fix(folders): multiple folders being created

backend/src/db/migrations/20250618172150_increase-aws-arn-field-size.ts

@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.IdentityAwsAuth, "allowedPrincipalArns");
-  if (hasColumn) {
-    await knex.schema.alterTable(TableName.IdentityAwsAuth, (t) => {
-      t.string("allowedPrincipalArns", 2048).notNullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.IdentityAwsAuth, "allowedPrincipalArns");
-  if (hasColumn) {
-    await knex.schema.alterTable(TableName.IdentityAwsAuth, (t) => {
-      t.string("allowedPrincipalArns", 255).notNullable().alter();
-    });
-  }
-}

backend/src/ee/services/dynamic-secret/providers/kubernetes.ts

@@ -52,9 +52,8 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
       gatewayId: string;
       targetHost: string;
       targetPort: number;
-      caCert?: string;
+      httpsAgent?: https.Agent;
       reviewTokenThroughGateway: boolean;
-      enableSsl: boolean;
     },
     gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent) => Promise<T>
   ): Promise<T> => {
@@ -85,10 +84,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
           key: relayDetails.privateKey.toString()
         },
         // we always pass this, because its needed for both tcp and http protocol
-        httpsAgent: new https.Agent({
-          ca: inputs.caCert,
-          rejectUnauthorized: inputs.enableSsl
-        })
+        httpsAgent: inputs.httpsAgent
       }
     );
 
@@ -311,6 +307,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
     const k8sHost = `${url.protocol}//${url.hostname}`;
 
     try {
+      const httpsAgent =
+        providerInputs.ca && providerInputs.sslEnabled
+          ? new https.Agent({
+              ca: providerInputs.ca,
+              rejectUnauthorized: true
+            })
+          : undefined;
+
       if (providerInputs.gatewayId) {
         if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
           await $gatewayProxyWrapper(
@@ -318,8 +322,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: true
             },
             providerInputs.credentialType === KubernetesCredentialType.Static
@@ -332,8 +335,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sGatewayHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: false
             },
             providerInputs.credentialType === KubernetesCredentialType.Static
@@ -342,9 +344,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
           );
         }
       } else if (providerInputs.credentialType === KubernetesCredentialType.Static) {
-        await serviceAccountStaticCallback(k8sHost, k8sPort);
+        await serviceAccountStaticCallback(k8sHost, k8sPort, httpsAgent);
       } else {
-        await serviceAccountDynamicCallback(k8sHost, k8sPort);
+        await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
       }
 
       return true;
@@ -546,6 +548,15 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
 
     try {
       let tokenData;
+
+      const httpsAgent =
+        providerInputs.ca && providerInputs.sslEnabled
+          ? new https.Agent({
+              ca: providerInputs.ca,
+              rejectUnauthorized: true
+            })
+          : undefined;
+
       if (providerInputs.gatewayId) {
         if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
           tokenData = await $gatewayProxyWrapper(
@@ -553,8 +564,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: true
             },
             providerInputs.credentialType === KubernetesCredentialType.Static
@@ -567,8 +577,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sGatewayHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: false
             },
             providerInputs.credentialType === KubernetesCredentialType.Static
@@ -579,8 +588,8 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
       } else {
         tokenData =
           providerInputs.credentialType === KubernetesCredentialType.Static
-            ? await tokenRequestStaticCallback(k8sHost, k8sPort)
-            : await serviceAccountDynamicCallback(k8sHost, k8sPort);
+            ? await tokenRequestStaticCallback(k8sHost, k8sPort, httpsAgent)
+            : await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
       }
 
       return {
@@ -684,6 +693,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
       const k8sPort = url.port ? Number(url.port) : 443;
       const k8sHost = `${url.protocol}//${url.hostname}`;
 
+      const httpsAgent =
+        providerInputs.ca && providerInputs.sslEnabled
+          ? new https.Agent({
+              ca: providerInputs.ca,
+              rejectUnauthorized: true
+            })
+          : undefined;
+
       if (providerInputs.gatewayId) {
         if (providerInputs.authMethod === KubernetesAuthMethod.Gateway) {
           await $gatewayProxyWrapper(
@@ -691,8 +708,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: true
             },
             serviceAccountDynamicCallback
@@ -703,15 +719,14 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
               gatewayId: providerInputs.gatewayId,
               targetHost: k8sGatewayHost,
               targetPort: k8sPort,
-              enableSsl: providerInputs.sslEnabled,
-              caCert: providerInputs.ca,
+              httpsAgent,
               reviewTokenThroughGateway: false
             },
             serviceAccountDynamicCallback
           );
         }
       } else {
-        await serviceAccountDynamicCallback(k8sHost, k8sPort);
+        await serviceAccountDynamicCallback(k8sHost, k8sPort, httpsAgent);
       }
     }
 

backend/src/ee/services/permission/project-permission.ts

@@ -211,11 +211,6 @@ export type SecretFolderSubjectFields = {
   secretPath: string;
 };
 
-export type SecretSyncSubjectFields = {
-  environment: string;
-  secretPath: string;
-};
-
 export type DynamicSecretSubjectFields = {
   environment: string;
   secretPath: string;
@@ -272,10 +267,6 @@ export type ProjectPermissionSet =
         | (ForcedSubject<ProjectPermissionSub.DynamicSecrets> & DynamicSecretSubjectFields)
       )
     ]
-  | [
-      ProjectPermissionSecretSyncActions,
-      ProjectPermissionSub.SecretSyncs | (ForcedSubject<ProjectPermissionSub.SecretSyncs> & SecretSyncSubjectFields)
-    ]
   | [
       ProjectPermissionActions,
       (
@@ -332,6 +323,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.SshHostGroups]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
+  | [ProjectPermissionSecretSyncActions, ProjectPermissionSub.SecretSyncs]
   | [ProjectPermissionKmipActions, ProjectPermissionSub.Kmip]
   | [ProjectPermissionCmekActions, ProjectPermissionSub.Cmek]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
@@ -420,23 +412,6 @@ const DynamicSecretConditionV2Schema = z
   })
   .partial();
 
-const SecretSyncConditionV2Schema = z
-  .object({
-    environment: z.union([
-      z.string(),
-      z
-        .object({
-          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
-          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
-          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
-          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
-        })
-        .partial()
-    ]),
-    secretPath: SECRET_PATH_PERMISSION_OPERATOR_SCHEMA
-  })
-  .partial();
-
 const SecretImportConditionSchema = z
   .object({
     environment: z.union([
@@ -696,6 +671,12 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretSyncs).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretSyncActions).describe(
+      "Describe what action an entity can take."
+    )
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.Kmip).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionKmipActions).describe(
@@ -855,16 +836,6 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SecretSyncs).describe("The entity this permission pertains to."),
-    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretSyncActions).describe(
-      "Describe what action an entity can take."
-    ),
-    conditions: SecretSyncConditionV2Schema.describe(
-      "When specified, only matching conditions will be allowed to access given resource."
-    ).optional()
-  }),
 
