Merge branch 'main' into feat/azureClientSecretsRotation

2026-10-14 13:22:08 +00:00 · 2025-04-21 10:27:56 -03:00
parent ccd7b0062e eba12912f8
commit ef47d0056f
175 changed files with 2608 additions and 249 deletions
@@ -14,6 +14,7 @@ import { GitHubSyncFields } from "./GitHubSyncFields";
 import { HumanitecSyncFields } from "./HumanitecSyncFields";
 import { TerraformCloudSyncFields } from "./TerraformCloudSyncFields";
 import { VercelSyncFields } from "./VercelSyncFields";
+import { WindmillSyncFields } from "./WindmillSyncFields";

 export const SecretSyncDestinationFields = () => {
  const { watch } = useFormContext<TSecretSyncForm>();
@@ -43,6 +44,8 @@ export const SecretSyncDestinationFields = () => {
      return <CamundaSyncFields />;
    case SecretSync.Vercel:
      return <VercelSyncFields />;
+    case SecretSync.Windmill:
+      return <WindmillSyncFields />;
    default:
      throw new Error(`Unhandled Destination Config Field: ${destination}`);
  }
@@ -0,0 +1,105 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl, Input, Tooltip } from "@app/components/v2";
+import {
+  TWindmillWorkspace,
+  useWindmillConnectionListWorkspaces
+} from "@app/hooks/api/appConnections/windmill";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const WindmillSyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.Windmill }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: workspaces, isLoading: isWorkspacesLoading } = useWindmillConnectionListWorkspaces(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.workspace", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.workspace"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Workspace"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the workspace exists in the connection's Windmill instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the workspace you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isWorkspacesLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={workspaces?.find((workspace) => workspace.name === value) ?? null}
+              onChange={(option) =>
+                onChange((option as SingleValue<TWindmillWorkspace>)?.name ?? null)
+              }
+              options={workspaces}
+              placeholder="Select a workspace..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.name}
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        name="destinationConfig.path"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            tooltipClassName="max-w-sm"
+            tooltipText={
+              <>
+                The workspace path where secrets should be synced to. Path must follow Windmill{" "}
+                <a
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  href="https://www.windmill.dev/docs/core_concepts/roles_and_permissions#path"
+                >
+                  <span className="cursor-pointer underline decoration-primary underline-offset-2 hover:text-mineshaft-200">
+                    owner path convention
+                  </span>
+                  .
+                </a>
+              </>
+            }
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Path"
+          >
+            <Input value={value} onChange={onChange} placeholder="f/folder-name/" />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
@@ -42,6 +42,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
    case SecretSync.TerraformCloud:
    case SecretSync.Camunda:
    case SecretSync.Vercel:
+    case SecretSync.Windmill:
      AdditionalSyncOptionsFieldsComponent = null;
      break;
    default:
@@ -24,6 +24,7 @@ import { GitHubSyncReviewFields } from "./GitHubSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
 import { TerraformCloudSyncReviewFields } from "./TerraformCloudSyncReviewFields";
 import { VercelSyncReviewFields } from "./VercelSyncReviewFields";
+import { WindmillSyncReviewFields } from "./WindmillSyncReviewFields";

 export const SecretSyncReviewFields = () => {
  const { watch } = useFormContext<TSecretSyncForm>();
@@ -84,6 +85,9 @@ export const SecretSyncReviewFields = () => {
    case SecretSync.Vercel:
      DestinationFieldsComponent = <VercelSyncReviewFields />;
      break;
+    case SecretSync.Windmill:
+      DestinationFieldsComponent = <WindmillSyncReviewFields />;
+      break;
    default:
      throw new Error(`Unhandled Destination Review Fields: ${destination}`);
  }
@@ -0,0 +1,18 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const WindmillSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Windmill }>();
+  const workspace = watch("destinationConfig.workspace");
+  const path = watch("destinationConfig.path");
+
+  return (
+    <>
+      <GenericFieldLabel label="Workspace">{workspace}</GenericFieldLabel>
+      <GenericFieldLabel label="Path">{path}</GenericFieldLabel>
+    </>
+  );
+};
@@ -1,17 +1,17 @@
 import { z } from "zod";

-import { AwsSecretsManagerSyncDestinationSchema } from "@app/components/secret-syncs/forms/schemas/aws-secrets-manager-sync-destination-schema";
-import { DatabricksSyncDestinationSchema } from "@app/components/secret-syncs/forms/schemas/databricks-sync-destination-schema";
-import { GitHubSyncDestinationSchema } from "@app/components/secret-syncs/forms/schemas/github-sync-destination-schema";
-
 import { AwsParameterStoreSyncDestinationSchema } from "./aws-parameter-store-sync-destination-schema";
+import { AwsSecretsManagerSyncDestinationSchema } from "./aws-secrets-manager-sync-destination-schema";
 import { AzureAppConfigurationSyncDestinationSchema } from "./azure-app-configuration-sync-destination-schema";
 import { AzureKeyVaultSyncDestinationSchema } from "./azure-key-vault-sync-destination-schema";
 import { CamundaSyncDestinationSchema } from "./camunda-sync-destination-schema";
+import { DatabricksSyncDestinationSchema } from "./databricks-sync-destination-schema";
 import { GcpSyncDestinationSchema } from "./gcp-sync-destination-schema";
+import { GitHubSyncDestinationSchema } from "./github-sync-destination-schema";
 import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
 import { TerraformCloudSyncDestinationSchema } from "./terraform-cloud-destination-schema";
 import { VercelSyncDestinationSchema } from "./vercel-sync-destination-schema";
+import { WindmillSyncDestinationSchema } from "./windmill-sync-destination-schema";

 const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
  AwsParameterStoreSyncDestinationSchema,
@@ -24,7 +24,8 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
  HumanitecSyncDestinationSchema,
  TerraformCloudSyncDestinationSchema,
  CamundaSyncDestinationSchema,
-  VercelSyncDestinationSchema
+  VercelSyncDestinationSchema,
+  WindmillSyncDestinationSchema
 ]);

 export const SecretSyncFormSchema = SecretSyncUnionSchema;
@@ -0,0 +1,21 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const WindmillSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.Windmill),
+    destinationConfig: z.object({
+      workspace: z.string().trim().min(1, "Workspace required"),
+      path: z
+        .string()
+        .trim()
+        .min(1, "Path required")
+        .regex(
+          /^([uf])\/([a-zA-Z0-9_-]+)(\/[a-zA-Z0-9_-]+)*\/$/,
+          'Invalid path - must follow Windmill path format. ex: "f/folder/path/"'
+        )
+    })
+  })
+);
@@ -112,9 +112,8 @@ const PasswordGeneratorModal = ({
        className="w-full max-w-lg rounded-lg border border-mineshaft-600 bg-mineshaft-800 shadow-xl"
      >
        <div className="p-6">
-          <h2 className="mb-1 text-xl font-semibold text-bunker-200">Password Generator</h2>
-          <p className="mb-6 text-sm text-bunker-400">Generate strong unique passwords</p>
-
+          <h2 className="mb-1 text-xl font-semibold text-bunker-200">Generate Random Value</h2>
+          <p className="mb-6 text-sm text-bunker-400">Generate strong unique values</p>
          <div className="relative mb-4 rounded-md bg-mineshaft-900 p-4">
            <div className="flex items-center justify-between">
              <div className="w-4/5 select-all break-all pr-2 font-mono text-lg">{password}</div>
@@ -146,18 +145,18 @@ const PasswordGeneratorModal = ({

