Add new commit logic on every folder/secret operation

2026-09-22 13:39:35 +00:00 · 2025-05-06 18:57:25 -03:00
parent 32a3e1d200
commit f493a617b1
32 changed files with 675 additions and 140 deletions
--- a/backend/src/@types/fastify.d.ts
+++ b/backend/src/@types/fastify.d.ts
@@ -57,6 +57,7 @@ import { TCertificateTemplateServiceFactory } from "@app/services/certificate-te
 import { TCmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { TExternalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { TExternalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
+import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service";
 import { THsmServiceFactory } from "@app/services/hsm/hsm-service";
 import { TIdentityServiceFactory } from "@app/services/identity/identity-service";
@@ -252,6 +253,7 @@ declare module "fastify" {
      microsoftTeams: TMicrosoftTeamsServiceFactory;
      assumePrivileges: TAssumePrivilegeServiceFactory;
      githubOrgSync: TGithubOrgSyncServiceFactory;
+      folderCommit: TFolderCommitServiceFactory;
    };
    // this is exclusive use for middlewares in which we need to inject data
    // everywhere else access using service layer
--- a/backend/src/db/migrations/20250505194916_add-pit-revamp-tables.ts
+++ b/backend/src/db/migrations/20250505194916_add-pit-revamp-tables.ts
@@ -7,11 +7,11 @@ export async function up(knex: Knex): Promise<void> {
  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
  if (!hasFolderCommitTable) {
    await knex.schema.createTable(TableName.FolderCommit, (t) => {
-      t.bigIncrements("id").primary();
-      t.string("actorName").notNullable();
+      t.uuid("id").primary().defaultTo(knex.fn.uuid());
+      t.bigIncrements("commitId");
+      t.jsonb("actorMetadata").notNullable();
      t.string("actorType").notNullable();
      t.string("message");
-      t.timestamp("date").notNullable().defaultTo(knex.fn.now());
      t.uuid("folderId").notNullable();
      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
      t.timestamps(true, true, true);
@@ -24,7 +24,7 @@ export async function up(knex: Knex): Promise<void> {
  if (!hasFolderCommitChangesTable) {
    await knex.schema.createTable(TableName.FolderCommitChanges, (t) => {
      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.bigInteger("folderCommitId").notNullable();
+      t.uuid("folderCommitId").notNullable();
      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
      t.string("changeType").notNullable();
      t.uuid("secretVersionId");
@@ -43,9 +43,8 @@ export async function up(knex: Knex): Promise<void> {
  if (!hasFolderCheckpointTable) {
    await knex.schema.createTable(TableName.FolderCheckpoint, (t) => {
      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.bigInteger("folderCommitId").notNullable();
+      t.uuid("folderCommitId").notNullable();
      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamp("date").notNullable().defaultTo(knex.fn.now());
      t.timestamps(true, true, true);

      t.index("folderCommitId");
@@ -74,9 +73,8 @@ export async function up(knex: Knex): Promise<void> {
  if (!hasFolderTreeCheckpointTable) {
    await knex.schema.createTable(TableName.FolderTreeCheckpoint, (t) => {
      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.bigInteger("folderCommitId").notNullable();
+      t.uuid("folderCommitId").notNullable();
      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamp("date").notNullable().defaultTo(knex.fn.now());
      t.timestamps(true, true, true);

      t.index("folderCommitId");
@@ -91,7 +89,7 @@ export async function up(knex: Knex): Promise<void> {
      t.foreign("folderTreeCheckpointId").references("id").inTable(TableName.FolderTreeCheckpoint).onDelete("CASCADE");
      t.uuid("folderId").notNullable();
      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
-      t.bigInteger("folderCommitId").notNullable();
+      t.uuid("folderCommitId").notNullable();
      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
      t.timestamps(true, true, true);

@@ -110,21 +108,45 @@ export async function up(knex: Knex): Promise<void> {
 }

 export async function down(knex: Knex): Promise<void> {
-  await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
-  await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpointResources);
+  const hasFolderCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderCheckpointResources);
+  const hasFolderTreeCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderTreeCheckpointResources);
+  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
+  const hasFolderCommitChangesTable = await knex.schema.hasTable(TableName.FolderCommitChanges);
+  const hasFolderTreeCheckpointTable = await knex.schema.hasTable(TableName.FolderTreeCheckpoint);
+  const hasFolderCheckpointTable = await knex.schema.hasTable(TableName.FolderCheckpoint);

-  await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
-  await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpoint);
+  if (hasFolderCheckpointResourcesTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
+    await knex.schema.dropTableIfExists(TableName.FolderCheckpointResources);
+  }

-  await dropOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
-  await knex.schema.dropTableIfExists(TableName.FolderCheckpointResources);
+  if (hasFolderTreeCheckpointResourcesTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
+    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpointResources);
+  }

-  await dropOnUpdateTrigger(knex, TableName.FolderCheckpoint);
-  await knex.schema.dropTableIfExists(TableName.FolderCheckpoint);
+  if (hasFolderTreeCheckpointTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
+    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpoint);
+  }

-  await dropOnUpdateTrigger(knex, TableName.FolderCommitChanges);
-  await knex.schema.dropTableIfExists(TableName.FolderCommitChanges);
+  if (hasFolderCheckpointResourcesTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
+    await knex.schema.dropTableIfExists(TableName.FolderCheckpointResources);
+  }

-  await dropOnUpdateTrigger(knex, TableName.FolderCommit);
-  await knex.schema.dropTableIfExists(TableName.FolderCommit);
+  if (hasFolderCheckpointTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderCheckpoint);
+    await knex.schema.dropTableIfExists(TableName.FolderCheckpoint);
+  }
+
+  if (hasFolderCommitChangesTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderCommitChanges);
+    await knex.schema.dropTableIfExists(TableName.FolderCommitChanges);
+  }
+
+  if (hasFolderCommitTable) {
+    await dropOnUpdateTrigger(knex, TableName.FolderCommit);
+    await knex.schema.dropTableIfExists(TableName.FolderCommit);
+  }
 }
--- a/backend/src/db/schemas/folder-checkpoints.ts
+++ b/backend/src/db/schemas/folder-checkpoints.ts
@@ -9,8 +9,7 @@ import { TImmutableDBKeys } from "./models";

 export const FolderCheckpointsSchema = z.object({
  id: z.string().uuid(),
-  folderCommitId: z.coerce.number(),
-  date: z.date(),
+  folderCommitId: z.string().uuid(),
  createdAt: z.date(),
  updatedAt: z.date()
 });
--- a/backend/src/db/schemas/folder-commit-changes.ts
+++ b/backend/src/db/schemas/folder-commit-changes.ts
@@ -9,7 +9,7 @@ import { TImmutableDBKeys } from "./models";

 export const FolderCommitChangesSchema = z.object({
  id: z.string().uuid(),
-  folderCommitId: z.coerce.number(),
+  folderCommitId: z.string().uuid(),
  changeType: z.string(),
  secretVersionId: z.string().uuid().nullable().optional(),
  folderVersionId: z.string().uuid().nullable().optional(),
--- a/backend/src/db/schemas/folder-commits.ts
+++ b/backend/src/db/schemas/folder-commits.ts
@@ -8,11 +8,11 @@ import { z } from "zod";
 import { TImmutableDBKeys } from "./models";

 export const FolderCommitsSchema = z.object({
-  id: z.coerce.number(),
-  actorName: z.string(),
+  id: z.string().uuid(),
+  commitId: z.coerce.number(),
+  actorMetadata: z.unknown(),
  actorType: z.string(),
  message: z.string().nullable().optional(),
-  date: z.date(),
  folderId: z.string().uuid(),
  createdAt: z.date(),
  updatedAt: z.date()
--- a/backend/src/db/schemas/folder-tree-checkpoint-resources.ts
+++ b/backend/src/db/schemas/folder-tree-checkpoint-resources.ts
@@ -11,7 +11,7 @@ export const FolderTreeCheckpointResourcesSchema = z.object({
  id: z.string().uuid(),
  folderTreeCheckpointId: z.string().uuid(),
  folderId: z.string().uuid(),
-  folderCommitId: z.coerce.number(),
+  folderCommitId: z.string().uuid(),
  createdAt: z.date(),
  updatedAt: z.date()
 });
--- a/backend/src/db/schemas/folder-tree-checkpoints.ts
+++ b/backend/src/db/schemas/folder-tree-checkpoints.ts
@@ -9,8 +9,7 @@ import { TImmutableDBKeys } from "./models";

 export const FolderTreeCheckpointsSchema = z.object({
  id: z.string().uuid(),
-  folderCommitId: z.coerce.number(),
-  date: z.date(),
+  folderCommitId: z.string().uuid(),
  createdAt: z.date(),
  updatedAt: z.date()
 });
--- a/backend/src/db/schemas/models.ts
+++ b/backend/src/db/schemas/models.ts
@@ -161,7 +161,7 @@ export enum TableName {
  FolderTreeCheckpointResources = "folder_tree_checkpoint_resources"
 }