   ...GeneralPermissionSchema
 ]);

backend/src/keystore/keystore.ts

@@ -44,7 +44,11 @@ export const KeyStorePrefixes = {
   IdentityAccessTokenStatusUpdate: (identityAccessTokenId: string) =>
     `identity-access-token-status:${identityAccessTokenId}`,
   ServiceTokenStatusUpdate: (serviceTokenId: string) => `service-token-status:${serviceTokenId}`,
-  GatewayIdentityCredential: (identityId: string) => `gateway-credentials:${identityId}`
+  GatewayIdentityCredential: (identityId: string) => `gateway-credentials:${identityId}`,
+
+  CreateFolderLock: (envId: string, projectId: string) => `folder-creation-${envId}-${projectId}` as const,
+  WaitUntilReadyCreateFolder: (envId: string, projectId: string) =>
+    `wait-until-ready-folder-creation-${envId}-${projectId}` as const
 };
 
 export const KeyStoreTtls = {

backend/src/lib/api-docs/constants.ts

@@ -2225,9 +2225,6 @@ export const AppConnections = {
     ONEPASS: {
       instanceUrl: "The URL of the 1Password Connect Server instance to authenticate with.",
       apiToken: "The API token used to access the 1Password Connect Server."
-    },
-    FLYIO: {
-      accessToken: "The Access Token used to access fly.io."
     }
   }
 };
@@ -2389,14 +2386,6 @@ export const SecretSyncs = {
     },
     ONEPASS: {
       vaultId: "The ID of the 1Password vault to sync secrets to."
-    },
-    RENDER: {
-      serviceId: "The ID of the Render service to sync secrets to.",
-      scope: "The Render scope that secrets should be synced to.",
-      type: "The Render resource type to sync secrets to."
-    },
-    FLYIO: {
-      appId: "The ID of the Fly.io app to sync secrets to."
     }
   }
 };

backend/src/server/routes/index.ts

@@ -1187,7 +1187,8 @@ export const registerRoutes = async (
     projectEnvDAL,
     snapshotService,
     projectDAL,
-    folderCommitService
+    folderCommitService,
+    keyStore
   });
 
   const secretImportService = secretImportServiceFactory({

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -39,7 +39,6 @@ import {
   DatabricksConnectionListItemSchema,
   SanitizedDatabricksConnectionSchema
 } from "@app/services/app-connection/databricks";
-import { FlyioConnectionListItemSchema, SanitizedFlyioConnectionSchema } from "@app/services/app-connection/flyio";
 import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
 import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
 import {
@@ -61,10 +60,6 @@ import {
   PostgresConnectionListItemSchema,
   SanitizedPostgresConnectionSchema
 } from "@app/services/app-connection/postgres";
-import {
-  RenderConnectionListItemSchema,
-  SanitizedRenderConnectionSchema
-} from "@app/services/app-connection/render/render-connection-schema";
 import {
   SanitizedTeamCityConnectionSchema,
   TeamCityConnectionListItemSchema
@@ -105,9 +100,7 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedTeamCityConnectionSchema.options,
   ...SanitizedOCIConnectionSchema.options,
   ...SanitizedOracleDBConnectionSchema.options,
-  ...SanitizedOnePassConnectionSchema.options,
-  ...SanitizedRenderConnectionSchema.options,
-  ...SanitizedFlyioConnectionSchema.options
+  ...SanitizedOnePassConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -134,9 +127,7 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   TeamCityConnectionListItemSchema,
   OCIConnectionListItemSchema,
   OracleDBConnectionListItemSchema,
-  OnePassConnectionListItemSchema,
-  RenderConnectionListItemSchema,
-  FlyioConnectionListItemSchema
+  OnePassConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/flyio-connection-router.ts

@@ -1,51 +0,0 @@
-import z from "zod";
-
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  CreateFlyioConnectionSchema,
-  SanitizedFlyioConnectionSchema,
-  UpdateFlyioConnectionSchema
-} from "@app/services/app-connection/flyio";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerFlyioConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.Flyio,
-    server,
-    sanitizedResponseSchema: SanitizedFlyioConnectionSchema,
-    createSchema: CreateFlyioConnectionSchema,
-    updateSchema: UpdateFlyioConnectionSchema
-  });
-
-  // The following endpoints are for internal Infisical App use only and not part of the public API
-  server.route({
-    method: "GET",
-    url: `/:connectionId/apps`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        connectionId: z.string().uuid()
-      }),
-      response: {
-        200: z
-          .object({
-            id: z.string(),
-            name: z.string()
-          })
-          .array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { connectionId } = req.params;
-      const apps = await server.services.appConnection.flyio.listApps(connectionId, req.permission);
-      return apps;
-    }
-  });
-};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -11,7 +11,6 @@ import { registerAzureDevOpsConnectionRouter } from "./azure-devops-connection-r
 import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
 import { registerCamundaConnectionRouter } from "./camunda-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
-import { registerFlyioConnectionRouter } from "./flyio-connection-router";
 import { registerGcpConnectionRouter } from "./gcp-connection-router";
 import { registerGitHubConnectionRouter } from "./github-connection-router";
 import { registerGitHubRadarConnectionRouter } from "./github-radar-connection-router";
@@ -21,7 +20,6 @@ import { registerLdapConnectionRouter } from "./ldap-connection-router";
 import { registerMsSqlConnectionRouter } from "./mssql-connection-router";
 import { registerMySqlConnectionRouter } from "./mysql-connection-router";
 import { registerPostgresConnectionRouter } from "./postgres-connection-router";
-import { registerRenderConnectionRouter } from "./render-connection-router";
 import { registerTeamCityConnectionRouter } from "./teamcity-connection-router";
 import { registerTerraformCloudConnectionRouter } from "./terraform-cloud-router";
 import { registerVercelConnectionRouter } from "./vercel-connection-router";
@@ -54,7 +52,5 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.TeamCity]: registerTeamCityConnectionRouter,
     [AppConnection.OCI]: registerOCIConnectionRouter,
     [AppConnection.OracleDB]: registerOracleDBConnectionRouter,
-    [AppConnection.OnePass]: registerOnePassConnectionRouter,
-    [AppConnection.Render]: registerRenderConnectionRouter,
-    [AppConnection.Flyio]: registerFlyioConnectionRouter
+    [AppConnection.OnePass]: registerOnePassConnectionRouter
   };

backend/src/server/routes/v1/app-connection-routers/render-connection-router.ts

@@ -1,52 +0,0 @@
-import z from "zod";
-
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  CreateRenderConnectionSchema,
-  SanitizedRenderConnectionSchema,
-  UpdateRenderConnectionSchema
-} from "@app/services/app-connection/render/render-connection-schema";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerRenderConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.Render,
-    server,
-    sanitizedResponseSchema: SanitizedRenderConnectionSchema,
-    createSchema: CreateRenderConnectionSchema,
-    updateSchema: UpdateRenderConnectionSchema
-  });
-
-  // The below endpoints are not exposed and for Infisical App use
-  server.route({
-    method: "GET",
-    url: `/:connectionId/services`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        connectionId: z.string().uuid()
-      }),
-      response: {
-        200: z
-          .object({
-            id: z.string(),
-            name: z.string()
-          })
-          .array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { connectionId } = req.params;
-      const services = await server.services.appConnection.render.listServices(connectionId, req.permission);
-
-      return services;
-    }
-  });
-};