          <div className="mb-6">
            <div className="mb-1 flex items-center justify-between">
-              <label htmlFor="password-length" className="text-sm text-bunker-300">
-                Password length: {passwordOptions.length}
+              <label htmlFor="value-length" className="text-sm text-bunker-300">
+                Length: {passwordOptions.length}
              </label>
            </div>
            <Slider
-              id="password-length"
+              id="value-length"
              min={minLength}
              max={maxLength}
              value={passwordOptions.length}
              onChange={(value) => setPasswordOptions({ ...passwordOptions, length: value })}
              className="mb-1"
-              aria-labelledby="password-length-label"
+              aria-labelledby="value-length-label"
            />
          </div>

@@ -219,7 +218,7 @@ const PasswordGeneratorModal = ({
                onClick={usePassword}
                className="ml-2"
              >
-                Use Password
+                Use Value
              </Button>
            )}
          </div>
@@ -251,12 +250,13 @@ export const PasswordGenerator = ({
  return (
    <>
      <IconButton
-        ariaLabel="generate password"
-        colorSchema="secondary"
+        ariaLabel="generate value"
+        colorSchema="primary"
+        variant="outline_bg"
        size="sm"
        onClick={toggleGenerator}
        isDisabled={isDisabled}
-        className="rounded text-bunker-400 transition-colors duration-150 hover:bg-mineshaft-700 hover:text-bunker-200"
+        className="rounded"
      >
        <FontAwesomeIcon icon={faKey} />
      </IconButton>
@@ -17,7 +17,8 @@ import {
  PostgresConnectionMethod,
  TAppConnection,
  TerraformCloudConnectionMethod,
-  VercelConnectionMethod
+  VercelConnectionMethod,
+  WindmillConnectionMethod
 } from "@app/hooks/api/appConnections/types";

 export const APP_CONNECTION_MAP: Record<
@@ -46,6 +47,7 @@ export const APP_CONNECTION_MAP: Record<
  [AppConnection.Postgres]: { name: "PostgreSQL", image: "Postgres.png" },
  [AppConnection.MsSql]: { name: "Microsoft SQL Server", image: "MsSql.png" },
  [AppConnection.Camunda]: { name: "Camunda", image: "Camunda.png" },
+  [AppConnection.Windmill]: { name: "Windmill", image: "Windmill.png" },
  [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 }
 };

@@ -75,6 +77,8 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
    case PostgresConnectionMethod.UsernameAndPassword:
    case MsSqlConnectionMethod.UsernameAndPassword:
      return { name: "Username & Password", icon: faLock };
+    case WindmillConnectionMethod.AccessToken:
+      return { name: "Access Token", icon: faKey };
    case Auth0ConnectionMethod.ClientCredentials:
      return { name: "Client Credentials", icon: faServer };
    default:
@@ -1,6 +1,6 @@
 import { ProjectMembershipRole, TOrgRole } from "@app/hooks/api/roles/types";

-enum OrgMembershipRole {
+export enum OrgMembershipRole {
  Admin = "admin",
  Member = "member",
  NoAccess = "no-access"
@@ -35,6 +35,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
  [SecretSync.Vercel]: {
    name: "Vercel",
    image: "Vercel.png"
+  },
+  [SecretSync.Windmill]: {
+    name: "Windmill",
+    image: "Windmill.png"
  }
 };

@@ -49,7 +53,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
  [SecretSync.Humanitec]: AppConnection.Humanitec,
  [SecretSync.TerraformCloud]: AppConnection.TerraformCloud,
  [SecretSync.Camunda]: AppConnection.Camunda,
-  [SecretSync.Vercel]: AppConnection.Vercel
+  [SecretSync.Vercel]: AppConnection.Vercel,
+  [SecretSync.Windmill]: AppConnection.Windmill
 };

 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<
@@ -12,5 +12,6 @@ export enum AppConnection {
  Postgres = "postgres",
  MsSql = "mssql",
  Camunda = "camunda",
+  Windmill = "windmill",
  Auth0 = "auth0"
 }
@@ -64,6 +64,10 @@ export type TCamundaConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Camunda;
 };

+export type TWindmillConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Windmill;
+};
+
 export type TAuth0ConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Auth0;
 };
@@ -82,6 +86,7 @@ export type TAppConnectionOption =
  | TPostgresConnectionOption
  | TMsSqlConnectionOption
  | TCamundaConnectionOption
+  | TWindmillConnectionOption
  | TAuth0ConnectionOption;

 export type TAppConnectionOptionMap = {
@@ -98,5 +103,6 @@ export type TAppConnectionOptionMap = {
  [AppConnection.Postgres]: TPostgresConnectionOption;
  [AppConnection.MsSql]: TMsSqlConnectionOption;
  [AppConnection.Camunda]: TCamundaConnectionOption;
+  [AppConnection.Windmill]: TWindmillConnectionOption;
  [AppConnection.Auth0]: TAuth0ConnectionOption;
 };
@@ -14,6 +14,7 @@ import { TMsSqlConnection } from "./mssql-connection";
 import { TPostgresConnection } from "./postgres-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
 import { TVercelConnection } from "./vercel-connection";
+import { TWindmillConnection } from "./windmill-connection";

 export * from "./auth0-connection";
 export * from "./aws-connection";
@@ -29,6 +30,7 @@ export * from "./mssql-connection";
 export * from "./postgres-connection";
 export * from "./terraform-cloud-connection";
 export * from "./vercel-connection";
+export * from "./windmill-connection";

 export type TAppConnection =
  | TAwsConnection
@@ -44,6 +46,7 @@ export type TAppConnection =
  | TPostgresConnection
  | TMsSqlConnection
  | TCamundaConnection
+  | TWindmillConnection
  | TAuth0Connection;

 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
@@ -85,5 +88,6 @@ export type TAppConnectionMap = {
  [AppConnection.MsSql]: TMsSqlConnection;
  [AppConnection.Camunda]: TCamundaConnection;
  [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
+  [AppConnection.Windmill]: TWindmillConnection;
  [AppConnection.Auth0]: TAuth0Connection;
 };
@@ -0,0 +1,14 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum WindmillConnectionMethod {
+  AccessToken = "access-token"
+}
+
+export type TWindmillConnection = TRootAppConnection & { app: AppConnection.Windmill } & {
+  method: WindmillConnectionMethod.AccessToken;
+  credentials: {
+    accessToken: string;
+    instanceUrl?: string;
+  };
+};
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TWindmillWorkspace } from "./types";
+
+const windmillConnectionKeys = {
+  all: [...appConnectionKeys.all, "windmill"] as const,
+  listWorkspaces: (connectionId: string) =>
+    [...windmillConnectionKeys.all, "workspaces", connectionId] as const
+};
+
+export const useWindmillConnectionListWorkspaces = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TWindmillWorkspace[],
+      unknown,
+      TWindmillWorkspace[],
+      ReturnType<typeof windmillConnectionKeys.listWorkspaces>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: windmillConnectionKeys.listWorkspaces(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TWindmillWorkspace[]>(
+        `/api/v1/app-connections/windmill/${connectionId}/workspaces`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
@@ -0,0 +1,4 @@
+export type TWindmillWorkspace = {
+  id: string;
+  name: string;
+};
@@ -4,6 +4,7 @@ import { apiRequest } from "@app/config/request";

 import { organizationKeys } from "../organization/queries";
 import { oidcConfigKeys } from "./queries";
+import { OIDCJWTSignatureAlgorithm } from "./types";