-export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";
+export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";

 export const UserDeviceSchema = z
  .object({
--- a/backend/src/ee/services/license/license-fns.ts
+++ b/backend/src/ee/services/license/license-fns.ts
@@ -17,44 +17,44 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
  environmentsUsed: 0,
  identityLimit: null,
  identitiesUsed: 0,
-  dynamicSecret: true,
+  dynamicSecret: false,
  secretVersioning: true,
-  pitRecovery: true,
-  ipAllowlisting: true,
-  rbac: true,
-  githubOrgSync: true,
-  customRateLimits: true,
-  customAlerts: true,
-  secretAccessInsights: true,
-  auditLogs: true,
+  pitRecovery: false,
+  ipAllowlisting: false,
+  rbac: false,
+  githubOrgSync: false,
+  customRateLimits: false,
+  customAlerts: false,
+  secretAccessInsights: false,
+  auditLogs: false,
  auditLogsRetentionDays: 0,
-  auditLogStreams: true,
+  auditLogStreams: false,
  auditLogStreamLimit: 3,
-  samlSSO: true,
-  hsm: true,
-  oidcSSO: true,
-  scim: true,
-  ldap: true,
-  groups: true,
+  samlSSO: false,
+  hsm: false,
+  oidcSSO: false,
+  scim: false,
+  ldap: false,
+  groups: false,
  status: null,
  trial_end: null,
  has_used_trial: true,
-  secretApproval: true,
-  secretRotation: true,
-  caCrl: true,
-  instanceUserManagement: true,
-  externalKms: true,
+  secretApproval: false,
+  secretRotation: false,
+  caCrl: false,
+  instanceUserManagement: false,
+  externalKms: false,
  rateLimits: {
    readLimit: 60,
    writeLimit: 200,
    secretsLimit: 40
  },
-  pkiEst: true,
-  enforceMfa: true,
-  projectTemplates: true,
-  kmip: true,
-  gateway: true,
-  sshHostGroups: true
+  pkiEst: false,
+  enforceMfa: false,
+  projectTemplates: false,
+  kmip: false,
+  gateway: false,
+  sshHostGroups: false
 });

 export const setupLicenseRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => {
--- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
+++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
@@ -20,6 +20,7 @@ import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { ActorType } from "@app/services/auth/auth-type";
+import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
@@ -130,6 +131,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
  projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
  microsoftTeamsService: Pick<TMicrosoftTeamsServiceFactory, "sendNotification">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 export type TSecretApprovalRequestServiceFactory = ReturnType<typeof secretApprovalRequestServiceFactory>;
@@ -161,7 +163,8 @@ export const secretApprovalRequestServiceFactory = ({
  projectSlackConfigDAL,
  resourceMetadataDAL,
  projectMicrosoftTeamsConfigDAL,
-  microsoftTeamsService
+  microsoftTeamsService,
+  folderCommitService
 }: TSecretApprovalRequestServiceFactoryDep) => {
  const requestCount = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TApprovalRequestCountDTO) => {
    if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" });
@@ -596,6 +599,10 @@ export const secretApprovalRequestServiceFactory = ({
          ? await fnSecretV2BridgeBulkInsert({
              tx,
              folderId,
+              actor: {
+                actorId,
+                type: actor
+              },
              orgId: actorOrgId,
              inputSecrets: secretCreationCommits.map((el) => ({
                tagIds: el?.tags.map(({ id }) => id),
@@ -618,13 +625,18 @@ export const secretApprovalRequestServiceFactory = ({
              secretDAL: secretV2BridgeDAL,
              secretVersionDAL: secretVersionV2BridgeDAL,
              secretTagDAL,
-              secretVersionTagDAL: secretVersionTagV2BridgeDAL
+              secretVersionTagDAL: secretVersionTagV2BridgeDAL,
+              folderCommitService
            })
          : [];
        const updatedSecrets = secretUpdationCommits.length
          ? await fnSecretV2BridgeBulkUpdate({
              folderId,
              orgId: actorOrgId,
+              actor: {
+                actorId,
+                type: actor
+              },
              tx,
              inputSecrets: secretUpdationCommits.map((el) => {
                const encryptedValue =
@@ -658,7 +670,8 @@ export const secretApprovalRequestServiceFactory = ({
              secretVersionDAL: secretVersionV2BridgeDAL,
              secretTagDAL,
              secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              resourceMetadataDAL
+              resourceMetadataDAL,
+              folderCommitService
            })
          : [];
        const deletedSecret = secretDeletionCommits.length
@@ -666,10 +679,13 @@ export const secretApprovalRequestServiceFactory = ({
              projectId,
              folderId,
              tx,
-              actorId: "",
+              actorId,
+              actorType: actor,
              secretDAL: secretV2BridgeDAL,
              secretQueueService,
-              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared }))
+              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared })),
+              folderCommitService,
+              secretVersionDAL: secretVersionV2BridgeDAL
            })
          : [];
        const updatedSecretApproval = await secretApprovalRequestDAL.updateById(
--- a/backend/src/ee/services/secret-replication/secret-replication-service.ts
+++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts
@@ -10,6 +10,7 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
+import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -87,6 +88,7 @@ type TSecretReplicationServiceFactoryDep = {

  projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 export type TSecretReplicationServiceFactory = ReturnType<typeof secretReplicationServiceFactory>;
@@ -132,6 +134,7 @@ export const secretReplicationServiceFactory = ({
  secretVersionV2BridgeDAL,
  secretV2BridgeDAL,
  kmsService,
+  folderCommitService,
  resourceMetadataDAL
 }: TSecretReplicationServiceFactoryDep) => {
  const $getReplicatedSecrets = (
@@ -446,6 +449,7 @@ export const secretReplicationServiceFactory = ({
                    tx,
                    secretTagDAL,
                    resourceMetadataDAL,
+                    folderCommitService,
                    secretVersionTagDAL: secretVersionV2TagBridgeDAL,
                    inputSecrets: locallyCreatedSecrets.map((doc) => {
                      return {
@@ -466,6 +470,7 @@ export const secretReplicationServiceFactory = ({
                    orgId,
                    folderId: destinationReplicationFolderId,
                    secretVersionDAL: secretVersionV2BridgeDAL,
+                    folderCommitService,
                    secretDAL: secretV2BridgeDAL,
                    tx,
                    resourceMetadataDAL,
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
@@ -61,6 +61,7 @@ import { TAppConnectionDALFactory } from "@app/services/app-connection/app-conne
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { ActorType } from "@app/services/auth/auth-type";
+import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -96,7 +97,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
    TSecretV2BridgeDALFactory,
    "bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "invalidateSecretCacheByProjectId"
  >;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
  secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
@@ -104,6 +105,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
  snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
  queueService: Pick<TQueueServiceFactory, "queuePg">;
  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 export type TSecretRotationV2ServiceFactory = ReturnType<typeof secretRotationV2ServiceFactory>;
@@ -141,6 +143,7 @@ export const secretRotationV2ServiceFactory = ({
  snapshotService,
  keyStore,
  queueService,
+  folderCommitService,
  appConnectionDAL
 }: TSecretRotationV2ServiceFactoryDep) => {
  const $queueSendSecretRotationStatusNotification = async (secretRotation: TSecretRotationV2Raw) => {
@@ -533,7 +536,12 @@ export const secretRotationV2ServiceFactory = ({
            secretVersionDAL: secretVersionV2BridgeDAL,
            secretVersionTagDAL: secretVersionTagV2BridgeDAL,
            secretTagDAL,
-            resourceMetadataDAL
+            folderCommitService,
+            resourceMetadataDAL,
+            actor: {
+              type: actor.type,
+              actorId: actor.id
+            }
          });