backend/src/server/routes/v1/secret-sync-routers/flyio-sync-router.ts

@@ -1,13 +0,0 @@
-import { CreateFlyioSyncSchema, FlyioSyncSchema, UpdateFlyioSyncSchema } from "@app/services/secret-sync/flyio";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerFlyioSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.Flyio,
-    server,
-    responseSchema: FlyioSyncSchema,
-    createSchema: CreateFlyioSyncSchema,
-    updateSchema: UpdateFlyioSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -9,12 +9,10 @@ import { registerAzureDevOpsSyncRouter } from "./azure-devops-sync-router";
 import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
 import { registerCamundaSyncRouter } from "./camunda-sync-router";
 import { registerDatabricksSyncRouter } from "./databricks-sync-router";
-import { registerFlyioSyncRouter } from "./flyio-sync-router";
 import { registerGcpSyncRouter } from "./gcp-sync-router";
 import { registerGitHubSyncRouter } from "./github-sync-router";
 import { registerHCVaultSyncRouter } from "./hc-vault-sync-router";
 import { registerHumanitecSyncRouter } from "./humanitec-sync-router";
-import { registerRenderSyncRouter } from "./render-sync-router";
 import { registerTeamCitySyncRouter } from "./teamcity-sync-router";
 import { registerTerraformCloudSyncRouter } from "./terraform-cloud-sync-router";
 import { registerVercelSyncRouter } from "./vercel-sync-router";
@@ -39,7 +37,5 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
   [SecretSync.HCVault]: registerHCVaultSyncRouter,
   [SecretSync.TeamCity]: registerTeamCitySyncRouter,
   [SecretSync.OCIVault]: registerOCIVaultSyncRouter,
-  [SecretSync.OnePass]: registerOnePassSyncRouter,
-  [SecretSync.Render]: registerRenderSyncRouter,
-  [SecretSync.Flyio]: registerFlyioSyncRouter
+  [SecretSync.OnePass]: registerOnePassSyncRouter
 };

backend/src/server/routes/v1/secret-sync-routers/render-sync-router.ts

@@ -1,17 +0,0 @@
-import {
-  CreateRenderSyncSchema,
-  RenderSyncSchema,
-  UpdateRenderSyncSchema
-} from "@app/services/secret-sync/render/render-sync-schemas";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerRenderSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.Render,
-    server,
-    responseSchema: RenderSyncSchema,
-    createSchema: CreateRenderSyncSchema,
-    updateSchema: UpdateRenderSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -23,12 +23,10 @@ import { AzureDevOpsSyncListItemSchema, AzureDevOpsSyncSchema } from "@app/servi
 import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/services/secret-sync/azure-key-vault";
 import { CamundaSyncListItemSchema, CamundaSyncSchema } from "@app/services/secret-sync/camunda";
 import { DatabricksSyncListItemSchema, DatabricksSyncSchema } from "@app/services/secret-sync/databricks";
-import { FlyioSyncListItemSchema, FlyioSyncSchema } from "@app/services/secret-sync/flyio";
 import { GcpSyncListItemSchema, GcpSyncSchema } from "@app/services/secret-sync/gcp";
 import { GitHubSyncListItemSchema, GitHubSyncSchema } from "@app/services/secret-sync/github";
 import { HCVaultSyncListItemSchema, HCVaultSyncSchema } from "@app/services/secret-sync/hc-vault";
 import { HumanitecSyncListItemSchema, HumanitecSyncSchema } from "@app/services/secret-sync/humanitec";
-import { RenderSyncListItemSchema, RenderSyncSchema } from "@app/services/secret-sync/render/render-sync-schemas";
 import { TeamCitySyncListItemSchema, TeamCitySyncSchema } from "@app/services/secret-sync/teamcity";
 import { TerraformCloudSyncListItemSchema, TerraformCloudSyncSchema } from "@app/services/secret-sync/terraform-cloud";
 import { VercelSyncListItemSchema, VercelSyncSchema } from "@app/services/secret-sync/vercel";
@@ -51,9 +49,7 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
   HCVaultSyncSchema,
   TeamCitySyncSchema,
   OCIVaultSyncSchema,
-  OnePassSyncSchema,
-  RenderSyncSchema,
-  FlyioSyncSchema
+  OnePassSyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
@@ -73,9 +69,7 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   HCVaultSyncListItemSchema,
   TeamCitySyncListItemSchema,
   OCIVaultSyncListItemSchema,
-  OnePassSyncListItemSchema,
-  RenderSyncListItemSchema,
-  FlyioSyncListItemSchema
+  OnePassSyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {

backend/src/services/app-connection/app-connection-enums.ts

@@ -22,9 +22,7 @@ export enum AppConnection {
   TeamCity = "teamcity",
   OCI = "oci",
   OracleDB = "oracledb",
-  OnePass = "1password",
-  Render = "render",
-  Flyio = "flyio"
+  OnePass = "1password"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -56,7 +56,6 @@ import {
   getDatabricksConnectionListItem,
   validateDatabricksConnectionCredentials
 } from "./databricks";
-import { FlyioConnectionMethod, getFlyioConnectionListItem, validateFlyioConnectionCredentials } from "./flyio";
 import { GcpConnectionMethod, getGcpConnectionListItem, validateGcpConnectionCredentials } from "./gcp";
 import { getGitHubConnectionListItem, GitHubConnectionMethod, validateGitHubConnectionCredentials } from "./github";
 import {
@@ -79,8 +78,6 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
 import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
 import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
-import { RenderConnectionMethod } from "./render/render-connection-enums";
-import { getRenderConnectionListItem, validateRenderConnectionCredentials } from "./render/render-connection-fns";
 import {
   getTeamCityConnectionListItem,
   TeamCityConnectionMethod,
@@ -124,9 +121,7 @@ export const listAppConnectionOptions = () => {
     getTeamCityConnectionListItem(),
     getOCIConnectionListItem(),
     getOracleDBConnectionListItem(),
-    getOnePassConnectionListItem(),
-    getRenderConnectionListItem(),
-    getFlyioConnectionListItem()
+    getOnePassConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -201,9 +196,7 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.TeamCity]: validateTeamCityConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.OCI]: validateOCIConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.OracleDB]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.OnePass]: validateOnePassConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Render]: validateRenderConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Flyio]: validateFlyioConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.OnePass]: validateOnePassConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
@@ -245,7 +238,6 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case HCVaultConnectionMethod.AccessToken:
     case TeamCityConnectionMethod.AccessToken:
     case AzureDevOpsConnectionMethod.AccessToken:
-    case FlyioConnectionMethod.AccessToken:
       return "Access Token";
     case Auth0ConnectionMethod.ClientCredentials:
       return "Client Credentials";
@@ -253,8 +245,6 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
       return "App Role";
     case LdapConnectionMethod.SimpleBind:
       return "Simple Bind";
-    case RenderConnectionMethod.ApiKey:
-      return "API Key";
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection Method: ${method}`);
@@ -309,9 +299,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.TeamCity]: platformManagedCredentialsNotSupported,
   [AppConnection.OCI]: platformManagedCredentialsNotSupported,
   [AppConnection.OracleDB]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
-  [AppConnection.OnePass]: platformManagedCredentialsNotSupported,
-  [AppConnection.Render]: platformManagedCredentialsNotSupported,
-  [AppConnection.Flyio]: platformManagedCredentialsNotSupported
+  [AppConnection.OnePass]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (

