh-config`, {
+        defaultUserSshCaId,
+        defaultHostSshCaId
+      });
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: workspaceKeys.getProjectSshConfig(projectId)
+      });
+    }
+  });
+};
@@ -34,6 +34,7 @@ import {
  TListProjectIdentitiesDTO,
  ToggleAutoCapitalizationDTO,
  ToggleDeleteProjectProtectionDTO,
+  TProjectSshConfig,
  TSearchProjectsDTO,
  TUpdateWorkspaceIdentityRoleDTO,
  TUpdateWorkspaceUserRoleDTO,
@@ -430,9 +431,13 @@ export const useDeleteWsEnvironment = () => {
  });
 };

-export const useGetWorkspaceUsers = (workspaceId: string, includeGroupMembers?: boolean) => {
+export const useGetWorkspaceUsers = (
+  workspaceId: string,
+  includeGroupMembers?: boolean,
+  roles?: string[]
+) => {
  return useQuery({
-    queryKey: workspaceKeys.getWorkspaceUsers(workspaceId),
+    queryKey: workspaceKeys.getWorkspaceUsers(workspaceId, includeGroupMembers, roles),
    queryFn: async () => {
      const {
        data: { users }
@@ -440,7 +445,11 @@ export const useGetWorkspaceUsers = (workspaceId: string, includeGroupMembers?:
        `/api/v1/workspace/${workspaceId}/users`,
        {
          params: {
-            includeGroupMembers
+            includeGroupMembers,
+            roles:
+              roles && roles.length > 0
+                ? roles.map((role) => encodeURIComponent(role)).join(",")
+                : undefined
          }
        }
      );
@@ -887,3 +896,17 @@ export const useGetWorkspaceSlackConfig = ({ workspaceId }: { workspaceId: strin
    enabled: Boolean(workspaceId)
  });
 };
+
+export const useGetProjectSshConfig = (projectId: string) => {
+  return useQuery({
+    queryKey: workspaceKeys.getProjectSshConfig(projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TProjectSshConfig>(
+        `/api/v1/workspace/${projectId}/ssh-config`
+      );
+
+      return data;
+    },
+    enabled: Boolean(projectId)
+  });
+};
@@ -15,7 +15,8 @@ export const workspaceKeys = {
    type ? ["workspaces", { type }] : (["workspaces"] as const),
  getWorkspaceAuditLogs: (workspaceId: string) =>
    [{ workspaceId }, "workspace-audit-logs"] as const,
-  getWorkspaceUsers: (workspaceId: string) => [{ workspaceId }, "workspace-users"] as const,
+  getWorkspaceUsers: (workspaceId: string, includeGroupMembers?: boolean, roles?: string[]) =>
+    [{ workspaceId, includeGroupMembers, roles }, "workspace-users"] as const,
  getWorkspaceUserDetails: (workspaceId: string, membershipId: string) =>
    [{ workspaceId, membershipId }, "workspace-user-details"] as const,
  getWorkspaceIdentityMemberships: (workspaceId: string) =>
@@ -69,5 +70,6 @@ export const workspaceKeys = {
    projectId: string;
  }) => [...workspaceKeys.allWorkspaceSshCertificates(projectId), { offset, limit }] as const,
  getWorkspaceSshCertificateTemplates: (projectId: string) =>
-    [{ projectId }, "workspace-ssh-certificate-templates"] as const
+    [{ projectId }, "workspace-ssh-certificate-templates"] as const,
+  getProjectSshConfig: (projectId: string) => [{ projectId }, "project-ssh-config"] as const
 };
@@ -184,3 +184,18 @@ export type TSearchProjectsDTO = {
  orderBy?: ProjectIdentityOrderBy;
  orderDirection?: OrderByDirection;
 };
+
+export type TProjectSshConfig = {
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  projectId: string;
+  defaultUserSshCaId: string | null;
+  defaultHostSshCaId: string | null;
+};
+
+export type TUpdateProjectSshConfigDTO = {
+  projectId: string;
+  defaultUserSshCaId?: string;
+  defaultHostSshCaId?: string;
+};
@@ -57,7 +57,7 @@ import { MenuIconButton } from "../MenuIconButton";
 import { ServerAdminsPanel } from "../ServerAdminsPanel/ServerAdminsPanel";