          await secretRotationV2DAL.insertSecretMappings(
@@ -668,7 +676,12 @@ export const secretRotationV2ServiceFactory = ({
            secretVersionDAL: secretVersionV2BridgeDAL,
            secretVersionTagDAL: secretVersionTagV2BridgeDAL,
            secretTagDAL,
-            resourceMetadataDAL
+            folderCommitService,
+            resourceMetadataDAL,
+            actor: {
+              type: actor.type,
+              actorId: actor.id
+            }
          });

          secretsMappingUpdated = true;
@@ -786,6 +799,9 @@ export const secretRotationV2ServiceFactory = ({
            projectId,
            folderId,
            actorId: actor.id, // not actually used since rotated secrets are shared
+            actorType: actor.type,
+            folderCommitService,
+            secretVersionDAL: secretVersionV2BridgeDAL,
            tx
          });
        }
@@ -926,6 +942,7 @@ export const secretRotationV2ServiceFactory = ({
            secretDAL: secretV2BridgeDAL,
            secretVersionDAL: secretVersionV2BridgeDAL,
            secretVersionTagDAL: secretVersionTagV2BridgeDAL,
+            folderCommitService,
            secretTagDAL,
            resourceMetadataDAL
          });
--- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts
+++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts
@@ -14,6 +14,7 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
+import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -53,6 +54,7 @@ type TSecretRotationQueueFactoryDep = {
  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
  telemetryService: Pick<TTelemetryServiceFactory, "sendPostHogEvents">;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 // These error should stop the repeatable job and ask user to reconfigure rotation
@@ -77,6 +79,7 @@ export const secretRotationQueueFactory = ({
  telemetryService,
  secretV2BridgeDAL,
  secretVersionV2BridgeDAL,
+  folderCommitService,
  kmsService
 }: TSecretRotationQueueFactoryDep) => {
  const addToQueue = async (rotationId: string, interval: number) => {
@@ -330,7 +333,7 @@ export const secretRotationQueueFactory = ({
            })),
            tx
          );
-          await secretVersionV2BridgeDAL.insertMany(
+          const secretVersions = await secretVersionV2BridgeDAL.insertMany(
            updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
              ...el,
              actorType: ActorType.PLATFORM,
@@ -338,6 +341,21 @@ export const secretRotationQueueFactory = ({
            })),
            tx
          );
+
+          await folderCommitService.createCommit(
+            {
+              actor: {
+                type: ActorType.PLATFORM
+              },
+              message: "Secret rotation",
+              folderId: secretVersions[0].folderId,
+              changes: secretVersions.map((sv) => ({
+                type: "add",
+                secretVersionId: sv.id
+              }))
+            },
+            tx
+          );
        });

        await secretV2BridgeDAL.invalidateSecretCacheByProjectId(secretRotation.projectId);
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -140,6 +140,11 @@ import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-gr
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
+import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
+import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
+import { folderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
+import { folderCommitChangesDALFactory } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
+import { folderTreeCheckpointDALFactory } from "@app/services/folder-tree-checkpoint/folder-tree-checkpoint-dal";
 import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
 import { groupProjectServiceFactory } from "@app/services/group-project/group-project-service";
@@ -551,6 +556,19 @@ export const registerRoutes = async (
    projectRoleDAL,
    permissionService
  });
+
+  const folderCommitChangesDAL = folderCommitChangesDALFactory(db);
+  const folderCheckpointDAL = folderCheckpointDALFactory(db);
+  const folderTreeCheckpointDAL = folderTreeCheckpointDALFactory(db);
+  const folderCommitDAL = folderCommitDALFactory(db);
+  const folderCommitService = folderCommitServiceFactory({
+    folderCommitDAL,
+    folderCommitChangesDAL,
+    folderCheckpointDAL,
+    folderTreeCheckpointDAL,
+    userDAL,
+    identityDAL
+  });
  const scimService = scimServiceFactory({
    licenseService,
    scimDAL,
@@ -973,6 +991,7 @@ export const registerRoutes = async (
    projectMembershipDAL,
    projectBotDAL,
    secretDAL,
+    folderCommitService,
    secretBlindIndexDAL,
    secretVersionDAL,
    secretTagDAL,
@@ -1019,6 +1038,7 @@ export const registerRoutes = async (
    secretReminderRecipientsDAL,
    orgService,
    resourceMetadataDAL,
+    folderCommitService,
    secretSyncQueue
  });

@@ -1120,7 +1140,8 @@ export const registerRoutes = async (
    folderVersionDAL,
    projectEnvDAL,
    snapshotService,
-    projectDAL
+    projectDAL,
+    folderCommitService
  });

  const secretImportService = secretImportServiceFactory({
@@ -1145,6 +1166,7 @@ export const registerRoutes = async (
  const secretV2BridgeService = secretV2BridgeServiceFactory({
    folderDAL,
    secretVersionDAL: secretVersionV2BridgeDAL,
+    folderCommitService,
    secretQueueService,
    secretDAL: secretV2BridgeDAL,
    permissionService,
@@ -1188,7 +1210,8 @@ export const registerRoutes = async (
    projectSlackConfigDAL,
    resourceMetadataDAL,
    projectMicrosoftTeamsConfigDAL,
-    microsoftTeamsService
+    microsoftTeamsService,
+    folderCommitService
  });

  const secretService = secretServiceFactory({
@@ -1273,7 +1296,8 @@ export const registerRoutes = async (
    secretV2BridgeDAL,
    secretVersionV2TagBridgeDAL: secretVersionTagV2BridgeDAL,
    secretVersionV2BridgeDAL,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService
  });

  const secretRotationQueue = secretRotationQueueFactory({
@@ -1285,6 +1309,7 @@ export const registerRoutes = async (
    projectBotService,
    secretVersionV2BridgeDAL,
    secretV2BridgeDAL,
+    folderCommitService,
    kmsService
  });

@@ -1557,7 +1582,9 @@ export const registerRoutes = async (
    secretDAL: secretV2BridgeDAL,
    queueService,
    secretV2BridgeService,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService,
+    folderVersionDAL
  });

  const migrationService = externalMigrationServiceFactory({
@@ -1619,6 +1646,7 @@ export const registerRoutes = async (
    auditLogService,
    secretV2BridgeDAL,
    secretTagDAL,
+    folderCommitService,
    secretVersionTagV2BridgeDAL,
    secretVersionV2BridgeDAL,
    keyStore,
@@ -1746,7 +1774,8 @@ export const registerRoutes = async (
    secretRotationV2: secretRotationV2Service,
    microsoftTeams: microsoftTeamsService,
    assumePrivileges: assumePrivilegeService,
-    githubOrgSync: githubOrgSyncConfigService
+    githubOrgSync: githubOrgSyncConfigService,
+    folderCommit: folderCommitService
  });

  const cronJobs: CronJob[] = [];
--- a/backend/src/services/external-migration/external-migration-fns.ts
+++ b/backend/src/services/external-migration/external-migration-fns.ts
@@ -10,6 +10,7 @@ import { chunkArray } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";

+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectDALFactory } from "../project/project-dal";
@@ -18,6 +19,7 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
+import { TSecretFolderVersionDALFactory } from "../secret-folder/secret-folder-version-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { fnSecretBulkInsert, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
@@ -42,6 +44,8 @@ export type TImportDataIntoInfisicalDTO = {
  projectService: Pick<TProjectServiceFactory, "createProject">;
  projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
  secretV2BridgeService: Pick<TSecretV2BridgeServiceFactory, "createManySecret">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
+  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "create">;

  input: TImportInfisicalDataCreate;
 };
@@ -507,6 +511,8 @@ export const importDataIntoInfisicalFn = async ({
  secretVersionTagDAL,
  folderDAL,
  resourceMetadataDAL,
+  folderVersionDAL,
+  folderCommitService,
  input: { data, actor, actorId, actorOrgId, actorAuthMethod }
 }: TImportDataIntoInfisicalDTO) => {
  // Import data to infisical
@@ -599,6 +605,36 @@ export const importDataIntoInfisicalFn = async ({
          tx
        );