 export const useUpdateOIDCConfig = () => {
  const queryClient = useQueryClient();
@@ -21,7 +22,8 @@ export const useUpdateOIDCConfig = () => {
      clientSecret,
      isActive,
      orgSlug,
-      manageGroupMemberships
+      manageGroupMemberships,
+      jwtSignatureAlgorithm
    }: {
      allowedEmailDomains?: string;
      issuer?: string;
@@ -36,6 +38,7 @@ export const useUpdateOIDCConfig = () => {
      configurationType?: string;
      orgSlug: string;
      manageGroupMemberships?: boolean;
+      jwtSignatureAlgorithm?: OIDCJWTSignatureAlgorithm;
    }) => {
      const { data } = await apiRequest.patch("/api/v1/sso/oidc/config", {
        issuer,
@@ -50,7 +53,8 @@ export const useUpdateOIDCConfig = () => {
        orgSlug,
        clientSecret,
        isActive,
-        manageGroupMemberships
+        manageGroupMemberships,
+        jwtSignatureAlgorithm
      });

      return data;
@@ -78,7 +82,8 @@ export const useCreateOIDCConfig = () => {
      clientSecret,
      isActive,
      orgSlug,
-      manageGroupMemberships
+      manageGroupMemberships,
+      jwtSignatureAlgorithm
    }: {
      issuer?: string;
      configurationType: string;
@@ -93,6 +98,7 @@ export const useCreateOIDCConfig = () => {
      orgSlug: string;
      allowedEmailDomains?: string;
      manageGroupMemberships?: boolean;
+      jwtSignatureAlgorithm?: OIDCJWTSignatureAlgorithm;
    }) => {
      const { data } = await apiRequest.post("/api/v1/sso/oidc/config", {
        issuer,
@@ -107,7 +113,8 @@ export const useCreateOIDCConfig = () => {
        clientSecret,
        isActive,
        orgSlug,
-        manageGroupMemberships
+        manageGroupMemberships,
+        jwtSignatureAlgorithm
      });

      return data;
@@ -13,4 +13,11 @@ export type OIDCConfigData = {
  clientSecret: string;
  allowedEmailDomains?: string;
  manageGroupMemberships: boolean;
+  jwtSignatureAlgorithm: OIDCJWTSignatureAlgorithm;
 };
+
+export enum OIDCJWTSignatureAlgorithm {
+  RS256 = "RS256",
+  HS256 = "HS256",
+  RS512 = "RS512"
+}
@@ -110,7 +110,8 @@ export const useUpdateOrg = () => {
      defaultMembershipRoleSlug,
      enforceMfa,
      selectedMfaMethod,
-      allowSecretSharingOutsideOrganization
+      allowSecretSharingOutsideOrganization,
+      bypassOrgAuthEnabled
    }) => {
      return apiRequest.patch(`/api/v1/organization/${orgId}`, {
        name,
@@ -120,7 +121,8 @@ export const useUpdateOrg = () => {
        defaultMembershipRoleSlug,
        enforceMfa,
        selectedMfaMethod,
-        allowSecretSharingOutsideOrganization
+        allowSecretSharingOutsideOrganization,
+        bypassOrgAuthEnabled
      });
    },
    onSuccess: () => {
@@ -9,6 +9,7 @@ export type Organization = {
  createAt: string;
  updatedAt: string;
  authEnforced: boolean;
+  bypassOrgAuthEnabled: boolean;
  orgAuthMethod: string;
  scimEnabled: boolean;
  slug: string;
@@ -17,6 +18,7 @@ export type Organization = {
  selectedMfaMethod?: MfaMethod;
  shouldUseNewPrivilegeSystem: boolean;
  allowSecretSharingOutsideOrganization?: boolean;
+  userRole: string;
 };

 export type UpdateOrgDTO = {
@@ -29,6 +31,7 @@ export type UpdateOrgDTO = {
  enforceMfa?: boolean;
  selectedMfaMethod?: MfaMethod;
  allowSecretSharingOutsideOrganization?: boolean;
+  bypassOrgAuthEnabled?: boolean;
 };

 export type BillingDetails = {
@@ -9,7 +9,8 @@ export enum SecretSync {
  Humanitec = "humanitec",
  TerraformCloud = "terraform-cloud",
  Camunda = "camunda",
-  Vercel = "vercel"
+  Vercel = "vercel",
+  Windmill = "windmill"
 }

 export enum SecretSyncStatus {
@@ -1,17 +1,18 @@
 import { SecretSync, SecretSyncImportBehavior } from "@app/hooks/api/secretSyncs";
-import { TAwsParameterStoreSync } from "@app/hooks/api/secretSyncs/types/aws-parameter-store-sync";
-import { TDatabricksSync } from "@app/hooks/api/secretSyncs/types/databricks-sync";
-import { TGitHubSync } from "@app/hooks/api/secretSyncs/types/github-sync";
 import { DiscriminativePick } from "@app/types";

+import { TAwsParameterStoreSync } from "./aws-parameter-store-sync";
 import { TAwsSecretsManagerSync } from "./aws-secrets-manager-sync";
 import { TAzureAppConfigurationSync } from "./azure-app-configuration-sync";
 import { TAzureKeyVaultSync } from "./azure-key-vault-sync";
 import { TCamundaSync } from "./camunda-sync";
+import { TDatabricksSync } from "./databricks-sync";
 import { TGcpSync } from "./gcp-sync";
+import { TGitHubSync } from "./github-sync";
 import { THumanitecSync } from "./humanitec-sync";
 import { TTerraformCloudSync } from "./terraform-cloud-sync";
 import { TVercelSync } from "./vercel-sync";
+import { TWindmillSync } from "./windmill-sync";

 export type TSecretSyncOption = {
  name: string;
@@ -30,7 +31,8 @@ export type TSecretSync =
  | THumanitecSync
  | TTerraformCloudSync
  | TCamundaSync
-  | TVercelSync;
+  | TVercelSync
+  | TWindmillSync;

 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };

@@ -0,0 +1,16 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TWindmillSync = TRootSecretSync & {
+  destination: SecretSync.Windmill;
+  destinationConfig: {
+    workspace: string;
+    path: string;
+  };
+  connection: {
+    app: AppConnection.Windmill;
+    name: string;
+    id: string;
+  };
+};
@@ -33,6 +33,7 @@ import {
  TGetUpgradeProjectStatusDTO,
  TListProjectIdentitiesDTO,
  ToggleAutoCapitalizationDTO,
+  ToggleDeleteProjectProtectionDTO,
  TSearchProjectsDTO,
  TUpdateWorkspaceIdentityRoleDTO,
  TUpdateWorkspaceUserRoleDTO,
@@ -306,6 +307,25 @@ export const useToggleAutoCapitalization = () => {
  });
 };

+export const useToggleDeleteProjectProtection = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<Workspace, object, ToggleDeleteProjectProtectionDTO>({
+    mutationFn: async ({ workspaceID, state }) => {
+      const { data } = await apiRequest.post<{ workspace: Workspace }>(
+        `/api/v1/workspace/${workspaceID}/delete-protection`,
+        {
+          hasDeleteProtection: state
+        }
+      );
+      return data.workspace;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: workspaceKeys.getAllUserWorkspace() });
+    }
+  });
+};
+
 export const useUpdateWorkspaceVersionLimit = () => {
  const queryClient = useQueryClient();

@@ -316,8 +336,8 @@ export const useUpdateWorkspaceVersionLimit = () => {
      });
      return data.workspace;
    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: workspaceKeys.getAllUserWorkspace() });
+    onSuccess: (dto) => {
+      queryClient.invalidateQueries({ queryKey: workspaceKeys.getAllUserWorkspace(dto.type) });
    }
  });
 };
@@ -36,6 +36,7 @@ export type Workspace = {
  slug: string;
  createdAt: string;
  roles?: TProjectRole[];
+  hasDeleteProtection: boolean;
 };

 export type WorkspaceEnv = {
@@ -80,6 +81,7 @@ export type UpdateProjectDTO = {
 export type UpdatePitVersionLimitDTO = { projectSlug: string; pitVersionLimit: number };
 export type UpdateAuditLogsRetentionDTO = { projectSlug: string; auditLogsRetentionDays: number };
 export type ToggleAutoCapitalizationDTO = { workspaceID: string; state: boolean };
+export type ToggleDeleteProjectProtectionDTO = { workspaceID: string; state: boolean };

 export type DeleteWorkspaceDTO = { workspaceID: string };