 const getPlan = (subscription: SubscriptionPlan) => {
-  if (subscription.dynamicSecret) return "Enterprise Plan";
+  if (subscription.groups) return "Enterprise Plan";
  if (subscription.pitRecovery) return "Pro Plan";
  return "Free Plan";
 };
@@ -2,7 +2,7 @@ import { useOrganization, useSubscription } from "@app/context";
 import { SubscriptionPlan } from "@app/hooks/api/types";

 const getPlan = (subscription: SubscriptionPlan) => {
-  if (subscription.dynamicSecret) return "Enterprise Plan";
+  if (subscription.groups) return "Enterprise Plan";
  if (subscription.pitRecovery) return "Pro Plan";
  return "Free Plan";
 };
@@ -4,6 +4,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Link, Outlet, useRouterState } from "@tanstack/react-router";
 import { motion } from "framer-motion";

+import { ProjectPermissionCan } from "@app/components/permissions";
 import {
  BreadcrumbContainer,
  Menu,
@@ -11,7 +12,13 @@ import {
  MenuItem,
  TBreadcrumbFormat
 } from "@app/components/v2";
-import { useProjectPermission, useSubscription, useWorkspace } from "@app/context";
+import {
+  useProjectPermission
+  ProjectPermissionActions,
+  ProjectPermissionSub,
+  useSubscription,
+  useWorkspace
+} from "@app/context";
 import {
  useGetAccessRequestsCount,
  useGetSecretApprovalRequestCount,
@@ -33,6 +40,7 @@ export const ProjectLayout = () => {
  const { assumedPrivilegeDetails } = useProjectPermission();
  const workspaceId = currentWorkspace?.id || "";
  const projectSlug = currentWorkspace?.slug || "";
+  const { subscription } = useSubscription();

  const isSecretManager = currentWorkspace?.type === ProjectType.SecretManager;
  const isCertManager = currentWorkspace?.type === ProjectType.CertificateManager;
@@ -49,7 +57,6 @@ export const ProjectLayout = () => {
  });