+        const newFolderVersion = await folderVersionDAL.create(
+          {
+            name: newFolder.name,
+            envId: newFolder.envId,
+            version: newFolder.version,
+            folderId: newFolder.id
+          },
+          tx
+        );
+
+        await folderCommitService.createCommit(
+          {
+            actor: {
+              type: actor,
+              metadata: {
+                id: actorId
+              }
+            },
+            message: "External migration",
+            folderId: parentEnv.rootFolderId,
+            changes: [
+              {
+                type: "add",
+                folderVersionId: newFolderVersion.id
+              }
+            ]
+          },
+          tx
+        );
+
        originalToNewFolderId.set(folder.id, {
          folderId: newFolder.id,
          projectId: parentEnv.projectId
@@ -772,6 +808,7 @@ export const importDataIntoInfisicalFn = async ({
            secretVersionDAL,
            secretTagDAL,
            secretVersionTagDAL,
+            folderCommitService,
            actor: {
              type: actor,
              actorId
--- a/backend/src/services/external-migration/external-migration-queue.ts
+++ b/backend/src/services/external-migration/external-migration-queue.ts
@@ -3,6 +3,7 @@ import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";

+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectServiceFactory } from "../project/project-service";
@@ -10,6 +11,7 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
+import { TSecretFolderVersionDALFactory } from "../secret-folder/secret-folder-version-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
@@ -36,6 +38,8 @@ export type TExternalMigrationQueueFactoryDep = {
  projectService: Pick<TProjectServiceFactory, "createProject">;
  projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
  secretV2BridgeService: Pick<TSecretV2BridgeServiceFactory, "createManySecret">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
+  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "create">;

  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
 };
@@ -56,6 +60,8 @@ export const externalMigrationQueueFactory = ({
  secretTagDAL,
  secretVersionTagDAL,
  folderDAL,
+  folderCommitService,
+  folderVersionDAL,
  resourceMetadataDAL
 }: TExternalMigrationQueueFactoryDep) => {
  const startImport = async (dto: {
@@ -114,6 +120,8 @@ export const externalMigrationQueueFactory = ({
        projectService,
        projectEnvService,
        secretV2BridgeService,
+        folderCommitService,
+        folderVersionDAL,
        resourceMetadataDAL
      });

--- a/backend/src/services/folder-checkpoint-resources/folder-checkpoint-resources-dal.ts
+++ b/backend/src/services/folder-checkpoint-resources/folder-checkpoint-resources-dal.ts
@@ -9,11 +9,10 @@ export type TFolderCheckpointResourcesDALFactory = ReturnType<typeof folderCheck

 type ResourceWithCheckpointInfo = TFolderCheckpointResources & {
  folderCommitId: string;
-  date: Date;
 };

 export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
-  const folderCheckpointResourcesOrm = ormify<TFolderCheckpointResources>(db, TableName.FolderCheckpointResources);
+  const folderCheckpointResourcesOrm = ormify(db, TableName.FolderCheckpointResources);

  const findByCheckpointId = async (folderCheckpointId: string, tx?: Knex): Promise<TFolderCheckpointResources[]> => {
    try {
@@ -29,7 +28,7 @@ export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
  const findBySecretVersionId = async (secretVersionId: string, tx?: Knex): Promise<ResourceWithCheckpointInfo[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "date">
+        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "createdAt">
      >(TableName.FolderCheckpointResources)
        .where({ secretVersionId })
        .select(selectAllTableCols(TableName.FolderCheckpointResources))
@@ -40,7 +39,7 @@ export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
        )
        .select(
          db.ref("folderCommitId").withSchema(TableName.FolderCheckpoint),
-          db.ref("date").withSchema(TableName.FolderCheckpoint)
+          db.ref("createdAt").withSchema(TableName.FolderCheckpoint)
        );
      return docs;
    } catch (error) {
@@ -51,7 +50,7 @@ export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
  const findByFolderVersionId = async (folderVersionId: string, tx?: Knex): Promise<ResourceWithCheckpointInfo[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "date">
+        TFolderCheckpointResources & Pick<TFolderCheckpoints, "folderCommitId" | "createdAt">
      >(TableName.FolderCheckpointResources)
        .where({ folderVersionId })
        .select(selectAllTableCols(TableName.FolderCheckpointResources))
@@ -62,7 +61,7 @@ export const folderCheckpointResourcesDALFactory = (db: TDbClient) => {
        )
        .select(
          db.ref("folderCommitId").withSchema(TableName.FolderCheckpoint),
-          db.ref("date").withSchema(TableName.FolderCheckpoint)
+          db.ref("createdAt").withSchema(TableName.FolderCheckpoint)
        );
      return docs;
    } catch (error) {
--- a/backend/src/services/folder-checkpoint/folder-checkpoint-dal.ts
+++ b/backend/src/services/folder-checkpoint/folder-checkpoint-dal.ts
@@ -8,15 +8,15 @@ import { ormify, selectAllTableCols } from "@app/lib/knex";
 export type TFolderCheckpointDALFactory = ReturnType<typeof folderCheckpointDALFactory>;

 type CheckpointWithCommitInfo = TFolderCheckpoints & {
-  actorName: string;
+  actorMetadata: unknown;
  actorType: string;
-  message: string | null;
+  message?: string | null;
  commitDate: Date;
  folderId: string;
 };

 export const folderCheckpointDALFactory = (db: TDbClient) => {
-  const folderCheckpointOrm = ormify<TFolderCheckpoints>(db, TableName.FolderCheckpoint);
+  const folderCheckpointOrm = ormify(db, TableName.FolderCheckpoint);

  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderCheckpoints | undefined> => {
    try {
@@ -37,13 +37,13 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
        .where({ folderId })
        .select(selectAllTableCols(TableName.FolderCheckpoint))
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit).as("commitDate"),
+          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        )
-        .orderBy(`${TableName.FolderCheckpoint}.date`, "desc");
+        .orderBy(`${TableName.FolderCheckpoint}.createdAt`, "desc");

      if (limit !== undefined) {
        query = query.limit(limit);
@@ -63,13 +63,13 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
        .where({ folderId })
        .select(selectAllTableCols(TableName.FolderCheckpoint))
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit).as("commitDate"),
+          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        )
-        .orderBy(`${TableName.FolderCheckpoint}.date`, "desc")
+        .orderBy(`${TableName.FolderCheckpoint}.createdAt`, "desc")
        .first();
      return doc;
    } catch (error) {
--- a/backend/src/services/folder-commit-changes/folder-commit-changes-dal.ts
+++ b/backend/src/services/folder-commit-changes/folder-commit-changes-dal.ts
@@ -8,15 +8,14 @@ import { ormify, selectAllTableCols } from "@app/lib/knex";
 export type TFolderCommitChangesDALFactory = ReturnType<typeof folderCommitChangesDALFactory>;

 type CommitChangeWithCommitInfo = TFolderCommitChanges & {
-  actorName: string;
+  actorMetadata: unknown;
  actorType: string;
-  message: string | null;
-  date: Date;
+  message?: string | null;
  folderId: string;
 };

 export const folderCommitChangesDALFactory = (db: TDbClient) => {
-  const folderCommitChangesOrm = ormify<TFolderCommitChanges>(db, TableName.FolderCommitChanges);
+  const folderCommitChangesOrm = ormify(db, TableName.FolderCommitChanges);