@@ -0,0 +1,7 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { LoginPage } from "../LoginPage/LoginPage";
+
+export const Route = createFileRoute("/_restrict-login-signup/login/admin")({
+  component: () => <LoginPage isAdmin />
+});
@@ -33,14 +33,21 @@ export const useNavigateToSelectOrganization = () => {
  const { config } = useServerConfig();
  const navigate = useNavigate();

-  const navigateToSelectOrganization = async (cliCallbackPort?: string) => {
+  const navigateToSelectOrganization = async (
+    cliCallbackPort?: string,
+    isFromAdminLogin?: boolean
+  ) => {
    if (!config.defaultAuthOrgId) {
      queryClient.invalidateQueries({ queryKey: userKeys.getUser });
    }

    navigate({
      to: "/login/select-organization",
-      search: { callback_port: cliCallbackPort, org_id: config.defaultAuthOrgId }
+      search: {
+        callback_port: cliCallbackPort,
+        org_id: config.defaultAuthOrgId,
+        is_admin_login: isFromAdminLogin
+      }
    });
  };

@@ -8,7 +8,7 @@ import { isLoggedIn } from "@app/hooks/api/reactQuery";
 import { InitialStep, SSOStep } from "./components";
 import { useNavigateToSelectOrganization } from "./Login.utils";

-export const LoginPage = () => {
+export const LoginPage = ({ isAdmin }: { isAdmin?: boolean }) => {
  const { t } = useTranslation();
  const [step, setStep] = useState(0);
  const [email, setEmail] = useState("");
@@ -44,6 +44,7 @@ export const LoginPage = () => {
      case 0:
        return (
          <InitialStep
+            isAdmin={isAdmin}
            setStep={setStep}
            email={email}
            setEmail={setEmail}
@@ -26,9 +26,17 @@ type Props = {
  setEmail: (email: string) => void;
  password: string;
  setPassword: (email: string) => void;
+  isAdmin?: boolean;
 };

-export const InitialStep = ({ setStep, email, setEmail, password, setPassword }: Props) => {
+export const InitialStep = ({
+  setStep,
+  email,
+  setEmail,
+  password,
+  setPassword,
+  isAdmin
+}: Props) => {
  const navigate = useNavigate();

  const { t } = useTranslation();
@@ -62,7 +70,9 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
  };

  useEffect(() => {
-    if (serverDetails?.samlDefaultOrgSlug) redirectToSaml(serverDetails.samlDefaultOrgSlug);
+    if (serverDetails?.samlDefaultOrgSlug && !isAdmin) {
+      redirectToSaml(serverDetails.samlDefaultOrgSlug);
+    }
  }, [serverDetails?.samlDefaultOrgSlug]);

  const handleSaml = () => {
@@ -82,7 +92,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
  };

  const shouldDisplayLoginMethod = (method: LoginMethod) =>
-    !config.enabledLoginMethods || config.enabledLoginMethods.includes(method);
+    isAdmin || !config.enabledLoginMethods || config.enabledLoginMethods.includes(method);

  const handleLogin = async (e: FormEvent<HTMLFormElement>) => {
    e.preventDefault();
@@ -120,7 +130,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:

        if (isLoginSuccessful && isLoginSuccessful.success) {
          // case: login was successful
-          navigateToSelectOrganization();
+          navigateToSelectOrganization(undefined, isAdmin);
          createNotification({
            text: "Successfully logged in",
            type: "success"
@@ -160,7 +170,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
    setIsLoading(false);
  };

-  if (config.defaultAuthOrgAuthEnforced && config.defaultAuthOrgAuthMethod) {
+  if (config.defaultAuthOrgAuthEnforced && config.defaultAuthOrgAuthMethod && !isAdmin) {
    return (
      <form
        onSubmit={handleLogin}
@@ -14,6 +14,7 @@ import { IsCliLoginSuccessful } from "@app/components/utilities/attemptCliLogin"
 import SecurityClient from "@app/components/utilities/SecurityClient";
 import { Button, Spinner } from "@app/components/v2";
 import { SessionStorageKeys } from "@app/const";
+import { OrgMembershipRole } from "@app/helpers/roles";
 import { useToggle } from "@app/hooks";
 import {
  useGetOrganizations,
@@ -53,6 +54,7 @@ export const SelectOrganizationPage = () => {
  const queryParams = new URLSearchParams(window.location.search);
  const orgId = queryParams.get("org_id");
  const callbackPort = queryParams.get("callback_port");
+  const isAdminLogin = queryParams.get("is_admin_login") === "true";
  const defaultSelectedOrg = organizations.data?.find((org) => org.id === orgId);

  const logout = useLogoutUser(true);
@@ -68,7 +70,12 @@ export const SelectOrganizationPage = () => {

  const handleSelectOrganization = useCallback(
    async (organization: Organization) => {
-      if (organization.authEnforced) {
+      const canBypassOrgAuth =
+        organization.bypassOrgAuthEnabled &&
+        organization.userRole === OrgMembershipRole.Admin &&
+        isAdminLogin;
+
+      if (organization.authEnforced && !canBypassOrgAuth) {
        // org has an org-level auth method enabled (e.g. SAML)
        // -> logout + redirect to SAML SSO
        await logout.mutateAsync();
@@ -6,13 +6,16 @@ import { SelectOrganizationPage } from "./SelectOrgPage";

 export const SelectOrganizationPageQueryParams = z.object({
  org_id: z.string().optional().catch(""),
-  callback_port: z.coerce.number().optional().catch(undefined)
+  callback_port: z.coerce.number().optional().catch(undefined),
+  is_admin_login: z.boolean().optional().catch(false)
 });

 export const Route = createFileRoute("/_restrict-login-signup/login/select-organization")({
  component: SelectOrganizationPage,
  validateSearch: zodValidator(SelectOrganizationPageQueryParams),
  search: {
-    middlewares: [stripSearchParams({ org_id: "", callback_port: undefined })]
+    middlewares: [
+      stripSearchParams({ org_id: "", callback_port: undefined, is_admin_login: false })
+    ]
  }
 });
@@ -23,6 +23,7 @@ import { MsSqlConnectionForm } from "./MsSqlConnectionForm";
 import { PostgresConnectionForm } from "./PostgresConnectionForm";
 import { TerraformCloudConnectionForm } from "./TerraformCloudConnectionForm";
 import { VercelConnectionForm } from "./VercelConnectionForm";
+import { WindmillConnectionForm } from "./WindmillConnectionForm";