backend/src/services/app-connection/app-connection-maps.ts

@@ -24,9 +24,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.TeamCity]: "TeamCity",
   [AppConnection.OCI]: "OCI",
   [AppConnection.OracleDB]: "OracleDB",
-  [AppConnection.OnePass]: "1Password",
-  [AppConnection.Render]: "Render",
-  [AppConnection.Flyio]: "Fly.io"
+  [AppConnection.OnePass]: "1Password"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -53,7 +51,5 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.OCI]: AppConnectionPlanType.Enterprise,
   [AppConnection.OracleDB]: AppConnectionPlanType.Enterprise,
   [AppConnection.OnePass]: AppConnectionPlanType.Regular,
-  [AppConnection.MySql]: AppConnectionPlanType.Regular,
-  [AppConnection.Render]: AppConnectionPlanType.Regular,
-  [AppConnection.Flyio]: AppConnectionPlanType.Regular
+  [AppConnection.MySql]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -49,8 +49,6 @@ import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
 import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
 import { databricksConnectionService } from "./databricks/databricks-connection-service";
-import { ValidateFlyioConnectionCredentialsSchema } from "./flyio";
-import { flyioConnectionService } from "./flyio/flyio-connection-service";
 import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
 import { gcpConnectionService } from "./gcp/gcp-connection-service";
 import { ValidateGitHubConnectionCredentialsSchema } from "./github";
@@ -64,8 +62,6 @@ import { ValidateLdapConnectionCredentialsSchema } from "./ldap";
 import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
 import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
-import { ValidateRenderConnectionCredentialsSchema } from "./render/render-connection-schema";
-import { renderConnectionService } from "./render/render-connection-service";
 import { ValidateTeamCityConnectionCredentialsSchema } from "./teamcity";
 import { teamcityConnectionService } from "./teamcity/teamcity-connection-service";
 import { ValidateTerraformCloudConnectionCredentialsSchema } from "./terraform-cloud";
@@ -108,9 +104,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.TeamCity]: ValidateTeamCityConnectionCredentialsSchema,
   [AppConnection.OCI]: ValidateOCIConnectionCredentialsSchema,
   [AppConnection.OracleDB]: ValidateOracleDBConnectionCredentialsSchema,
-  [AppConnection.OnePass]: ValidateOnePassConnectionCredentialsSchema,
-  [AppConnection.Render]: ValidateRenderConnectionCredentialsSchema,
-  [AppConnection.Flyio]: ValidateFlyioConnectionCredentialsSchema
+  [AppConnection.OnePass]: ValidateOnePassConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -515,8 +509,6 @@ export const appConnectionServiceFactory = ({
     windmill: windmillConnectionService(connectAppConnectionById),
     teamcity: teamcityConnectionService(connectAppConnectionById),
     oci: ociConnectionService(connectAppConnectionById, licenseService),
-    onepass: onePassConnectionService(connectAppConnectionById),
-    render: renderConnectionService(connectAppConnectionById),
-    flyio: flyioConnectionService(connectAppConnectionById)
+    onepass: onePassConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -68,12 +68,6 @@ import {
   TDatabricksConnectionInput,
   TValidateDatabricksConnectionCredentialsSchema
 } from "./databricks";
-import {
-  TFlyioConnection,
-  TFlyioConnectionConfig,
-  TFlyioConnectionInput,
-  TValidateFlyioConnectionCredentialsSchema
-} from "./flyio";
 import {
   TGcpConnection,
   TGcpConnectionConfig,
@@ -117,12 +111,6 @@ import {
   TPostgresConnectionInput,
   TValidatePostgresConnectionCredentialsSchema
 } from "./postgres";
-import {
-  TRenderConnection,
-  TRenderConnectionConfig,
-  TRenderConnectionInput,
-  TValidateRenderConnectionCredentialsSchema
-} from "./render/render-connection-types";
 import {
   TTeamCityConnection,
   TTeamCityConnectionConfig,
@@ -173,8 +161,6 @@ export type TAppConnection = { id: string } & (
   | TOCIConnection
   | TOracleDBConnection
   | TOnePassConnection
-  | TRenderConnection
-  | TFlyioConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -206,8 +192,6 @@ export type TAppConnectionInput = { id: string } & (
   | TOCIConnectionInput
   | TOracleDBConnectionInput
   | TOnePassConnectionInput
-  | TRenderConnectionInput
-  | TFlyioConnectionInput
 );
 
 export type TSqlConnectionInput =
@@ -246,9 +230,7 @@ export type TAppConnectionConfig =
   | TLdapConnectionConfig
   | TTeamCityConnectionConfig
   | TOCIConnectionConfig
-  | TOnePassConnectionConfig
-  | TRenderConnectionConfig
-  | TFlyioConnectionConfig;
+  | TOnePassConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -274,9 +256,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateTeamCityConnectionCredentialsSchema
   | TValidateOCIConnectionCredentialsSchema
   | TValidateOracleDBConnectionCredentialsSchema
-  | TValidateOnePassConnectionCredentialsSchema
-  | TValidateRenderConnectionCredentialsSchema
-  | TValidateFlyioConnectionCredentialsSchema;
+  | TValidateOnePassConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/flyio/flyio-connection-enums.ts

@@ -1,3 +0,0 @@
-export enum FlyioConnectionMethod {
-  AccessToken = "access-token"
-}

backend/src/services/app-connection/flyio/flyio-connection-fns.ts

@@ -1,72 +0,0 @@
-import { AxiosError } from "axios";
-
-import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
-
-import { FlyioConnectionMethod } from "./flyio-connection-enums";
-import { TFlyioApp, TFlyioConnection, TFlyioConnectionConfig } from "./flyio-connection-types";
-
-export const getFlyioConnectionListItem = () => {
-  return {
-    name: "Fly.io" as const,
-    app: AppConnection.Flyio as const,
-    methods: Object.values(FlyioConnectionMethod) as [FlyioConnectionMethod.AccessToken]
-  };
-};
-
-export const validateFlyioConnectionCredentials = async (config: TFlyioConnectionConfig) => {
-  const { accessToken } = config.credentials;
-
-  try {
-    const resp = await request.post<{ data: { viewer: { id: string | null; email: string } } | null }>(
-      IntegrationUrls.FLYIO_API_URL,
-      { query: "query { viewer { id email } }" },
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json"
-        }
-      }
-    );
-
-    if (resp.data.data === null) {
-      throw new BadRequestError({
-        message: "Unable to validate connection: Invalid access token provided."
-      });
-    }
-  } catch (error: unknown) {
-    if (error instanceof AxiosError) {
-      throw new BadRequestError({
-        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
-      });
-    }
-    throw new BadRequestError({
-      message: "Unable to validate connection: verify credentials"
-    });
-  }
-
-  return config.credentials;
-};
-
-export const listFlyioApps = async (appConnection: TFlyioConnection) => {
-  const { accessToken } = appConnection.credentials;
-
-  const resp = await request.post<{ data: { apps: { nodes: TFlyioApp[] } } }>(
-    IntegrationUrls.FLYIO_API_URL,
-    {
-      query:
-        "query GetApps { apps { nodes { id name hostname status organization { id slug } currentRelease { version status createdAt } } } }"
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
-        Accept: "application/json"
-      }
-    }
-  );
-
-  return resp.data.data.apps.nodes;
-};

backend/src/services/app-connection/flyio/flyio-connection-schemas.ts

@@ -1,62 +0,0 @@
-import z from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { FlyioConnectionMethod } from "./flyio-connection-enums";
-
-export const FlyioConnectionAccessTokenCredentialsSchema = z.object({
-  accessToken: z
-    .string()
-    .trim()
-    .min(1, "Access Token required")
-    .max(1000)
-    .startsWith("FlyV1", "Token must start with 'FlyV1'")
-    .describe(AppConnections.CREDENTIALS.FLYIO.accessToken)
-});
-
-const BaseFlyioConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Flyio) });
-
-export const FlyioConnectionSchema = BaseFlyioConnectionSchema.extend({
-  method: z.literal(FlyioConnectionMethod.AccessToken),
-  credentials: FlyioConnectionAccessTokenCredentialsSchema
-});
-
-export const SanitizedFlyioConnectionSchema = z.discriminatedUnion("method", [
-  BaseFlyioConnectionSchema.extend({
-    method: z.literal(FlyioConnectionMethod.AccessToken),
-    credentials: FlyioConnectionAccessTokenCredentialsSchema.pick({})
-  })
-]);
-
-export const ValidateFlyioConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(FlyioConnectionMethod.AccessToken).describe(AppConnections.CREATE(AppConnection.Flyio).method),
-    credentials: FlyioConnectionAccessTokenCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.Flyio).credentials
-    )
-  })
-]);
-
-export const CreateFlyioConnectionSchema = ValidateFlyioConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.Flyio)
-);
-
-export const UpdateFlyioConnectionSchema = z
-  .object({
-    credentials: FlyioConnectionAccessTokenCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.Flyio).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Flyio));
-
-export const FlyioConnectionListItemSchema = z.object({
-  name: z.literal("Fly.io"),
-  app: z.literal(AppConnection.Flyio),
-  methods: z.nativeEnum(FlyioConnectionMethod).array()
-});