  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderCommitChanges[]> => {
    try {
@@ -32,16 +31,17 @@ export const folderCommitChangesDALFactory = (db: TDbClient) => {
  const findBySecretVersionId = async (secretVersionId: string, tx?: Knex): Promise<CommitChangeWithCommitInfo[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderCommitChanges & Pick<TFolderCommits, "actorName" | "actorType" | "message" | "date" | "folderId">
+        TFolderCommitChanges &
+          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
      >(TableName.FolderCommitChanges)
        .where({ secretVersionId })
        .select(selectAllTableCols(TableName.FolderCommitChanges))
        .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit),
+          db.ref("createdAt").withSchema(TableName.FolderCommit),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        );
      return docs;
@@ -53,16 +53,17 @@ export const folderCommitChangesDALFactory = (db: TDbClient) => {
  const findByFolderVersionId = async (folderVersionId: string, tx?: Knex): Promise<CommitChangeWithCommitInfo[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderCommitChanges & Pick<TFolderCommits, "actorName" | "actorType" | "message" | "date" | "folderId">
+        TFolderCommitChanges &
+          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
      >(TableName.FolderCommitChanges)
        .where({ folderVersionId })
        .select(selectAllTableCols(TableName.FolderCommitChanges))
        .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit),
+          db.ref("createdAt").withSchema(TableName.FolderCommit),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        );
      return docs;
--- a/backend/src/services/folder-commit/folder-commit-dal.ts
+++ b/backend/src/services/folder-commit/folder-commit-dal.ts
@@ -8,7 +8,8 @@ import { ormify, selectAllTableCols } from "@app/lib/knex";
 export type TFolderCommitDALFactory = ReturnType<typeof folderCommitDALFactory>;

 export const folderCommitDALFactory = (db: TDbClient) => {
-  const folderCommitOrm = ormify<TFolderCommits>(db, TableName.FolderCommit);
+  const folderCommitOrm = ormify(db, TableName.FolderCommit);
+  const { delete: deleteOp, deleteById, ...restOfOrm } = folderCommitOrm;

  const findByFolderId = async (folderId: string, tx?: Knex): Promise<TFolderCommits[]> => {
    try {
@@ -48,7 +49,7 @@ export const folderCommitDALFactory = (db: TDbClient) => {
  };

  return {
-    ...folderCommitOrm,
+    ...restOfOrm,
    findByFolderId,
    findById,
    findLatestCommit
--- a/backend/src/services/folder-commit/folder-commit-service.ts
+++ b/backend/src/services/folder-commit/folder-commit-service.ts
@@ -0,0 +1,168 @@
+import { Knex } from "knex";
+
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
+
+import { ActorType } from "../auth/auth-type";
+import { TFolderCheckpointDALFactory } from "../folder-checkpoint/folder-checkpoint-dal";
+import { TFolderCommitChangesDALFactory } from "../folder-commit-changes/folder-commit-changes-dal";
+import { TFolderTreeCheckpointDALFactory } from "../folder-tree-checkpoint/folder-tree-checkpoint-dal";
+import { TIdentityDALFactory } from "../identity/identity-dal";
+import { TUserDALFactory } from "../user/user-dal";
+import { TFolderCommitDALFactory } from "./folder-commit-dal";
+
+type TFolderCommitServiceFactoryDep = {
+  folderCommitDAL: Pick<
+    TFolderCommitDALFactory,
+    "create" | "findById" | "findByFolderId" | "findLatestCommit" | "transaction"
+  >;
+  folderCommitChangesDAL: Pick<TFolderCommitChangesDALFactory, "create" | "findByCommitId" | "insertMany">;
+  folderCheckpointDAL: Pick<TFolderCheckpointDALFactory, "create" | "findByFolderId" | "findLatestByFolderId">;
+  folderTreeCheckpointDAL: Pick<
+    TFolderTreeCheckpointDALFactory,
+    "create" | "findByProjectId" | "findLatestByProjectId"
+  >;
+  userDAL: Pick<TUserDALFactory, "findById">;
+  identityDAL: Pick<TIdentityDALFactory, "findById">;
+};
+
+export type TCreateCommitDTO = {
+  actor: {
+    type: string;
+    metadata?: {
+      name?: string;
+      id?: string;
+    };
+  };
+  message?: string;
+  folderId: string;
+  changes: {
+    type: string;
+    secretVersionId?: string;
+    folderVersionId?: string;
+  }[];
+};
+
+export type TCommitChangeDTO = {
+  folderCommitId: string;
+  changeType: string;
+  secretVersionId?: string;
+  folderVersionId?: string;
+};
+
+export const folderCommitServiceFactory = ({
+  folderCommitDAL,
+  folderCommitChangesDAL,
+  folderCheckpointDAL,
+  folderTreeCheckpointDAL,
+  userDAL,
+  identityDAL
+}: TFolderCommitServiceFactoryDep) => {
+  const createCommit = async (data: TCreateCommitDTO, tx?: Knex) => {
+    const metadata = data.actor.metadata || {};
+    try {
+      if (data.actor.type === ActorType.USER && data.actor.metadata?.id) {
+        const user = await userDAL.findById(data.actor.metadata?.id, tx);
+        metadata.name = user?.username;
+      }
+      if (data.actor.type === ActorType.IDENTITY && data.actor.metadata?.id) {
+        const identity = await identityDAL.findById(data.actor.metadata?.id, tx);
+        metadata.name = identity?.name;
+      }
+      const newCommit = await folderCommitDAL.create(
+        {
+          actorMetadata: metadata,
+          actorType: data.actor.type,
+          message: data.message,
+          folderId: data.folderId
+        },
+        tx
+      );
+      for (const change of data.changes) {
+        // eslint-disable-next-line no-await-in-loop
+        await folderCommitChangesDAL.create(
+          {
+            folderCommitId: newCommit.id,
+            changeType: change.type,
+            secretVersionId: change.secretVersionId,
+            folderVersionId: change.folderVersionId
+          },
+          tx
+        );
+      }
+
+      return newCommit;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "CreateCommit" });
+    }
+  };
+
+  // Add a change to a commit and trigger checkpoints as needed
+  const addCommitChange = async (data: TCommitChangeDTO, tx?: Knex) => {
+    try {
+      if (!data.secretVersionId && !data.folderVersionId) {
+        throw new BadRequestError({ message: "Either secretVersionId or folderVersionId must be provided" });
+      }
+
+      const commit = await folderCommitDAL.findById(data.folderCommitId, tx);
+      if (!commit) {
+        throw new NotFoundError({ message: `Commit with ID ${data.folderCommitId} not found` });
+      }
+
+      return await folderCommitChangesDAL.create(data, tx);
+    } catch (error) {
+      if (error instanceof NotFoundError || error instanceof BadRequestError) {
+        throw error;
+      }
+      throw new DatabaseError({ error, name: "AddCommitChange" });
+    }
+  };
+
+  // Retrieve a commit by ID
+  const getCommitById = async (id: string, tx?: Knex) => {
+    return folderCommitDAL.findById(id, tx);
+  };
+
+  // Get all commits for a folder
+  const getCommitsByFolderId = async (folderId: string, tx?: Knex) => {
+    return folderCommitDAL.findByFolderId(folderId, tx);
+  };
+
+  // Get changes for a commit
+  const getCommitChanges = async (commitId: string, tx?: Knex) => {
+    return folderCommitChangesDAL.findByCommitId(commitId, tx);
+  };
+
+  // Get checkpoints for a folder
+  const getCheckpointsByFolderId = async (folderId: string, limit?: number, tx?: Knex) => {
+    return folderCheckpointDAL.findByFolderId(folderId, limit, tx);
+  };
+
+  // Get the latest checkpoint for a folder
+  const getLatestCheckpoint = async (folderId: string, tx?: Knex) => {
+    return folderCheckpointDAL.findLatestByFolderId(folderId, tx);
+  };
+
+  // Get tree checkpoints for a project
+  const getTreeCheckpointsByProjectId = async (projectId: string, limit?: number, tx?: Knex) => {
+    return folderTreeCheckpointDAL.findByProjectId(projectId, limit, tx);
+  };
+
+  // Get the latest tree checkpoint for a project
+  const getLatestTreeCheckpoint = async (projectId: string, tx?: Knex) => {
+    return folderTreeCheckpointDAL.findLatestByProjectId(projectId, tx);
+  };
+
+  return {
+    createCommit,
+    addCommitChange,
+    getCommitById,
+    getCommitsByFolderId,
+    getCommitChanges,
+    getCheckpointsByFolderId,
+    getLatestCheckpoint,
+    getTreeCheckpointsByProjectId,
+    getLatestTreeCheckpoint
+  };
+};
+
+export type TFolderCommitServiceFactory = ReturnType<typeof folderCommitServiceFactory>;
--- a/backend/src/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal.ts
+++ b/backend/src/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal.ts
@@ -3,9 +3,9 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import {
  TableName,
-  TEnvironments,
  TFolderTreeCheckpointResources,
  TFolderTreeCheckpoints,
+  TProjectEnvironments,
  TSecretFolders
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
@@ -15,21 +15,17 @@ export type TFolderTreeCheckpointResourcesDALFactory = ReturnType<typeof folderT

 type ResourceWithCheckpointInfo = TFolderTreeCheckpointResources & {
  folderCommitId: string;
-  date: Date;
 };