 type FormProps = {
  onComplete: (appConnection: TAppConnection) => void;
@@ -87,6 +88,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
      return <CamundaConnectionForm onSubmit={onSubmit} />;
    case AppConnection.AzureClientSecrets:
      return <AzureClientSecretsConnectionForm />;
+    case AppConnection.Windmill:
+      return <WindmillConnectionForm onSubmit={onSubmit} />;
    case AppConnection.Auth0:
      return <Auth0ConnectionForm onSubmit={onSubmit} />;
    default:
@@ -151,6 +154,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
      return <CamundaConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    case AppConnection.AzureClientSecrets:
      return <AzureClientSecretsConnectionForm appConnection={appConnection} />;
+    case AppConnection.Windmill:
+      return <WindmillConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    case AppConnection.Auth0:
      return <Auth0ConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    default:
@@ -0,0 +1,158 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { TWindmillConnection, WindmillConnectionMethod } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TWindmillConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Windmill)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(WindmillConnectionMethod.AccessToken),
+    credentials: z.object({
+      accessToken: z.string().trim().min(1, "Access Token required"),
+      instanceUrl: z
+        .string()
+        .trim()
+        .transform((value) => value || undefined)
+        .refine((value) => (!value ? true : z.string().url().safeParse(value).success), {
+          message: "Invalid instance URL"
+        })
+        .optional()
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const WindmillConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Windmill,
+      method: WindmillConnectionMethod.AccessToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Windmill].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(WindmillConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.instanceUrl"
+          control={control}
+          shouldUnregister
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Instance URL"
+              isOptional
+              tooltipClassName="max-w-sm"
+              tooltipText="Will default to Windmill Cloud if not specified."
+            >
+              <Input {...field} placeholder="https://app.windmill.dev" />
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.accessToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Access Token"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Windmill"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
@@ -18,6 +18,7 @@ import { useOrganization } from "@app/context";
 import { useToggle } from "@app/hooks";
 import { useGetOIDCConfig } from "@app/hooks/api";
 import { useCreateOIDCConfig, useUpdateOIDCConfig } from "@app/hooks/api/oidcConfig/mutations";
+import { OIDCJWTSignatureAlgorithm } from "@app/hooks/api/oidcConfig/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";

 enum ConfigurationType {
@@ -43,7 +44,8 @@ const schema = z
    userinfoEndpoint: z.string().optional(),
    clientId: z.string().min(1),
    clientSecret: z.string().min(1),
-    allowedEmailDomains: z.string().optional()
+    allowedEmailDomains: z.string().optional(),
+    jwtSignatureAlgorithm: z.nativeEnum(OIDCJWTSignatureAlgorithm).optional()
  })
  .superRefine((data, ctx) => {
    if (data.configurationType === ConfigurationType.CUSTOM) {
@@ -159,6 +161,7 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
      setValue("clientSecret", data.clientSecret);
      setValue("allowedEmailDomains", data.allowedEmailDomains);
      setValue("configurationType", data.configurationType);
+      setValue("jwtSignatureAlgorithm", data.jwtSignatureAlgorithm);
    }
  }, [data]);

@@ -172,7 +175,8 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
    configurationType,
    discoveryURL,
    clientId,
-    clientSecret
+    clientSecret,
+    jwtSignatureAlgorithm
  }: OIDCFormData) => {
    try {
      if (!currentOrg) {
@@ -192,7 +196,8 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
          clientId,
          clientSecret,
          isActive: true,
-          orgSlug: currentOrg.slug
+          orgSlug: currentOrg.slug,
+          jwtSignatureAlgorithm
        });
      } else {
        await updateMutateAsync({
@@ -207,7 +212,8 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
          clientId,
          clientSecret,
          isActive: true,
-          orgSlug: currentOrg.slug
+          orgSlug: currentOrg.slug,
+          jwtSignatureAlgorithm
        });
      }

@@ -362,6 +368,29 @@ export const OIDCModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDele
                />
              </>
            )}
+            <Controller
+              control={control}
+              defaultValue={OIDCJWTSignatureAlgorithm.RS256}
+              name="jwtSignatureAlgorithm"
+              render={({ field: { onChange, ...field }, fieldState: { error } }) => (
+                <FormControl
+                  className="w-full"
+                  label="JWT Signature Algorithm"
+                  errorText={error?.message}
+                  isError={Boolean(error)}
+                >
+                  <Select
+                    defaultValue={field.value}
+                    onValueChange={(e) => onChange(e)}
+                    className="w-full"
+                  >
+                    <SelectItem value={OIDCJWTSignatureAlgorithm.RS256}>RS256</SelectItem>
+                    <SelectItem value={OIDCJWTSignatureAlgorithm.RS512}>RS512</SelectItem>
+                    <SelectItem value={OIDCJWTSignatureAlgorithm.HS256}>HS256</SelectItem>
+                  </Select>
+                </FormControl>
+              )}
+            />
            <Controller
              control={control}
              name="allowedEmailDomains"
@@ -1,7 +1,10 @@
+import { faInfoCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
 import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
-import { Switch } from "@app/components/v2";
+import { Switch, Tooltip } from "@app/components/v2";
 import {
  OrgPermissionActions,
  OrgPermissionSubjects,
@@ -52,6 +55,28 @@ export const OrgGeneralAuthSection = () => {
    }
  };

+  const handleEnableBypassOrgAuthToggle = async (value: boolean) => {
+    try {
+      if (!currentOrg?.id) return;
+      if (!subscription?.samlSSO) {
+        handlePopUpOpen("upgradePlan");
+        return;
+      }
+
+      await mutateAsync({
+        orgId: currentOrg?.id,
+        bypassOrgAuthEnabled: value
+      });
+
+      createNotification({
+        text: `Successfully ${value ? "enabled" : "disabled"} admin bypassing of org-level auth`,
+        type: "success"
+      });
+    } catch (err) {
+      console.error(err);
+    }
+  };
+
  return (
    <>
      {/* <div className="py-4">
@@ -72,7 +97,9 @@ export const OrgGeneralAuthSection = () => {
            </div> */}
      <div className="py-4">
        <div className="mb-2 flex justify-between">
-          <h3 className="text-md text-mineshaft-100">Enforce SAML SSO</h3>
+          <div className="flex items-center gap-1">
+            <span className="text-md text-mineshaft-100">Enforce SAML SSO</span>
+          </div>
          <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
            {(isAllowed) => (
              <Switch
@@ -85,9 +112,62 @@ export const OrgGeneralAuthSection = () => {
          </OrgPermissionCan>
        </div>
        <p className="text-sm text-mineshaft-300">
-          Enforce members to authenticate via SAML to access this organization
+          Enforce users to authenticate via SAML to access this organization
        </p>
      </div>
+      {currentOrg?.authEnforced && (
+        <div className="py-4">
+          <div className="mb-2 flex justify-between">
+            <div className="flex items-center gap-1">
+              <span className="text-md text-mineshaft-100">Enable Admin SSO Bypass</span>
+              <Tooltip
+                className="max-w-lg"
+                content={
+                  <div>
+                    <span>
+                      When this is enabled, we strongly recommend enforcing MFA at the organization
+                      level.
+                    </span>
+                    <p className="mt-4">
+                      In case of a lockout, admins can use the admin login portal at{" "}
+                      <a
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="underline underline-offset-2 hover:text-mineshaft-300"
+                        href={`${window.location.origin}/login/admin`}
+                      >
+                        {window.location.origin}/login/admin
+                      </a>
+                    </p>
+                  </div>
+                }
+              >
+                <FontAwesomeIcon
+                  icon={faInfoCircle}
+                  size="sm"
+                  className="mt-0.5 inline-block text-mineshaft-400"
+                />
+              </Tooltip>
+            </div>
+            <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
+              {(isAllowed) => (
+                <Switch
+                  id="allow-admin-bypass"
+                  isChecked={currentOrg?.bypassOrgAuthEnabled ?? false}
+                  onCheckedChange={(value) => handleEnableBypassOrgAuthToggle(value)}
+                  isDisabled={!isAllowed}
+                />
+              )}
+            </OrgPermissionCan>
+          </div>
+          <p className="text-sm text-mineshaft-300">
+            <span>
+              Allow organization admins to bypass SAML enforcement when SSO is unavailable,
+              misconfigured, or inaccessible.
+            </span>
+          </p>
+        </div>
+      )}
      <UpgradePlanModal
        isOpen={popUp.upgradePlan.isOpen}
        onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
@@ -82,6 +82,28 @@ export const OrgOIDCSection = (): JSX.Element => {
    }
  };