backend/src/services/app-connection/flyio/flyio-connection-service.ts

@@ -1,30 +0,0 @@
-import { logger } from "@app/lib/logger";
-import { OrgServiceActor } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import { listFlyioApps } from "./flyio-connection-fns";
-import { TFlyioConnection } from "./flyio-connection-types";
-
-type TGetAppConnectionFunc = (
-  app: AppConnection,
-  connectionId: string,
-  actor: OrgServiceActor
-) => Promise<TFlyioConnection>;
-
-export const flyioConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
-  const listApps = async (connectionId: string, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.Flyio, connectionId, actor);
-
-    try {
-      const apps = await listFlyioApps(appConnection);
-      return apps;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with fly.io");
-      return [];
-    }
-  };
-
-  return {
-    listApps
-  };
-};

backend/src/services/app-connection/flyio/flyio-connection-types.ts

@@ -1,27 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  CreateFlyioConnectionSchema,
-  FlyioConnectionSchema,
-  ValidateFlyioConnectionCredentialsSchema
-} from "./flyio-connection-schemas";
-
-export type TFlyioConnection = z.infer<typeof FlyioConnectionSchema>;
-
-export type TFlyioConnectionInput = z.infer<typeof CreateFlyioConnectionSchema> & {
-  app: AppConnection.Flyio;
-};
-
-export type TValidateFlyioConnectionCredentialsSchema = typeof ValidateFlyioConnectionCredentialsSchema;
-
-export type TFlyioConnectionConfig = DiscriminativePick<TFlyioConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};
-
-export type TFlyioApp = {
-  id: string;
-  name: string;
-};

backend/src/services/app-connection/flyio/index.ts

@@ -1,4 +0,0 @@
-export * from "./flyio-connection-enums";
-export * from "./flyio-connection-fns";
-export * from "./flyio-connection-schemas";
-export * from "./flyio-connection-types";

backend/src/services/app-connection/render/render-connection-enums.ts

@@ -1,3 +0,0 @@
-export enum RenderConnectionMethod {
-  ApiKey = "api-key"
-}

backend/src/services/app-connection/render/render-connection-fns.ts

@@ -1,88 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import { AxiosError } from "axios";
-
-import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
-import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
-
-import { AppConnection } from "../app-connection-enums";
-import { RenderConnectionMethod } from "./render-connection-enums";
-import {
-  TRawRenderService,
-  TRenderConnection,
-  TRenderConnectionConfig,
-  TRenderService
-} from "./render-connection-types";
-
-export const getRenderConnectionListItem = () => {
-  return {
-    name: "Render" as const,
-    app: AppConnection.Render as const,
-    methods: Object.values(RenderConnectionMethod) as [RenderConnectionMethod.ApiKey]
-  };
-};
-
-export const listRenderServices = async (appConnection: TRenderConnection): Promise<TRenderService[]> => {
-  const {
-    credentials: { apiKey }
-  } = appConnection;
-
-  const services: TRenderService[] = [];
-  let hasMorePages = true;
-  const perPage = 100;
-  let cursor;
-
-  while (hasMorePages) {
-    const res: TRawRenderService[] = (
-      await request.get<TRawRenderService[]>(`${IntegrationUrls.RENDER_API_URL}/v1/services`, {
-        params: new URLSearchParams({
-          ...(cursor ? { cursor: String(cursor) } : {}),
-          limit: String(perPage)
-        }),
-        headers: {
-          Authorization: `Bearer ${apiKey}`,
-          Accept: "application/json",
-          "Accept-Encoding": "application/json"
-        }
-      })
-    ).data;
-
-    res.forEach((item) => {
-      services.push({
-        name: item.service.name,
-        id: item.service.id
-      });
-    });
-
-    if (res.length < perPage) {
-      hasMorePages = false;
-    } else {
-      cursor = res[res.length - 1].cursor;
-    }
-  }
-
-  return services;
-};
-
-export const validateRenderConnectionCredentials = async (config: TRenderConnectionConfig) => {
-  const { credentials: inputCredentials } = config;
-
-  try {
-    await request.get(`${IntegrationUrls.RENDER_API_URL}/v1/users`, {
-      headers: {
-        Authorization: `Bearer ${inputCredentials.apiKey}`
-      }
-    });
-  } catch (error: unknown) {
-    if (error instanceof AxiosError) {
-      throw new BadRequestError({
-        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
-      });
-    }
-    throw new BadRequestError({
-      message: "Unable to validate connection: verify credentials"
-    });
-  }
-
-  return inputCredentials;
-};

backend/src/services/app-connection/render/render-connection-schema.ts

@@ -1,56 +0,0 @@
-import z from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { RenderConnectionMethod } from "./render-connection-enums";
-
-export const RenderConnectionApiKeyCredentialsSchema = z.object({
-  apiKey: z.string().trim().min(1, "API key required").max(256, "API key cannot exceed 256 characters")
-});
-
-const BaseRenderConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Render) });
-
-export const RenderConnectionSchema = BaseRenderConnectionSchema.extend({
-  method: z.literal(RenderConnectionMethod.ApiKey),
-  credentials: RenderConnectionApiKeyCredentialsSchema
-});
-
-export const SanitizedRenderConnectionSchema = z.discriminatedUnion("method", [
-  BaseRenderConnectionSchema.extend({
-    method: z.literal(RenderConnectionMethod.ApiKey),
-    credentials: RenderConnectionApiKeyCredentialsSchema.pick({})
-  })
-]);
-
-export const ValidateRenderConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(RenderConnectionMethod.ApiKey).describe(AppConnections.CREATE(AppConnection.Render).method),
-    credentials: RenderConnectionApiKeyCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.Render).credentials
-    )
-  })
-]);
-
-export const CreateRenderConnectionSchema = ValidateRenderConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.Render)
-);
-
-export const UpdateRenderConnectionSchema = z
-  .object({
-    credentials: RenderConnectionApiKeyCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.Render).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Render));
-
-export const RenderConnectionListItemSchema = z.object({
-  name: z.literal("Render"),
-  app: z.literal(AppConnection.Render),
-  methods: z.nativeEnum(RenderConnectionMethod).array()
-});

backend/src/services/app-connection/render/render-connection-service.ts

@@ -1,30 +0,0 @@
-import { logger } from "@app/lib/logger";
-import { OrgServiceActor } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import { listRenderServices } from "./render-connection-fns";
-import { TRenderConnection } from "./render-connection-types";
-
-type TGetAppConnectionFunc = (
-  app: AppConnection,
-  connectionId: string,
-  actor: OrgServiceActor
-) => Promise<TRenderConnection>;
-
-export const renderConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
-  const listServices = async (connectionId: string, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.Render, connectionId, actor);
-    try {
-      const services = await listRenderServices(appConnection);
-
-      return services;
-    } catch (error) {
-      logger.error(error, "Failed to list services for Render connection");
-      return [];
-    }
-  };
-
-  return {
-    listServices
-  };
-};