 type ResourceWithFolderInfo = TFolderTreeCheckpointResources & {
  name: string;
-  parentId: string | null;
+  parentId?: string | null;
  slug: string;
  envName: string;
 };

 export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
-  const folderTreeCheckpointResourcesOrm = ormify<TFolderTreeCheckpointResources>(
-    db,
-    TableName.FolderTreeCheckpointResources
-  );
+  const folderTreeCheckpointResourcesOrm = ormify(db, TableName.FolderTreeCheckpointResources);

  const findByTreeCheckpointId = async (
    folderTreeCheckpointId: string,
@@ -50,7 +46,7 @@ export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
  const findByFolderId = async (folderId: string, tx?: Knex): Promise<ResourceWithCheckpointInfo[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderTreeCheckpointResources & Pick<TFolderTreeCheckpoints, "folderCommitId" | "date">
+        TFolderTreeCheckpointResources & Pick<TFolderTreeCheckpoints, "folderCommitId" | "createdAt">
      >(TableName.FolderTreeCheckpointResources)
        .where({ folderId })
        .select(selectAllTableCols(TableName.FolderTreeCheckpointResources))
@@ -61,7 +57,7 @@ export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
        )
        .select(
          db.ref("folderCommitId").withSchema(TableName.FolderTreeCheckpoint),
-          db.ref("date").withSchema(TableName.FolderTreeCheckpoint)
+          db.ref("createdAt").withSchema(TableName.FolderTreeCheckpoint)
        );
      return docs;
    } catch (error) {
@@ -69,13 +65,10 @@ export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
    }
  };

-  const findByFolderCommitId = async (
-    folderCommitId: string,
-    tx?: Knex
-  ): Promise<(TFolderTreeCheckpointResources & { date: Date })[]> => {
+  const findByFolderCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderTreeCheckpointResources[]> => {
    try {
      const docs = await (tx || db.replicaNode())<
-        TFolderTreeCheckpointResources & Pick<TFolderTreeCheckpoints, "date">
+        TFolderTreeCheckpointResources & Pick<TFolderTreeCheckpoints, "createdAt">
      >(TableName.FolderTreeCheckpointResources)
        .where({ folderCommitId })
        .select(selectAllTableCols(TableName.FolderTreeCheckpointResources))
@@ -84,7 +77,7 @@ export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
          `${TableName.FolderTreeCheckpointResources}.folderTreeCheckpointId`,
          `${TableName.FolderTreeCheckpoint}.id`
        )
-        .select(db.ref("date").withSchema(TableName.FolderTreeCheckpoint));
+        .select(db.ref("createdAt").withSchema(TableName.FolderTreeCheckpoint));
      return docs;
    } catch (error) {
      throw new DatabaseError({ error, name: "FindByFolderCommitId" });
@@ -99,7 +92,7 @@ export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {
      const docs = await (tx || db.replicaNode())<
        TFolderTreeCheckpointResources &
          Pick<TSecretFolders, "name" | "parentId"> &
-          Pick<TEnvironments, "slug"> & { envName: string }
+          Pick<TProjectEnvironments, "slug"> & { envName: string }
      >(TableName.FolderTreeCheckpointResources)
        .where({ folderTreeCheckpointId })
        .select(selectAllTableCols(TableName.FolderTreeCheckpointResources))
--- a/backend/src/services/folder-tree-checkpoint/folder-tree-checkpoint-dal.ts
+++ b/backend/src/services/folder-tree-checkpoint/folder-tree-checkpoint-dal.ts
@@ -8,15 +8,15 @@ import { ormify, selectAllTableCols } from "@app/lib/knex";
 export type TFolderTreeCheckpointDALFactory = ReturnType<typeof folderTreeCheckpointDALFactory>;

 type TreeCheckpointWithCommitInfo = TFolderTreeCheckpoints & {
-  actorName: string;
+  actorMetadata: unknown;
  actorType: string;
-  message: string | null;
+  message?: string | null;
  commitDate: Date;
  folderId: string;
 };

 export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
-  const folderTreeCheckpointOrm = ormify<TFolderTreeCheckpoints>(db, TableName.FolderTreeCheckpoint);
+  const folderTreeCheckpointOrm = ormify(db, TableName.FolderTreeCheckpoint);

  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderTreeCheckpoints | undefined> => {
    try {
@@ -38,7 +38,7 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
    try {
      const query = (tx || db.replicaNode())<
        TFolderTreeCheckpoints &
-          Pick<TFolderCommits, "actorName" | "actorType" | "message" | "folderId"> & { commitDate: Date }
+          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "folderId"> & { commitDate: Date }
      >(TableName.FolderTreeCheckpoint)
        .join(
          TableName.FolderCommit,
@@ -50,13 +50,13 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
        .where({ projectId })
        .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit).as("commitDate"),
+          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        )
-        .orderBy(`${TableName.FolderTreeCheckpoint}.date`, "desc");
+        .orderBy(`${TableName.FolderTreeCheckpoint}.createdAt`, "desc");

      if (limit) {
        void query.limit(limit);
@@ -76,7 +76,7 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
    try {
      const doc = await (tx || db.replicaNode())<
        TFolderTreeCheckpoints &
-          Pick<TFolderCommits, "actorName" | "actorType" | "message" | "folderId"> & { commitDate: Date }
+          Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "folderId"> & { commitDate: Date }
      >(TableName.FolderTreeCheckpoint)
        .join(
          TableName.FolderCommit,
@@ -88,13 +88,13 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
        .where({ projectId })
        .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
        .select(
-          db.ref("actorName").withSchema(TableName.FolderCommit),
+          db.ref("actorMetadata").withSchema(TableName.FolderCommit),
          db.ref("actorType").withSchema(TableName.FolderCommit),
          db.ref("message").withSchema(TableName.FolderCommit),
-          db.ref("date").withSchema(TableName.FolderCommit).as("commitDate"),
+          db.ref("createdAt").withSchema(TableName.FolderCommit).as("commitDate"),
          db.ref("folderId").withSchema(TableName.FolderCommit)
        )
-        .orderBy(`${TableName.FolderTreeCheckpoint}.date`, "desc")
+        .orderBy(`${TableName.FolderTreeCheckpoint}.createdAt`, "desc")
        .first();
      return doc;
    } catch (error) {
--- a/backend/src/services/secret-folder/secret-folder-service.ts
+++ b/backend/src/services/secret-folder/secret-folder-service.ts
@@ -10,6 +10,7 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
 import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";

+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
@@ -29,7 +30,8 @@ type TSecretFolderServiceFactoryDep = {
  snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
  folderDAL: TSecretFolderDALFactory;
  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs" | "find">;
-  folderVersionDAL: TSecretFolderVersionDALFactory;
+  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestFolderVersions" | "create" | "insertMany">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
 };

@@ -41,6 +43,7 @@ export const secretFolderServiceFactory = ({
  permissionService,
  projectEnvDAL,
  folderVersionDAL,
+  folderCommitService,
  projectDAL
 }: TSecretFolderServiceFactoryDep) => {
  const createFolder = async ({
@@ -111,7 +114,7 @@ export const secretFolderServiceFactory = ({
          });
          parentFolderId = newFolders.at(-1)?.id as string;
          const docs = await folderDAL.insertMany(newFolders, tx);
-          await folderVersionDAL.insertMany(
+          const folderVersions = await folderVersionDAL.insertMany(
            docs.map((doc) => ({
              name: doc.name,
              envId: doc.envId,
@@ -120,6 +123,23 @@ export const secretFolderServiceFactory = ({
            })),
            tx
          );
+          await folderCommitService.createCommit(
+            {
+              actor: {
+                type: actor,
+                metadata: {
+                  id: actorId
+                }
+              },
+              message: "Folder created",
+              folderId: parentFolderId,
+              changes: folderVersions.map((fv) => ({
+                type: "add",
+                folderVersionId: fv.id
+              }))
+            },
+            tx
+          );
        }
      }

@@ -127,7 +147,7 @@ export const secretFolderServiceFactory = ({
        { name, envId: env.id, version: 1, parentId: parentFolderId, description },
        tx
      );
-      await folderVersionDAL.create(
+      const folderVersion = await folderVersionDAL.create(
        {
          name: doc.name,
          envId: doc.envId,
@@ -136,6 +156,25 @@ export const secretFolderServiceFactory = ({
        },
        tx
      );
+      await folderCommitService.createCommit(
+        {
+          actor: {
+            type: actor,
+            metadata: {
+              id: actorId
+            }
+          },
+          message: "Folder created",
+          folderId: parentFolderId,
+          changes: [
+            {
+              type: "add",
+              folderVersionId: folderVersion.id
+            }
+          ]
+        },
+        tx
+      );
      return doc;
    });