  // we only show the secret rotations v1 tab if they have existing rotations
-  const { subscription } = useSubscription();
  const { data: secretRotations } = useGetSecretRotations({
    workspaceId,
    options: {
@@ -95,18 +102,46 @@ export const ProjectLayout = () => {
                        </Link>
                      )}
                      {isCertManager && (
-                        <Link
-                          to={`/${ProjectType.CertificateManager}/$projectId/overview` as const}
-                          params={{
-                            projectId: currentWorkspace.id
-                          }}
-                        >
-                          {({ isActive }) => (
-                            <MenuItem isSelected={isActive} icon="lock-closed">
-                              Overview
-                            </MenuItem>
-                          )}
-                        </Link>
+                        <>
+                          <Link
+                            to={`/${ProjectType.CertificateManager}/$projectId/overview` as const}
+                            params={{
+                              projectId: currentWorkspace.id
+                            }}
+                          >
+                            {({ isActive }) => (
+                              <MenuItem isSelected={isActive} icon="certificate">
+                                Certificates
+                              </MenuItem>
+                            )}
+                          </Link>
+                          <Link
+                            to={
+                              `/${ProjectType.CertificateManager}/$projectId/certificate-authorities` as const
+                            }
+                            params={{
+                              projectId: currentWorkspace.id
+                            }}
+                          >
+                            {({ isActive }) => (
+                              <MenuItem isSelected={isActive} icon="certificate-authority">
+                                Certificate Authorities
+                              </MenuItem>
+                            )}
+                          </Link>
+                          <Link
+                            to={`/${ProjectType.CertificateManager}/$projectId/alerting` as const}
+                            params={{
+                              projectId: currentWorkspace.id
+                            }}
+                          >
+                            {({ isActive }) => (
+                              <MenuItem isSelected={isActive} icon="notification-bell">
+                                Alerting
+                              </MenuItem>
+                            )}
+                          </Link>
+                        </>
                      )}
                      {isCmek && (
                        <Link
@@ -162,22 +197,31 @@ export const ProjectLayout = () => {
                              </MenuItem>
                            )}
                          </Link> */}
-                          {/* <Link
-                            to={`/${ProjectType.SSH}/$projectId/cas` as const}
-                            params={{
-                              projectId: currentWorkspace.id
-                            }}
+                          <ProjectPermissionCan
+                            I={ProjectPermissionActions.Read}
+                            a={ProjectPermissionSub.SshCertificateAuthorities}
                          >
-                            {({ isActive }) => (
-                              <MenuItem
-                                isSelected={isActive}
-                                icon="certificate-authority"
-                                iconMode="reverse"
-                              >
-                                Certificate Authorities
-                              </MenuItem>
-                            )}
-                          </Link> */}
+                            {(isAllowed) =>
+                              isAllowed && (
+                                <Link
+                                  to={`/${ProjectType.SSH}/$projectId/cas` as const}
+                                  params={{
+                                    projectId: currentWorkspace.id
+                                  }}
+                                >
+                                  {({ isActive }) => (
+                                    <MenuItem
+                                      isSelected={isActive}
+                                      icon="certificate-authority"
+                                      iconMode="reverse"
+                                    >
+                                      Certificate Authorities
+                                    </MenuItem>
+                                  )}
+                                </Link>
+                              )
+                            }
+                          </ProjectPermissionCan>
                        </>
                      )}
                      {isSecretManager && (
@@ -11,3 +11,65 @@ export const formatReservedPaths = (secretPath: string) => {
 export const camelCaseToSpaces = (input: string) => {
  return input.replace(/([a-z])([A-Z])/g, "$1 $2");
 };
+
+export const formatSessionUserAgent = (userAgent: string) => {
+  const result = {
+    os: "Unknown",
+    browser: "Unknown",
+    device: "Desktop"
+  };
+
+  // Operating System detection
+  if (userAgent.includes("Windows")) {
+    result.os = "Windows";
+  } else if (
+    userAgent.includes("Mac OS") ||
+    userAgent.includes("Macintosh") ||
+    userAgent.includes("macOS")
+  ) {
+    result.os = "macOS";
+  } else if (userAgent.includes("Linux") && !userAgent.includes("Android")) {
+    result.os = "Linux";
+  } else if (userAgent.includes("Android")) {
+    result.os = "Android";
+    result.device = "Mobile";
+  } else if (
+    userAgent.includes("iOS") ||
+    userAgent.includes("iPhone") ||
+    userAgent.includes("iPad")
+  ) {
+    result.os = "iOS";
+    result.device = userAgent.includes("iPad") ? "Tablet" : "Mobile";
+  }
+
+  // Browser detection
+  if (userAgent.includes("Firefox/")) {
+    result.browser = "Firefox";
+  } else if (userAgent.includes("Edge/") || userAgent.includes("Edg/")) {
+    result.browser = "Edge";
+  } else if (userAgent.includes("Brave/") || userAgent.includes("Brave ")) {
+    result.browser = "Brave";
+  } else if (
+    userAgent.includes("Chrome/") &&
+    !userAgent.includes("Chromium/") &&
+    !userAgent.includes("Edg/")
+  ) {
+    result.browser = "Chrome";
+  } else if (
+    userAgent.includes("Safari/") &&
+    !userAgent.includes("Chrome/") &&
+    !userAgent.includes("Chromium/")
+  ) {
+    result.browser = "Safari";
+  } else if (userAgent.includes("Opera/") || userAgent.includes("OPR/")) {
+    result.browser = "Opera";
+  } else if (userAgent.includes("Trident/") || userAgent.includes("MSIE")) {
+    result.browser = "Internet Explorer";
+  }
+
+  if (userAgent.toLowerCase() === "cli") {
+    result.browser = "CLI";
+  }
+
+  return result;
+};
@@ -0,0 +1,29 @@
+import { Helmet } from "react-helmet";
+import { useTranslation } from "react-i18next";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { PageHeader } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+
+import { PkiAlertsSection } from "./components";
+
+export const AlertingPage = () => {
+  const { t } = useTranslation();
+  return (
+    <div className="container mx-auto flex h-full flex-col justify-between bg-bunker-800 text-white">
+      <Helmet>
+        <title>{t("common.head-title", { title: "Alerting" })}</title>
+      </Helmet>
+      <div className="mx-auto mb-6 w-full max-w-7xl">
+        <PageHeader title="Alerting" />
+        <ProjectPermissionCan
+          renderGuardBanner
+          I={ProjectPermissionActions.Read}
+          a={ProjectPermissionSub.PkiAlerts}
+        >
+          <PkiAlertsSection />
+        </ProjectPermissionCan>
+      </div>
+    </div>
+  );
+};
@@ -0,0 +1,19 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { AlertingPage } from "./AlertingPage";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/alerting"
+)({
+  component: AlertingPage,
+  beforeLoad: ({ context }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Alerting"
+        }
+      ]
+    };
+  }
+});
@@ -20,9 +20,9 @@ import { useDeleteCa, useGetCaById } from "@app/hooks/api";
 import { ProjectType } from "@app/hooks/api/workspace/types";
 import { usePopUp } from "@app/hooks/usePopUp";