backend/src/services/app-connection/render/render-connection-types.ts

@@ -1,35 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  CreateRenderConnectionSchema,
-  RenderConnectionSchema,
-  ValidateRenderConnectionCredentialsSchema
-} from "./render-connection-schema";
-
-export type TRenderConnection = z.infer<typeof RenderConnectionSchema>;
-
-export type TRenderConnectionInput = z.infer<typeof CreateRenderConnectionSchema> & {
-  app: AppConnection.Render;
-};
-
-export type TValidateRenderConnectionCredentialsSchema = typeof ValidateRenderConnectionCredentialsSchema;
-
-export type TRenderConnectionConfig = DiscriminativePick<TRenderConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};
-
-export type TRenderService = {
-  name: string;
-  id: string;
-};
-
-export type TRawRenderService = {
-  cursor: string;
-  service: {
-    id: string;
-    name: string;
-  };
-};

backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts

@@ -9,7 +9,6 @@ const arnRegex = new RE2(/^arn:aws:iam::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/
 export const validateAccountIds = z
   .string()
   .trim()
-  .max(2048)
   .default("")
   // Custom validation to ensure each part is a 12-digit number
   .refine(
@@ -37,7 +36,6 @@ export const validateAccountIds = z
 export const validatePrincipalArns = z
   .string()
   .trim()
-  .max(2048)
   .default("")
   // Custom validation for ARN format
   .refine(

backend/src/services/secret-folder/secret-folder-service.ts

@@ -6,7 +6,9 @@ import { ActionProjectType, TSecretFoldersInsert } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
+import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
 import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 
@@ -33,6 +35,7 @@ type TSecretFolderServiceFactoryDep = {
   folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestFolderVersions" | "create" | "insertMany" | "find">;
   folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
+  keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem" | "waitTillReady">;
 };
 
 export type TSecretFolderServiceFactory = ReturnType<typeof secretFolderServiceFactory>;
@@ -44,7 +47,8 @@ export const secretFolderServiceFactory = ({
   projectEnvDAL,
   folderVersionDAL,
   folderCommitService,
-  projectDAL
+  projectDAL,
+  keyStore
 }: TSecretFolderServiceFactoryDep) => {
   const createFolder = async ({
     projectId,
@@ -78,110 +82,169 @@ export const secretFolderServiceFactory = ({
       });
     }
 
-    const folder = await folderDAL.transaction(async (tx) => {
-      // the logic is simple we need to avoid creating same folder in same path multiple times
-      // that is this request must be idempotent
-      // so we do a tricky move. we try to find the to be created folder path if that is exactly match return that
-      // else we get some path before that then we will start creating remaining folder
-      const pathWithFolder = path.join(secretPath, name);
-      const parentFolder = await folderDAL.findClosestFolder(projectId, environment, pathWithFolder, tx);
-      // no folder found is not possible root should be their
-      if (!parentFolder) {
-        throw new NotFoundError({
-          message: `Folder with path '${pathWithFolder}' in environment with slug '${environment}' not found`
+    const lock = await keyStore
+      .acquireLock([KeyStorePrefixes.CreateFolderLock(env.id, projectId)], 5000)
+      .catch(() => null);
+
+    try {
+      if (!lock) {
+        await keyStore.waitTillReady({
+          key: KeyStorePrefixes.WaitUntilReadyCreateFolder(env.id, projectId),
+          keyCheckCb: (val) => val === "true",
+          waitingCb: () => logger.debug("CreateFolder: Waiting for key store lock."),
+          delay: 500
         });
       }
-      // exact folder
-      if (parentFolder.path === pathWithFolder) return parentFolder;
 
-      let parentFolderId = parentFolder.id;
-      if (parentFolder.path !== secretPath) {
-        // this is upsert folder in a path
-        // we are not taking snapshots of this because
-        // snapshot will be removed from automatic for all commits to user click or cron based
-        const missingSegment = secretPath.substring(parentFolder.path.length).split("/").filter(Boolean);
-        if (missingSegment.length) {
-          const newFolders: Array<TSecretFoldersInsert & { id: string }> = missingSegment.map((segment) => {
-            const newFolder = {
-              name: segment,
-              parentId: parentFolderId,
-              id: uuidv4(),
-              envId: env.id,
-              version: 1
-            };
-            parentFolderId = newFolder.id;
-            return newFolder;
+      const folder = await folderDAL.transaction(async (tx) => {
+        const pathWithFolder = path.join(secretPath, name);
+        const parentFolder = await folderDAL.findClosestFolder(projectId, environment, pathWithFolder, tx);
+
+        if (!parentFolder) {
+          throw new NotFoundError({
+            message: `Parent folder for path '${pathWithFolder}' not found`
           });
-          parentFolderId = newFolders.at(-1)?.id as string;
-          const docs = await folderDAL.insertMany(newFolders, tx);
-          const folderVersions = await folderVersionDAL.insertMany(
-            docs.map((doc) => ({
-              name: doc.name,
-              envId: doc.envId,
-              version: doc.version,
-              folderId: doc.id,
-              description: doc.description
-            })),
-            tx
-          );
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: actor,
-                metadata: {
-                  id: actorId
-                }
-              },
-              message: "Folder created",
-              folderId: parentFolderId,
-              changes: folderVersions.map((fv) => ({
-                type: CommitType.ADD,
-                folderVersionId: fv.id
-              }))
-            },
-            tx
-          );
         }
-      }
 
-      const doc = await folderDAL.create(
-        { name, envId: env.id, version: 1, parentId: parentFolderId, description },
-        tx
-      );
-      const folderVersion = await folderVersionDAL.create(
-        {
-          name: doc.name,
-          envId: doc.envId,
-          version: doc.version,
-          folderId: doc.id,
-          description: doc.description
-        },
-        tx
-      );
-      await folderCommitService.createCommit(
-        {
-          actor: {
-            type: actor,
-            metadata: {
-              id: actorId
-            }
+        // check if the exact folder already exists
+        const existingFolder = await folderDAL.findOne(
+          {
+            envId: env.id,
+            parentId: parentFolder.id,
+            name,
+            isReserved: false
           },
-          message: "Folder created",
-          folderId: parentFolderId,
-          changes: [
-            {
-              type: CommitType.ADD,
-              folderVersionId: folderVersion.id
-            }
-          ]
-        },
-        tx
-      );
-      return doc;
-    });
+          tx
+        );
 