+  const handleEnableBypassOrgAuthToggle = async (value: boolean) => {
+    try {
+      if (!currentOrg?.id) return;
+      if (!subscription?.oidcSSO) {
+        handlePopUpOpen("upgradePlan");
+        return;
+      }
+
+      await updateOrg({
+        orgId: currentOrg?.id,
+        bypassOrgAuthEnabled: value
+      });
+
+      createNotification({
+        text: `Successfully ${value ? "enabled" : "disabled"} admin bypassing of org-level auth`,
+        type: "success"
+      });
+    } catch (err) {
+      console.error(err);
+    }
+  };
+
  const handleOIDCGroupManagement = async (value: boolean) => {
    try {
      if (!currentOrg?.id) return;
@@ -158,7 +180,9 @@ export const OrgOIDCSection = (): JSX.Element => {
      )}
      <div className="py-4">
        <div className="mb-2 flex justify-between">
-          <h3 className="text-md text-mineshaft-100">Enforce OIDC SSO</h3>
+          <div className="flex items-center gap-1">
+            <span className="text-md text-mineshaft-100">Enforce OIDC SSO</span>
+          </div>
          <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
            {(isAllowed) => (
              <Switch
@@ -171,9 +195,62 @@ export const OrgOIDCSection = (): JSX.Element => {
          </OrgPermissionCan>
        </div>
        <p className="text-sm text-mineshaft-300">
-          Enforce members to authenticate via OIDC to access this organization
+          <span>Enforce users to authenticate via OIDC to access this organization.</span>
        </p>
      </div>
+      {currentOrg?.authEnforced && (
+        <div className="py-4">
+          <div className="mb-2 flex justify-between">
+            <div className="flex items-center gap-1">
+              <span className="text-md text-mineshaft-100">Enable Admin SSO Bypass</span>
+              <Tooltip
+                className="max-w-lg"
+                content={
+                  <div>
+                    <span>
+                      When this is enabled, we strongly recommend enforcing MFA at the organization
+                      level.
+                    </span>
+                    <p className="mt-4">
+                      In case of a lockout, admins can use the admin login portal at{" "}
+                      <a
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="underline underline-offset-2 hover:text-mineshaft-300"
+                        href={`${window.location.origin}/login/admin`}
+                      >
+                        {window.location.origin}/login/admin
+                      </a>
+                    </p>
+                  </div>
+                }
+              >
+                <FontAwesomeIcon
+                  icon={faInfoCircle}
+                  size="sm"
+                  className="mt-0.5 inline-block text-mineshaft-400"
+                />
+              </Tooltip>
+            </div>
+            <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
+              {(isAllowed) => (
+                <Switch
+                  id="allow-admin-bypass"
+                  isChecked={currentOrg?.bypassOrgAuthEnabled ?? false}
+                  onCheckedChange={(value) => handleEnableBypassOrgAuthToggle(value)}
+                  isDisabled={!isAllowed}
+                />
+              )}
+            </OrgPermissionCan>
+          </div>
+          <p className="text-sm text-mineshaft-300">
+            <span>
+              Allow organization admins to bypass OIDC enforcement when SSO is unavailable,
+              misconfigured, or inaccessible.
+            </span>
+          </p>
+        </div>
+      )}
      <div className="py-4">
        <div className="mb-2 flex justify-between">
          <div className="text-md flex items-center text-mineshaft-100">
@@ -20,6 +20,8 @@ import { useToggle } from "@app/hooks";
 import { useCreateSSOConfig, useGetSSOConfig, useUpdateSSOConfig } from "@app/hooks/api";
 import { UsePopUpState } from "@app/hooks/usePopUp";

+import { SSOModalHeader } from "./SSOModalHeader";
+
 enum AuthProvider {
  OKTA_SAML = "okta-saml",
  AZURE_SAML = "azure-saml",
@@ -30,12 +32,32 @@ enum AuthProvider {
 }

 const ssoAuthProviders = [
-  { label: "Okta SAML", value: AuthProvider.OKTA_SAML },
-  { label: "Azure / Entra SAML", value: AuthProvider.AZURE_SAML },
-  { label: "JumpCloud SAML", value: AuthProvider.JUMPCLOUD_SAML },
-  { label: "Keycloak SAML", value: AuthProvider.KEYCLOAK_SAML },
-  { label: "Google SAML", value: AuthProvider.GOOGLE_SAML },
-  { label: "Auth0 SAML", value: AuthProvider.AUTH0_SAML }
+  { label: "Okta SAML", value: AuthProvider.OKTA_SAML, image: "Okta.png", docsUrl: "okta" },
+  {
+    label: "Azure / Entra SAML",
+    value: AuthProvider.AZURE_SAML,
+    image: "Microsoft Azure.png",
+    docsUrl: "azure"
+  },
+  {
+    label: "JumpCloud SAML",
+    value: AuthProvider.JUMPCLOUD_SAML,
+    image: "JumpCloud.png",
+    docsUrl: "jumpcloud"
+  },
+  {
+    label: "Keycloak SAML",
+    value: AuthProvider.KEYCLOAK_SAML,
+    image: "Keycloak.png",
+    docsUrl: "keycloak-saml"
+  },
+  {
+    label: "Google SAML",
+    value: AuthProvider.GOOGLE_SAML,
+    image: "Google.png",
+    docsUrl: "google-saml"
+  },
+  { label: "Auth0 SAML", value: AuthProvider.AUTH0_SAML, image: "Auth0.png", docsUrl: "auth0-saml" }
 ];

 const schema = z
@@ -231,6 +253,10 @@ export const SSOModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDelet
        }}
      >
        <ModalContent title="Manage SAML configuration">
+          <SSOModalHeader
+            providerDetails={ssoAuthProviders.find((provider) => provider.value === authProvider)!}
+            isConnected={Boolean(data)}
+          />
          <form onSubmit={handleSubmit(onSSOModalSubmit)}>
            <Controller
              control={control}
@@ -0,0 +1,53 @@
+import { faArrowUpRightFromSquare, faBookOpen } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+type ProviderDetails = {
+  label: string;
+  image: string;
+  value: string;
+  docsUrl: string;
+};
+
+type Props = {
+  providerDetails: ProviderDetails;
+  isConnected: boolean;
+};
+
+const docsBaseUrl = "https://infisical.com/docs/documentation/platform/sso";
+
+export const SSOModalHeader = ({ providerDetails, isConnected }: Props) => {
+  return (
+    <div className="mb-4 flex w-full items-start gap-2 border-b border-mineshaft-500 pb-4">
+      <img
+        alt={`${providerDetails.label} logo`}
+        src={`/images/sso/${providerDetails.image}`}
+        className="h-12 w-12 rounded-md bg-bunker-500 p-2"
+      />
+      <div>
+        <div className="flex items-center text-mineshaft-300">
+          {providerDetails.label}
+          <a
+            href={`${docsBaseUrl}/${providerDetails.docsUrl}`}
+            target="_blank"
+            className="mb-1 ml-1"
+            rel="noopener noreferrer"
+          >
+            <div className="inline-block rounded-md bg-yellow/20 px-1.5 text-sm text-yellow opacity-80 hover:opacity-100">
+              <FontAwesomeIcon icon={faBookOpen} className="mb-[0.03rem] mr-1 text-[12px]" />
+              <span>Docs</span>
+              <FontAwesomeIcon
+                icon={faArrowUpRightFromSquare}
+                className="mb-[0.07rem] ml-1 text-[10px]"
+              />
+            </div>
+          </a>
+        </div>
+        <p className="text-sm leading-4 text-mineshaft-400">
+          {isConnected
+            ? `${providerDetails.label} Connection`
+            : `Connect to ${providerDetails.label}`}
+        </p>
+      </div>
+    </div>
+  );
+};
@@ -11,6 +11,7 @@ import { GitHubSyncDestinationCol } from "./GitHubSyncDestinationCol";
 import { HumanitecSyncDestinationCol } from "./HumanitecSyncDestinationCol";
 import { TerraformCloudSyncDestinationCol } from "./TerraformCloudSyncDestinationCol";
 import { VercelSyncDestinationCol } from "./VercelSyncDestinationCol";
+import { WindmillSyncDestinationCol } from "./WindmillSyncDestinationCol";