@@ -225,7 +264,7 @@ export const secretFolderServiceFactory = ({
            { name, description },
            tx
          );
-          await folderVersionDAL.create(
+          const folderVersion = await folderVersionDAL.create(
            {
              name: doc.name,
              envId: doc.envId,
@@ -234,6 +273,25 @@ export const secretFolderServiceFactory = ({
            },
            tx
          );
+          await folderCommitService.createCommit(
+            {
+              actor: {
+                type: actor,
+                metadata: {
+                  id: actorId
+                }
+              },
+              message: "Folder updated",
+              folderId: parentFolder.id,
+              changes: [
+                {
+                  type: "add",
+                  folderVersionId: folderVersion.id
+                }
+              ]
+            },
+            tx
+          );
          if (!doc) {
            throw new NotFoundError({
              message: `Failed to update folder with id '${id}', not found`,
@@ -321,7 +379,7 @@ export const secretFolderServiceFactory = ({
        { name, description },
        tx
      );
-      await folderVersionDAL.create(
+      const folderVersion = await folderVersionDAL.create(
        {
          name: doc.name,
          envId: doc.envId,
@@ -330,6 +388,25 @@ export const secretFolderServiceFactory = ({
        },
        tx
      );
+      await folderCommitService.createCommit(
+        {
+          actor: {
+            type: actor,
+            metadata: {
+              id: actorId
+            }
+          },
+          message: "Folder updated",
+          folderId: parentFolder.id,
+          changes: [
+            {
+              type: "add",
+              folderVersionId: folderVersion.id
+            }
+          ]
+        },
+        tx
+      );
      if (!doc) throw new NotFoundError({ message: `Failed to update folder with ID '${id}'`, name: "UpdateFolder" });
      return doc;
    });
@@ -381,7 +458,30 @@ export const secretFolderServiceFactory = ({
        },
        tx
      );
+
      if (!doc) throw new NotFoundError({ message: `Failed to delete folder with ID '${idOrName}', not found` });
+
+      const folderVersions = await folderVersionDAL.findLatestFolderVersions([doc.id]);
+
+      await folderCommitService.createCommit(
+        {
+          actor: {
+            type: actor,
+            metadata: {
+              id: actorId
+            }
+          },
+          message: "Folder deleted",
+          folderId: parentFolder.id,
+          changes: [
+            {
+              type: "delete",
+              folderVersionId: folderVersions[doc.id].id
+            }
+          ]
+        },
+        tx
+      );
      return doc;
    });

--- a/backend/src/services/secret-folder/secret-folder-version-dal.ts
+++ b/backend/src/services/secret-folder/secret-folder-version-dal.ts
@@ -43,7 +43,7 @@ export const secretFolderVersionDALFactory = (db: TDbClient) => {
      const docs: Array<TSecretFolderVersions & { max: number }> = await (tx || db.replicaNode())(
        TableName.SecretFolderVersion
      )
-        .whereIn("folderId", folderIds)
+        .whereIn(`${TableName.SecretFolderVersion}.folderId`, folderIds)
        .join(
          (tx || db)(TableName.SecretFolderVersion)
            .groupBy("folderId")
--- a/backend/src/services/secret-sync/secret-sync-queue.ts
+++ b/backend/src/services/secret-sync/secret-sync-queue.ts
@@ -58,6 +58,7 @@ import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/se
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";

 import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";

 export type TSecretSyncQueueFactory = ReturnType<typeof secretSyncQueueFactory>;

@@ -93,6 +94,7 @@ type TSecretSyncQueueFactoryDep = {
  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
  secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 type SecretSyncActionJob = Job<
@@ -133,7 +135,8 @@ export const secretSyncQueueFactory = ({
  secretVersionTagDAL,
  secretVersionV2BridgeDAL,
  secretVersionTagV2BridgeDAL,
-  resourceMetadataDAL
+  resourceMetadataDAL,
+  folderCommitService
 }: TSecretSyncQueueFactoryDep) => {
  const appCfg = getConfig();

@@ -164,7 +167,8 @@ export const secretSyncQueueFactory = ({
    secretVersionV2BridgeDAL,
    secretV2BridgeDAL,
    secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService
  });

  const $updateManySecretsRawFn = updateManySecretsRawFnFactory({
@@ -180,7 +184,8 @@ export const secretSyncQueueFactory = ({
    secretVersionV2BridgeDAL,
    secretV2BridgeDAL,
    secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService
  });

  const $getInfisicalSecrets = async (
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
@@ -73,6 +73,7 @@ export const fnSecretBulkInsert = async ({
  resourceMetadataDAL,
  secretTagDAL,
  secretVersionTagDAL,
+  folderCommitService,
  actor,
  tx
 }: TFnSecretBulkInsert) => {
@@ -131,6 +132,30 @@ export const fnSecretBulkInsert = async ({
    tx
  );

+  const commitChanges = secretVersions
+    .filter(({ type }) => type === SecretType.Shared)
+    .map((sv) => ({
+      type: "add",
+      secretVersionId: sv.id
+    }));
+
+  if (commitChanges.length > 0) {
+    await folderCommitService.createCommit(
+      {
+        actor: {
+          type: actorType || ActorType.PLATFORM,
+          metadata: {
+            id: actor?.actorId
+          }
+        },
+        message: "Secret Creation",
+        folderId,
+        changes: commitChanges
+      },
+      tx
+    );
+  }
+
  await secretDAL.upsertSecretReferences(
    inputSecrets.map(({ references = [], key }) => ({
      secretId: newSecretGroupedByKeyName[key][0].id,
@@ -185,6 +210,7 @@ export const fnSecretBulkUpdate = async ({
  orgId,
  secretDAL,
  secretVersionDAL,
+  folderCommitService,
  secretTagDAL,
  secretVersionTagDAL,
  resourceMetadataDAL,
@@ -259,6 +285,30 @@ export const fnSecretBulkUpdate = async ({
    ),
    tx
  );
+
+  const commitChanges = secretVersions
+    .filter(({ type }) => type === SecretType.Shared)
+    .map((sv) => ({
+      type: "add",
+      secretVersionId: sv.id
+    }));
+  if (commitChanges.length > 0) {
+    await folderCommitService.createCommit(
+      {
+        actor: {
+          type: actorType || ActorType.PLATFORM,
+          metadata: {
+            id: actor?.actorId
+          }
+        },
+        message: "Secret Update",
+        folderId,
+        changes: commitChanges
+      },
+      tx
+    );
+  }
+
  await secretDAL.upsertSecretReferences(
    inputSecrets
      .filter(({ data: { references } }) => Boolean(references))
@@ -337,8 +387,11 @@ export const fnSecretBulkDelete = async ({
  inputSecrets,
  tx,
  actorId,
+  actorType,
  secretDAL,
-  secretQueueService
+  secretQueueService,
+  folderCommitService,
+  secretVersionDAL
 }: TFnSecretBulkDelete) => {
  const deletedSecrets = await secretDAL.deleteMany(
    inputSecrets.map(({ type, secretKey }) => ({
@@ -358,6 +411,35 @@ export const fnSecretBulkDelete = async ({
      )
  );

+  const secretVersions = await secretVersionDAL.findLatestVersionMany(
+    folderId,
+    deletedSecrets.map(({ id }) => id),
+    tx
+  );
+
+  const commitChanges = deletedSecrets
+    .filter(({ type }) => type === SecretType.Shared)
+    .map(({ id }) => ({
+      type: "delete",
+      secretVersionId: secretVersions[id].id
+    }));
+  if (commitChanges.length > 0) {
+    await folderCommitService.createCommit(
+      {
+        actor: {
+          type: actorType || ActorType.PLATFORM,
+          metadata: {
+            id: actorId
+          }
+        },
+        message: "Secret Delete",
+        folderId,
+        changes: commitChanges
+      },
+      tx
+    );
+  }
+
  return deletedSecrets;
 };