-    await snapshotService.performSnapshot(folder.parentId as string);
-    return folder;
+        if (existingFolder) {
+          return existingFolder;
+        }
+
+        // exact folder case
+        if (parentFolder.path === pathWithFolder) {
+          return parentFolder;
+        }
+
+        let currentParentId = parentFolder.id;
+        let currentPath = parentFolder.path;
+
+        // build the full path we need by processing each segment
+        if (parentFolder.path !== secretPath) {
+          const missingSegments = secretPath.substring(parentFolder.path.length).split("/").filter(Boolean);
+
+          const newFolders: TSecretFoldersInsert[] = [];
+
+          // process each segment sequentially
+          for (const segment of missingSegments) {
+            // eslint-disable-next-line no-await-in-loop
+            const existingSegment = await folderDAL.findOne(
+              {
+                name: segment,
+                parentId: currentParentId,
+                envId: env.id,
+                isReserved: false
+              },
+              tx
+            );
+
+            if (existingSegment) {
+              // use existing folder and update the path / parent
+              currentParentId = existingSegment.id;
+              currentPath = path.join(currentPath, segment);
+            } else {
+              const newFolder = {
+                name: segment,
+                parentId: currentParentId,
+                id: uuidv4(),
+                envId: env.id,
+                version: 1
+              };
+
+              currentParentId = newFolder.id;
+              currentPath = path.join(currentPath, segment);
+              newFolders.push(newFolder);
+            }
+          }
+
+          if (newFolders.length) {
+            const docs = await folderDAL.insertMany(newFolders, tx);
+            const folderVersions = await folderVersionDAL.insertMany(
+              docs.map((doc) => ({
+                name: doc.name,
+                envId: doc.envId,
+                version: doc.version,
+                folderId: doc.id,
+                description: doc.description
+              })),
+              tx
+            );
+            await folderCommitService.createCommit(
+              {
+                actor: {
+                  type: actor,
+                  metadata: {
+                    id: actorId
+                  }
+                },
+                message: "Folder created",
+                folderId: currentParentId,
+                changes: folderVersions.map((fv) => ({
+                  type: CommitType.ADD,
+                  folderVersionId: fv.id
+                }))
+              },
+              tx
+            );
+          }
+        }
+
+        const doc = await folderDAL.create(
+          { name, envId: env.id, version: 1, parentId: currentParentId, description },
+          tx
+        );
+
+        const folderVersion = await folderVersionDAL.create(
+          {
+            name: doc.name,
+            envId: doc.envId,
+            version: doc.version,
+            folderId: doc.id,
+            description: doc.description
+          },
+          tx
+        );
+
+        await folderCommitService.createCommit(
+          {
+            actor: {
+              type: actor,
+              metadata: {
+                id: actorId
+              }
+            },
+            message: "Folder created",
+            folderId: doc.id,
+            changes: [
+              {
+                type: CommitType.ADD,
+                folderVersionId: folderVersion.id
+              }
+            ]
+          },
+          tx
+        );
+
+        return doc;
+      });
+
+      await keyStore.setItemWithExpiry(KeyStorePrefixes.WaitUntilReadyCreateFolder(env.id, projectId), 10, "true");
+
+      await snapshotService.performSnapshot(folder.parentId as string);
+      return folder;
+    } finally {
+      await lock?.release();
+    }
   };
 
   const updateManyFolders = async ({

backend/src/services/secret-sync/flyio/flyio-sync-constants.ts

@@ -1,10 +0,0 @@
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
-
-export const FLYIO_SYNC_LIST_OPTION: TSecretSyncListItem = {
-  name: "Fly.io",
-  destination: SecretSync.Flyio,
-  connection: AppConnection.Flyio,
-  canImportSecrets: false
-};

backend/src/services/secret-sync/flyio/flyio-sync-fns.ts

@@ -1,133 +0,0 @@
-import { request } from "@app/lib/config/request";
-import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
-import {
-  TDeleteFlyioVariable,
-  TFlyioListVariables,
-  TFlyioSecret,
-  TFlyioSyncWithCredentials,
-  TPutFlyioVariable
-} from "@app/services/secret-sync/flyio/flyio-sync-types";
-import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
-import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
-import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
-
-import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
-
-const listFlyioSecrets = async ({ accessToken, appId }: TFlyioListVariables) => {
-  const { data } = await request.post<{ data: { app: { secrets: TFlyioSecret[] } } }>(
-    IntegrationUrls.FLYIO_API_URL,
-    {
-      query: "query GetAppSecrets($appId: String!) { app(id: $appId) { id name secrets { name createdAt } } }",
-      variables: { appId }
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
-        Accept: "application/json"
-      }
-    }
-  );
-
-  return data.data.app.secrets.map((s) => s.name);
-};
-
-const putFlyioSecrets = async ({ accessToken, appId, secretMap }: TPutFlyioVariable) => {
-  return request.post(
-    IntegrationUrls.FLYIO_API_URL,
-    {
-      query:
-        "mutation SetAppSecrets($appId: ID!, $secrets: [SecretInput!]!) { setSecrets(input: { appId: $appId, secrets: $secrets }) { app { name } release { version } } }",
-      variables: {
-        appId,
-        secrets: Object.entries(secretMap).map(([key, { value }]) => ({ key, value }))
-      }
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json"
-      }
-    }
-  );
-};
-
-const deleteFlyioSecrets = async ({ accessToken, appId, keys }: TDeleteFlyioVariable) => {
-  return request.post(
-    IntegrationUrls.FLYIO_API_URL,
-    {
-      query:
-        "mutation UnsetAppSecrets($appId: ID!, $keys: [String!]!) { unsetSecrets(input: { appId: $appId, keys: $keys }) { app { name } release { version } } }",
-      variables: {
-        appId,
-        keys
-      }
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json"
-      }
-    }
-  );
-};
-
-export const FlyioSyncFns = {
-  syncSecrets: async (secretSync: TFlyioSyncWithCredentials, secretMap: TSecretMap) => {
-    const {
-      connection,
-      environment,
-      destinationConfig: { appId }
-    } = secretSync;
-
-    const { accessToken } = connection.credentials;
-
-    try {
-      await putFlyioSecrets({ accessToken, appId, secretMap });
-    } catch (error) {
-      throw new SecretSyncError({
-        error
-      });
-    }
-
-    if (secretSync.syncOptions.disableSecretDeletion) return;
-
-    const secrets = await listFlyioSecrets({ accessToken, appId });
-
-    const keys = secrets.filter(
-      (secret) =>
-        matchesSchema(secret, environment?.slug || "", secretSync.syncOptions.keySchema) && !(secret in secretMap)
-    );
-
-    try {
-      await deleteFlyioSecrets({ accessToken, appId, keys });
-    } catch (error) {
-      throw new SecretSyncError({
-        error
-      });
-    }
-  },
-  removeSecrets: async (secretSync: TFlyioSyncWithCredentials, secretMap: TSecretMap) => {
-    const {
-      connection,
-      destinationConfig: { appId }
-    } = secretSync;
-
-    const { accessToken } = connection.credentials;
-
-    const secrets = await listFlyioSecrets({ accessToken, appId });
-
-    const keys = secrets.filter((secret) => secret in secretMap);
-
-    try {
-      await deleteFlyioSecrets({ accessToken, appId, keys });
-    } catch (error) {
-      throw new SecretSyncError({
-        error
-      });
-    }
-  },
-  getSecrets: async (secretSync: TFlyioSyncWithCredentials) => {
-    throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
-  }
-};

backend/src/services/secret-sync/flyio/flyio-sync-schemas.ts

@@ -1,43 +0,0 @@
-import { z } from "zod";
-
-import { SecretSyncs } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-import {
-  BaseSecretSyncSchema,
-  GenericCreateSecretSyncFieldsSchema,
-  GenericUpdateSecretSyncFieldsSchema
-} from "@app/services/secret-sync/secret-sync-schemas";
-import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
-
-const FlyioSyncDestinationConfigSchema = z.object({
-  appId: z.string().trim().min(1, "App required").max(255).describe(SecretSyncs.DESTINATION_CONFIG.FLYIO.appId)
-});
-
-const FlyioSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
-
-export const FlyioSyncSchema = BaseSecretSyncSchema(SecretSync.Flyio, FlyioSyncOptionsConfig).extend({
-  destination: z.literal(SecretSync.Flyio),
-  destinationConfig: FlyioSyncDestinationConfigSchema
-});
-
-export const CreateFlyioSyncSchema = GenericCreateSecretSyncFieldsSchema(
-  SecretSync.Flyio,
-  FlyioSyncOptionsConfig
-).extend({
-  destinationConfig: FlyioSyncDestinationConfigSchema
-});
-
-export const UpdateFlyioSyncSchema = GenericUpdateSecretSyncFieldsSchema(
-  SecretSync.Flyio,
-  FlyioSyncOptionsConfig
-).extend({
-  destinationConfig: FlyioSyncDestinationConfigSchema.optional()
-});
-
-export const FlyioSyncListItemSchema = z.object({
-  name: z.literal("Fly.io"),
-  connection: z.literal(AppConnection.Flyio),
-  destination: z.literal(SecretSync.Flyio),
-  canImportSecrets: z.literal(false)
-});