 type Props = {
  secretSync: TSecretSync;
@@ -40,6 +41,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
      return <CamundaSyncDestinationCol secretSync={secretSync} />;
    case SecretSync.Vercel:
      return <VercelSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.Windmill:
+      return <WindmillSyncDestinationCol secretSync={secretSync} />;
    default:
      throw new Error(
        `Unhandled Secret Sync Destination Col: ${(secretSync as TSecretSync).destination}`
@@ -0,0 +1,14 @@
+import { TWindmillSync } from "@app/hooks/api/secretSyncs/types/windmill-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TWindmillSync;
+};
+
+export const WindmillSyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};
@@ -90,6 +90,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
      primaryText = destinationConfig.appName || destinationConfig.app;
      secondaryText = destinationConfig.env;
      break;
+    case SecretSync.Windmill:
+      primaryText = destinationConfig.workspace;
+      secondaryText = destinationConfig.path;
+      break;
    default:
      throw new Error(`Unhandled Destination Col Values ${destination}`);
  }
@@ -9,18 +9,19 @@ import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
 import { APP_CONNECTION_MAP } from "@app/helpers/appConnections";
 import { SecretSync, TSecretSync } from "@app/hooks/api/secretSyncs";
-import { AwsParameterStoreSyncDestinationSection } from "@app/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AwsParameterStoreSyncDestinationSection";
-import { AwsSecretsManagerSyncDestinationSection } from "@app/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AwsSecretsManagerSyncDestinationSection";
-import { DatabricksSyncDestinationSection } from "@app/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/DatabricksSyncDestinationSection";
-import { GitHubSyncDestinationSection } from "@app/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/GitHubSyncDestinationSection";

+import { AwsParameterStoreSyncDestinationSection } from "./AwsParameterStoreSyncDestinationSection";
+import { AwsSecretsManagerSyncDestinationSection } from "./AwsSecretsManagerSyncDestinationSection";
 import { AzureAppConfigurationSyncDestinationSection } from "./AzureAppConfigurationSyncDestinationSection";
 import { AzureKeyVaultSyncDestinationSection } from "./AzureKeyVaultSyncDestinationSection";
 import { CamundaSyncDestinationSection } from "./CamundaSyncDestinationSection";
+import { DatabricksSyncDestinationSection } from "./DatabricksSyncDestinationSection";
 import { GcpSyncDestinationSection } from "./GcpSyncDestinationSection";
+import { GitHubSyncDestinationSection } from "./GitHubSyncDestinationSection";
 import { HumanitecSyncDestinationSection } from "./HumanitecSyncDestinationSection";
 import { TerraformCloudSyncDestinationSection } from "./TerraformCloudSyncDestinationSection";
 import { VercelSyncDestinationSection } from "./VercelSyncDestinationSection";
+import { WindmillSyncDestinationSection } from "./WindmillSyncDestinationSection";

 type Props = {
  secretSync: TSecretSync;
@@ -69,6 +70,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
    case SecretSync.Vercel:
      DestinationComponents = <VercelSyncDestinationSection secretSync={secretSync} />;
      break;
+    case SecretSync.Windmill:
+      DestinationComponents = <WindmillSyncDestinationSection secretSync={secretSync} />;
+      break;
    default:
      throw new Error(`Unhandled Destination Section components: ${destination}`);
  }
@@ -0,0 +1,19 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TWindmillSync } from "@app/hooks/api/secretSyncs/types/windmill-sync";
+
+type Props = {
+  secretSync: TWindmillSync;
+};
+
+export const WindmillSyncDestinationSection = ({ secretSync }: Props) => {
+  const {
+    destinationConfig: { path, workspace }
+  } = secretSync;
+
+  return (
+    <>
+      <GenericFieldLabel label="Workspace">{workspace}</GenericFieldLabel>
+      <GenericFieldLabel label="Path">{path}</GenericFieldLabel>
+    </>
+  );
+};
@@ -51,6 +51,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
    case SecretSync.TerraformCloud:
    case SecretSync.Camunda:
    case SecretSync.Vercel:
+    case SecretSync.Windmill:
      AdditionalSyncOptionsComponent = null;
      break;
    default:
@@ -0,0 +1,57 @@
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Checkbox } from "@app/components/v2";
+import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context";
+import { useToggleDeleteProjectProtection } from "@app/hooks/api/workspace/queries";
+
+export const DeleteProjectProtection = () => {
+  const { currentWorkspace } = useWorkspace();
+  const { mutateAsync } = useToggleDeleteProjectProtection();
+
+  const handleToggleDeleteProjectProtection = async (state: boolean) => {
+    try {
+      if (!currentWorkspace?.id) return;
+
+      await mutateAsync({
+        workspaceID: currentWorkspace.id,
+        state
+      });
+
+      const text = `Successfully ${state ? "enabled" : "disabled"} delete protection`;
+      createNotification({
+        text,
+        type: "success"
+      });
+    } catch (err) {
+      console.error(err);
+      createNotification({
+        text: "Failed to update delete protection",
+        type: "error"
+      });
+    }
+  };
+
+  return (
+    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+      <p className="mb-3 text-xl font-semibold">Delete Protection</p>
+      <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Settings}>
+        {(isAllowed) => (
+          <div className="w-max">
+            <Checkbox
+              className="data-[state=checked]:bg-primary"
+              id="hasDeleteProtection"
+              isDisabled={!isAllowed}
+              isChecked={currentWorkspace?.hasDeleteProtection ?? false}
+              onCheckedChange={(state) => {
+                handleToggleDeleteProjectProtection(state as boolean);
+              }}
+            >
+              Protects the project from being deleted accidentally. While this option is enabled,
+              you can&apos;t delete the project.
+            </Checkbox>
+          </div>
+        )}
+      </ProjectPermissionCan>
+    </div>
+  );
+};
@@ -0,0 +1 @@
+export { DeleteProjectProtection } from "./DeleteProjectProtection";
@@ -144,7 +144,7 @@ export const DeleteProjectSection = () => {
          {(isAllowed) => (
            <Button
              isLoading={isDeleting}
-              isDisabled={!isAllowed || isDeleting}
+              isDisabled={!isAllowed || isDeleting || currentWorkspace?.hasDeleteProtection}
              colorSchema="danger"
              variant="outline_bg"
              type="submit"
@@ -5,6 +5,7 @@ import { ProjectType, ProjectVersion } from "@app/hooks/api/workspace/types";
 import { AuditLogsRetentionSection } from "../AuditLogsRetentionSection";
 import { AutoCapitalizationSection } from "../AutoCapitalizationSection";
 import { BackfillSecretReferenceSecretion } from "../BackfillSecretReferenceSection";
+import { DeleteProjectProtection } from "../DeleteProjectProtection";
 import { DeleteProjectSection } from "../DeleteProjectSection";
 import { EnvironmentSection } from "../EnvironmentSection";
 import { PointInTimeVersionLimitSection } from "../PointInTimeVersionLimitSection";
@@ -27,6 +28,7 @@ export const ProjectGeneralTab = () => {
      {currentWorkspace?.version !== ProjectVersion.V3 && isSecretManager && (
        <RebuildSecretIndicesSection />
      )}
+      <DeleteProjectProtection />
      <DeleteProjectSection />
    </div>
  );
@@ -33,6 +33,7 @@ import { Route as authSignUpSsoPageRouteImport } from './pages/auth/SignUpSsoPag
 import { Route as authLoginSsoPageRouteImport } from './pages/auth/LoginSsoPage/route'
 import { Route as authSelectOrgPageRouteImport } from './pages/auth/SelectOrgPage/route'
 import { Route as authLoginLdapPageRouteImport } from './pages/auth/LoginLdapPage/route'
+import { Route as authAdminLoginPageRouteImport } from './pages/auth/AdminLoginPage/route'
 import { Route as adminSignUpPageRouteImport } from './pages/admin/SignUpPage/route'
 import { Route as organizationNoOrgPageRouteImport } from './pages/organization/NoOrgPage/route'
 import { Route as authSignUpPageRouteImport } from './pages/auth/SignUpPage/route'
@@ -393,6 +394,12 @@ const authLoginLdapPageRouteRoute = authLoginLdapPageRouteImport.update({
  getParentRoute: () => RestrictLoginSignupLoginRoute,
 } as any)