-import { CaInstallCertModal } from "../CertificatesPage/components/CaTab/components/CaInstallCertModal";
-import { CaModal } from "../CertificatesPage/components/CaTab/components/CaModal";
-import { CertificateTemplatesSection } from "../CertificatesPage/components/CertificatesTab/components/CertificateTemplatesSection";
+import { CaInstallCertModal } from "../CertificateAuthoritiesPage/components/CaInstallCertModal";
+import { CaModal } from "../CertificateAuthoritiesPage/components/CaModal";
+import { CertificateTemplatesSection } from "../CertificatesPage/components/CertificateTemplatesSection";
 import {
  CaCertificatesSection,
  CaCrlsSection,
@@ -13,7 +13,7 @@ export const Route = createFileRoute(
        {
          label: "Certificate Authorities",
          link: linkOptions({
-            to: "/cert-manager/$projectId/overview",
+            to: "/cert-manager/$projectId/certificate-authorities",
            params: {
              projectId: params.projectId
            }
@@ -0,0 +1,29 @@
+import { Helmet } from "react-helmet";
+import { useTranslation } from "react-i18next";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { PageHeader } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+
+import { CaSection } from "./components";
+
+export const CertificateAuthoritiesPage = () => {
+  const { t } = useTranslation();
+  return (
+    <div className="container mx-auto flex h-full flex-col justify-between bg-bunker-800 text-white">
+      <Helmet>
+        <title>{t("common.head-title", { title: "Certificate Authorities" })}</title>
+      </Helmet>
+      <div className="mx-auto mb-6 w-full max-w-7xl">
+        <PageHeader title="Certificate Authorities" />
+        <ProjectPermissionCan
+          renderGuardBanner
+          I={ProjectPermissionActions.Read}
+          a={ProjectPermissionSub.CertificateAuthorities}
+        >
+          <CaSection />
+        </ProjectPermissionCan>
+      </div>
+    </div>
+  );
+};
@@ -2,7 +2,7 @@ import { Modal, ModalContent } from "@app/components/v2";
 import { useGetCaCert } from "@app/hooks/api";
 import { UsePopUpState } from "@app/hooks/usePopUp";

-import { CertificateContent } from "../../CertificatesTab/components/CertificateContent";
+import { CertificateContent } from "../../CertificatesPage/components/CertificateContent";

 type Props = {
  popUp: UsePopUpState<["caCert"]>;
@@ -0,0 +1,19 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { CertificateAuthoritiesPage } from "./CertificateAuthoritiesPage";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/cert-manager/$projectId/_cert-manager-layout/certificate-authorities"
+)({
+  component: CertificateAuthoritiesPage,
+  beforeLoad: ({ context }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Certificate Authorities"
+        }
+      ]
+    };
+  }
+});
@@ -2,63 +2,49 @@ import { Helmet } from "react-helmet";
 import { useTranslation } from "react-i18next";

 import { ProjectPermissionCan } from "@app/components/permissions";
-import { PageHeader, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { PageHeader } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";