--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -34,6 +34,7 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";

 import { ActorType } from "../auth/auth-type";
+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
@@ -90,6 +91,7 @@ type TSecretV2BridgeServiceFactoryDep = {
  secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
  secretTagDAL: TSecretTagDALFactory;
  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs">;
  folderDAL: Pick<
    TSecretFolderDALFactory,
@@ -124,6 +126,7 @@ export const secretV2BridgeServiceFactory = ({
  projectEnvDAL,
  secretTagDAL,
  secretVersionDAL,
+  folderCommitService,
  folderDAL,
  permissionService,
  snapshotService,
@@ -327,6 +330,7 @@ export const secretV2BridgeServiceFactory = ({
        resourceMetadataDAL,
        secretDAL,
        secretVersionDAL,
+        folderCommitService,
        secretTagDAL,
        secretVersionTagDAL,
        actor: {
@@ -510,6 +514,7 @@ export const secretV2BridgeServiceFactory = ({
        folderId,
        orgId: actorOrgId,
        resourceMetadataDAL,
+        folderCommitService,
        inputSecrets: [
          {
            filter: { id: secretId },
@@ -650,6 +655,9 @@ export const secretV2BridgeServiceFactory = ({
          projectId,
          folderId,
          actorId,
+          actorType: actor,
+          folderCommitService,
+          secretVersionDAL,
          secretDAL,
          secretQueueService,
          inputSecrets: [
@@ -1590,6 +1598,7 @@ export const secretV2BridgeServiceFactory = ({
        orgId: actorOrgId,
        secretDAL,
        resourceMetadataDAL,
+        folderCommitService,
        secretVersionDAL,
        secretTagDAL,
        secretVersionTagDAL,
@@ -1859,6 +1868,7 @@ export const secretV2BridgeServiceFactory = ({
        const bulkUpdatedSecrets = await fnSecretBulkUpdate({
          folderId,
          orgId: actorOrgId,
+          folderCommitService,
          tx,
          inputSecrets: secretsToUpdate.map((el) => {
            const originalSecret = secretsToUpdateInDBGroupedByKey[el.secretKey][0];
@@ -1928,6 +1938,7 @@ export const secretV2BridgeServiceFactory = ({
            secretVersionDAL,
            secretTagDAL,
            secretVersionTagDAL,
+            folderCommitService,
            actor: {
              type: actor,
              actorId
@@ -2061,6 +2072,8 @@ export const secretV2BridgeServiceFactory = ({
        fnSecretBulkDelete({
          secretDAL,
          secretQueueService,
+          folderCommitService,
+          secretVersionDAL,
          inputSecrets: inputSecrets.map(({ type, secretKey }) => ({
            secretKey,
            type: type || SecretType.Shared
@@ -2068,6 +2081,7 @@ export const secretV2BridgeServiceFactory = ({
          projectId,
          folderId,
          actorId,
+          actorType: actor,
          tx
        })
      );
@@ -2469,6 +2483,7 @@ export const secretV2BridgeServiceFactory = ({
            tx,
            secretTagDAL,
            resourceMetadataDAL,
+            folderCommitService,
            secretVersionTagDAL,
            actor: {
              type: actor,
@@ -2495,6 +2510,7 @@ export const secretV2BridgeServiceFactory = ({
            folderId: destinationFolder.id,
            orgId: actorOrgId,
            resourceMetadataDAL,
+            folderCommitService,
            secretVersionDAL,
            secretDAL,
            tx,
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts
@@ -8,6 +8,7 @@ import { SecretsOrderBy } from "@app/services/secret/secret-types";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";

+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
@@ -178,6 +179,7 @@ export type TFnSecretBulkInsert = {
  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "find">;
  secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  actor?: {
    type: string;
    actorId: string;
@@ -206,6 +208,7 @@ export type TFnSecretBulkUpdate = {
  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
  secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  actor?: {
    type: string;
    actorId: string;
@@ -218,11 +221,14 @@ export type TFnSecretBulkDelete = {
  projectId: string;
  inputSecrets: Array<{ type: SecretType; secretKey: string }>;
  actorId: string;
+  actorType?: string;
  tx?: Knex;
  secretDAL: Pick<TSecretV2BridgeDALFactory, "deleteMany">;
  secretQueueService: {
    removeSecretReminder: (data: TRemoveSecretReminderDTO, tx?: Knex) => Promise<void>;
  };
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
+  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "findLatestVersionMany">;
 };

 export type THandleReminderDTO = {
--- a/backend/src/services/secret/secret-fns.ts
+++ b/backend/src/services/secret/secret-fns.ts
@@ -778,6 +778,7 @@ export const createManySecretsRawFnFactory = ({
  secretVersionV2BridgeDAL,
  secretV2BridgeDAL,
  secretVersionTagV2BridgeDAL,
+  folderCommitService,
  kmsService,
  resourceMetadataDAL
 }: TCreateManySecretsRawFnFactory) => {
@@ -850,6 +851,7 @@ export const createManySecretsRawFnFactory = ({
          secretVersionDAL: secretVersionV2BridgeDAL,
          secretTagDAL,
          secretVersionTagDAL: secretVersionTagV2BridgeDAL,
+          folderCommitService,
          tx
        })
      );
@@ -942,6 +944,7 @@ export const updateManySecretsRawFnFactory = ({
  secretVersionV2BridgeDAL,
  secretV2BridgeDAL,
  resourceMetadataDAL,
+  folderCommitService,
  kmsService
 }: TUpdateManySecretsRawFnFactory) => {
  const getBotKeyFn = getBotKeyFnFactory(projectBotDAL, projectDAL);
@@ -1032,7 +1035,8 @@ export const updateManySecretsRawFnFactory = ({
          secretDAL: secretV2BridgeDAL,
          secretVersionDAL: secretVersionV2BridgeDAL,
          secretTagDAL,
-          secretVersionTagDAL: secretVersionTagV2BridgeDAL
+          secretVersionTagDAL: secretVersionTagV2BridgeDAL,
+          folderCommitService
        })
      );

--- a/backend/src/services/secret/secret-queue.ts
+++ b/backend/src/services/secret/secret-queue.ts
@@ -35,6 +35,7 @@ import { TSecretSyncQueueFactory } from "@app/services/secret-sync/secret-sync-q
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";

 import { ActorType } from "../auth/auth-type";
+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TIntegrationDALFactory } from "../integration/integration-dal";
 import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal";
 import { TIntegrationAuthServiceFactory } from "../integration-auth/integration-auth-service";
@@ -112,6 +113,7 @@ type TSecretQueueFactoryDep = {
  orgService: Pick<TOrgServiceFactory, "addGhostUser">;
  projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "create">;
  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  secretReminderRecipientsDAL: Pick<
    TSecretReminderRecipientsDALFactory,
    "delete" | "findUsersBySecretId" | "insertMany" | "transaction"
@@ -178,7 +180,8 @@ export const secretQueueFactory = ({
  projectKeyDAL,
  resourceMetadataDAL,
  secretReminderRecipientsDAL,
-  secretSyncQueue
+  secretSyncQueue,
+  folderCommitService
 }: TSecretQueueFactoryDep) => {
  const integrationMeter = opentelemetry.metrics.getMeter("Integrations");
  const errorHistogram = integrationMeter.createHistogram("integration_secret_sync_errors", {
@@ -366,7 +369,8 @@ export const secretQueueFactory = ({
    secretVersionV2BridgeDAL,
    secretV2BridgeDAL,
    secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService
  });

  const updateManySecretsRawFn = updateManySecretsRawFnFactory({
@@ -382,7 +386,8 @@ export const secretQueueFactory = ({
    secretVersionV2BridgeDAL,
    secretV2BridgeDAL,
    secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL
+    resourceMetadataDAL,
+    folderCommitService
  });

  /**
--- a/backend/src/services/secret/secret-types.ts
+++ b/backend/src/services/secret/secret-types.ts
@@ -14,6 +14,7 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";

 import { ActorType } from "../auth/auth-type";
+import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
@@ -441,6 +442,7 @@ export type TCreateManySecretsRawFnFactory = {
  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
  secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 export type TCreateManySecretsRawFn = {
@@ -478,6 +480,7 @@ export type TUpdateManySecretsRawFnFactory = {
  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
  secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };

 export type TUpdateManySecretsRawFn = {