+const authAdminLoginPageRouteRoute = authAdminLoginPageRouteImport.update({
+  id: '/admin',
+  path: '/admin',
+  getParentRoute: () => RestrictLoginSignupLoginRoute,
+} as any)
+
 const adminSignUpPageRouteRoute = adminSignUpPageRouteImport.update({
  id: '/admin/signup',
  path: '/admin/signup',
@@ -1775,6 +1782,13 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof adminSignUpPageRouteImport
      parentRoute: typeof middlewaresRestrictLoginSignupImport
    }
+    '/_restrict-login-signup/login/admin': {
+      id: '/_restrict-login-signup/login/admin'
+      path: '/admin'
+      fullPath: '/login/admin'
+      preLoaderRoute: typeof authAdminLoginPageRouteImport
+      parentRoute: typeof RestrictLoginSignupLoginImport
+    }
    '/_restrict-login-signup/login/ldap': {
      id: '/_restrict-login-signup/login/ldap'
      path: '/ldap'
@@ -3655,6 +3669,7 @@ const middlewaresAuthenticateRouteWithChildren =

 interface RestrictLoginSignupLoginRouteChildren {
  authLoginPageRouteRoute: typeof authLoginPageRouteRoute
+  authAdminLoginPageRouteRoute: typeof authAdminLoginPageRouteRoute
  authLoginLdapPageRouteRoute: typeof authLoginLdapPageRouteRoute
  authSelectOrgPageRouteRoute: typeof authSelectOrgPageRouteRoute
  authLoginSsoPageRouteRoute: typeof authLoginSsoPageRouteRoute
@@ -3665,6 +3680,7 @@ interface RestrictLoginSignupLoginRouteChildren {
 const RestrictLoginSignupLoginRouteChildren: RestrictLoginSignupLoginRouteChildren =
  {
    authLoginPageRouteRoute: authLoginPageRouteRoute,
+    authAdminLoginPageRouteRoute: authAdminLoginPageRouteRoute,
    authLoginLdapPageRouteRoute: authLoginLdapPageRouteRoute,
    authSelectOrgPageRouteRoute: authSelectOrgPageRouteRoute,
    authLoginSsoPageRouteRoute: authLoginSsoPageRouteRoute,
@@ -3739,6 +3755,7 @@ export interface FileRoutesByFullPath {
  '/signup/': typeof authSignUpPageRouteRoute
  '/organization/none': typeof organizationNoOrgPageRouteRoute
  '/admin/signup': typeof adminSignUpPageRouteRoute
+  '/login/admin': typeof authAdminLoginPageRouteRoute
  '/login/ldap': typeof authLoginLdapPageRouteRoute
  '/login/select-organization': typeof authSelectOrgPageRouteRoute
  '/login/sso': typeof authLoginSsoPageRouteRoute
@@ -3918,6 +3935,7 @@ export interface FileRoutesByTo {
  '/signup': typeof authSignUpPageRouteRoute
  '/organization/none': typeof organizationNoOrgPageRouteRoute
  '/admin/signup': typeof adminSignUpPageRouteRoute
+  '/login/admin': typeof authAdminLoginPageRouteRoute
  '/login/ldap': typeof authLoginLdapPageRouteRoute
  '/login/select-organization': typeof authSelectOrgPageRouteRoute
  '/login/sso': typeof authLoginSsoPageRouteRoute
@@ -4096,6 +4114,7 @@ export interface FileRoutesById {
  '/_restrict-login-signup/signup/': typeof authSignUpPageRouteRoute
  '/_authenticate/organization/none': typeof organizationNoOrgPageRouteRoute
  '/_restrict-login-signup/admin/signup': typeof adminSignUpPageRouteRoute
+  '/_restrict-login-signup/login/admin': typeof authAdminLoginPageRouteRoute
  '/_restrict-login-signup/login/ldap': typeof authLoginLdapPageRouteRoute
  '/_restrict-login-signup/login/select-organization': typeof authSelectOrgPageRouteRoute
  '/_restrict-login-signup/login/sso': typeof authLoginSsoPageRouteRoute
@@ -4286,6 +4305,7 @@ export interface FileRouteTypes {
    | '/signup/'
    | '/organization/none'
    | '/admin/signup'
+    | '/login/admin'
    | '/login/ldap'
    | '/login/select-organization'
    | '/login/sso'
@@ -4464,6 +4484,7 @@ export interface FileRouteTypes {
    | '/signup'
    | '/organization/none'
    | '/admin/signup'
+    | '/login/admin'
    | '/login/ldap'
    | '/login/select-organization'
    | '/login/sso'
@@ -4640,6 +4661,7 @@ export interface FileRouteTypes {
    | '/_restrict-login-signup/signup/'
    | '/_authenticate/organization/none'
    | '/_restrict-login-signup/admin/signup'
+    | '/_restrict-login-signup/login/admin'
    | '/_restrict-login-signup/login/ldap'
    | '/_restrict-login-signup/login/select-organization'
    | '/_restrict-login-signup/login/sso'
@@ -4928,6 +4950,7 @@ export const routeTree = rootRoute
      "parent": "/_restrict-login-signup",
      "children": [
        "/_restrict-login-signup/login/",
+        "/_restrict-login-signup/login/admin",
        "/_restrict-login-signup/login/ldap",
        "/_restrict-login-signup/login/select-organization",
        "/_restrict-login-signup/login/sso",
@@ -4959,6 +4982,10 @@ export const routeTree = rootRoute
      "filePath": "admin/SignUpPage/route.tsx",
      "parent": "/_restrict-login-signup"
    },
+    "/_restrict-login-signup/login/admin": {
+      "filePath": "auth/AdminLoginPage/route.tsx",
+      "parent": "/_restrict-login-signup/login"
+    },
    "/_restrict-login-signup/login/ldap": {
      "filePath": "auth/LoginLdapPage/route.tsx",
      "parent": "/_restrict-login-signup/login"
@@ -328,6 +328,7 @@ export const routes = rootRoute("root.tsx", [
    route("/admin/signup", "admin/SignUpPage/route.tsx"),
    route("/login", [
      index("auth/LoginPage/route.tsx"),
+      route("/admin", "auth/AdminLoginPage/route.tsx"),
      route("/select-organization", "auth/SelectOrgPage/route.tsx"),
      route("/sso", "auth/LoginSsoPage/route.tsx"),
      route("/ldap", "auth/LoginLdapPage/route.tsx"),
				`@@ -0,0 +1 @@`
				`export { DeleteProjectProtection } from "./DeleteProjectProtection";`