-import { CaTab, CertificatesTab, PkiAlertsTab } from "./components";
-
-enum TabSections {
-  Ca = "certificate-authorities",
-  Certificates = "certificates",
-  Alerting = "alerting"
-}
+import { PkiCollectionSection } from "../AlertingPage/components";
+import { CertificatesSection } from "./components";

 export const CertificatesPage = () => {
  const { t } = useTranslation();
+  const { permission } = useProjectPermission();
+
+  const canAccessPkiColl = permission.can(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.PkiCollections
+  );
+  const canAccessCerts = permission.can(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.Certificates
+  );
+
  return (
    <div className="container mx-auto flex h-full flex-col justify-between bg-bunker-800 text-white">
      <Helmet>
        <title>{t("common.head-title", { title: "Certificates" })}</title>
      </Helmet>
      <div className="mx-auto mb-6 w-full max-w-7xl">
-        <PageHeader title="Overview" />
-        <Tabs defaultValue={TabSections.Certificates}>
-          <TabList>
-            <Tab value={TabSections.Certificates}>Certificates</Tab>
-            <Tab value={TabSections.Ca}>Certificate Authorities</Tab>
-            <Tab value={TabSections.Alerting}>Alerting</Tab>
-          </TabList>
-          <TabPanel value={TabSections.Certificates}>
-            <ProjectPermissionCan
-              renderGuardBanner
-              passThrough={false}
-              I={ProjectPermissionActions.Read}
-              a={ProjectPermissionSub.Certificates}
-            >
-              <CertificatesTab />
-            </ProjectPermissionCan>
-          </TabPanel>
-          <TabPanel value={TabSections.Ca}>
-            <ProjectPermissionCan
-              renderGuardBanner
-              passThrough={false}
-              I={ProjectPermissionActions.Read}
-              a={ProjectPermissionSub.CertificateAuthorities}
-            >
-              <CaTab />
-            </ProjectPermissionCan>
-          </TabPanel>
-          <TabPanel value={TabSections.Alerting}>
-            <ProjectPermissionCan
-              renderGuardBanner
-              passThrough={false}
-              I={ProjectPermissionActions.Read}
-              a={ProjectPermissionSub.PkiAlerts}
-            >
-              <PkiAlertsTab />
-            </ProjectPermissionCan>
-          </TabPanel>
-        </Tabs>
+        <PageHeader title="Certificates" />
+        {/* If both are false, the section does not render. This is to prevent duplicate banners. */}
+        {(canAccessCerts || canAccessPkiColl) && (
+          <ProjectPermissionCan
+            renderGuardBanner
+            I={ProjectPermissionActions.Read}
+            a={ProjectPermissionSub.PkiCollections}
+          >
+            <PkiCollectionSection />
+          </ProjectPermissionCan>
+        )}
+        <ProjectPermissionCan
+          renderGuardBanner
+          I={ProjectPermissionActions.Read}
+          a={ProjectPermissionSub.Certificates}
+        >
+          <CertificatesSection />
+        </ProjectPermissionCan>
      </div>
    </div>
  );
@@ -1,17 +0,0 @@
-import { motion } from "framer-motion";
-
-import { CaSection } from "./components";
-
-export const CaTab = () => {
-  return (
-    <motion.div
-      key="panel-certificate-authorities"
-      transition={{ duration: 0.15 }}
-      initial={{ opacity: 0, translateX: 30 }}
-      animate={{ opacity: 1, translateX: 0 }}
-      exit={{ opacity: 0, translateX: 30 }}
-    >
-      <CaSection />
-    </motion.div>
-  );
-};
@@ -1 +0,0 @@
-export { CaTab } from "./CaTab";
--- a/Show More
+++ b/Show More