backend/src/services/secret-sync/flyio/flyio-sync-types.ts

@@ -1,32 +0,0 @@
-import { z } from "zod";
-
-import { TFlyioConnection } from "@app/services/app-connection/flyio";
-
-import { CreateFlyioSyncSchema, FlyioSyncListItemSchema, FlyioSyncSchema } from "./flyio-sync-schemas";
-
-export type TFlyioSync = z.infer<typeof FlyioSyncSchema>;
-
-export type TFlyioSyncInput = z.infer<typeof CreateFlyioSyncSchema>;
-
-export type TFlyioSyncListItem = z.infer<typeof FlyioSyncListItemSchema>;
-
-export type TFlyioSyncWithCredentials = TFlyioSync & {
-  connection: TFlyioConnection;
-};
-
-export type TFlyioSecret = {
-  name: string;
-};
-
-export type TFlyioListVariables = {
-  accessToken: string;
-  appId: string;
-};
-
-export type TPutFlyioVariable = TFlyioListVariables & {
-  secretMap: { [key: string]: { value: string } };
-};
-
-export type TDeleteFlyioVariable = TFlyioListVariables & {
-  keys: string[];
-};

backend/src/services/secret-sync/flyio/index.ts

@@ -1,4 +0,0 @@
-export * from "./flyio-sync-constants";
-export * from "./flyio-sync-fns";
-export * from "./flyio-sync-schemas";
-export * from "./flyio-sync-types";

backend/src/services/secret-sync/render/index.ts

@@ -1,4 +0,0 @@
-export * from "./render-sync-constants";
-export * from "./render-sync-fns";
-export * from "./render-sync-schemas";
-export * from "./render-sync-types";

backend/src/services/secret-sync/render/render-sync-constants.ts

@@ -1,10 +0,0 @@
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
-
-export const RENDER_SYNC_LIST_OPTION: TSecretSyncListItem = {
-  name: "Render",
-  destination: SecretSync.Render,
-  connection: AppConnection.Render,
-  canImportSecrets: true
-};

backend/src/services/secret-sync/render/render-sync-enums.ts

@@ -1,8 +0,0 @@
-export enum RenderSyncScope {
-  Service = "service"
-}
-
-export enum RenderSyncType {
-  Env = "env",
-  File = "file"
-}

backend/src/services/secret-sync/render/render-sync-fns.ts

@@ -1,134 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import { request } from "@app/lib/config/request";
-import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
-import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
-import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
-
-import { TRenderSecret, TRenderSyncWithCredentials } from "./render-sync-types";
-
-const getRenderEnvironmentSecrets = async (secretSync: TRenderSyncWithCredentials) => {
-  const {
-    destinationConfig,
-    connection: {
-      credentials: { apiKey }
-    }
-  } = secretSync;
-
-  const baseUrl = `${IntegrationUrls.RENDER_API_URL}/v1/services/${destinationConfig.serviceId}/env-vars`;
-  const allSecrets: TRenderSecret[] = [];
-  let cursor: string | undefined;
-
-  do {
-    const url = cursor ? `${baseUrl}?cursor=${cursor}` : baseUrl;
-    const { data } = await request.get<
-      {
-        envVar: {
-          key: string;
-          value: string;
-        };
-        cursor: string;
-      }[]
-    >(url, {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        Accept: "application/json"
-      }
-    });
-
-    const secrets = data.map((item) => ({
-      key: item.envVar.key,
-      value: item.envVar.value
-    }));
-
-    allSecrets.push(...secrets);
-
-    cursor = data[data.length - 1]?.cursor;
-  } while (cursor);
-
-  return allSecrets;
-};
-
-const putEnvironmentSecret = async (secretSync: TRenderSyncWithCredentials, secretMap: TSecretMap, key: string) => {
-  const {
-    destinationConfig,
-    connection: {
-      credentials: { apiKey }
-    }
-  } = secretSync;
-
-  await request.put(
-    `${IntegrationUrls.RENDER_API_URL}/v1/services/${destinationConfig.serviceId}/env-vars/${key}`,
-    {
-      key,
-      value: secretMap[key].value
-    },
-    {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        Accept: "application/json"
-      }
-    }
-  );
-};
-
-const deleteEnvironmentSecret = async (secretSync: TRenderSyncWithCredentials, secret: TRenderSecret) => {
-  const {
-    destinationConfig,
-    connection: {
-      credentials: { apiKey }
-    }
-  } = secretSync;
-
-  await request.delete(
-    `${IntegrationUrls.RENDER_API_URL}/v1/services/${destinationConfig.serviceId}/env-vars/${secret.key}`,
-    {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        Accept: "application/json"
-      }
-    }
-  );
-};
-
-const sleep = async () =>
-  new Promise((resolve) => {
-    setTimeout(resolve, 500);
-  });
-
-export const RenderSyncFns = {
-  syncSecrets: async (secretSync: TRenderSyncWithCredentials, secretMap: TSecretMap) => {
-    const renderSecrets = await getRenderEnvironmentSecrets(secretSync);
-    for await (const key of Object.keys(secretMap)) {
-      await putEnvironmentSecret(secretSync, secretMap, key);
-      await sleep();
-    }
-
-    if (secretSync.syncOptions.disableSecretDeletion) return;
-
-    for await (const renderSecret of renderSecrets) {
-      if (!matchesSchema(renderSecret.key, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema))
-        // eslint-disable-next-line no-continue
-        continue;
-
-      if (!secretMap[renderSecret.key]) {
-        await deleteEnvironmentSecret(secretSync, renderSecret);
-        await sleep();
-      }
-    }
-  },
-  getSecrets: async (secretSync: TRenderSyncWithCredentials): Promise<TSecretMap> => {
-    const renderSecrets = await getRenderEnvironmentSecrets(secretSync);
-    return Object.fromEntries(renderSecrets.map((secret) => [secret.key, { value: secret.value ?? "" }]));
-  },
-
-  removeSecrets: async (secretSync: TRenderSyncWithCredentials, secretMap: TSecretMap) => {
-    const encryptedSecrets = await getRenderEnvironmentSecrets(secretSync);
-
-    for await (const encryptedSecret of encryptedSecrets) {
-      if (encryptedSecret.key in secretMap) {
-        await deleteEnvironmentSecret(secretSync, encryptedSecret);
-        await sleep();
-      }
-    }
-  }
-};

backend/src/services/secret-sync/render/render-sync-schemas.ts

@@ -1,49 +0,0 @@
-import { z } from "zod";
-
-import { SecretSyncs } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-import {
-  BaseSecretSyncSchema,
-  GenericCreateSecretSyncFieldsSchema,
-  GenericUpdateSecretSyncFieldsSchema
-} from "@app/services/secret-sync/secret-sync-schemas";
-import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
-
-import { RenderSyncScope, RenderSyncType } from "./render-sync-enums";
-
-const RenderSyncDestinationConfigSchema = z.discriminatedUnion("scope", [
-  z.object({
-    scope: z.literal(RenderSyncScope.Service).describe(SecretSyncs.DESTINATION_CONFIG.RENDER.scope),
-    serviceId: z.string().min(1, "Service ID is required").describe(SecretSyncs.DESTINATION_CONFIG.RENDER.serviceId),
-    type: z.nativeEnum(RenderSyncType).describe(SecretSyncs.DESTINATION_CONFIG.RENDER.type)
-  })
-]);
-
-const RenderSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
-
-export const RenderSyncSchema = BaseSecretSyncSchema(SecretSync.Render, RenderSyncOptionsConfig).extend({
-  destination: z.literal(SecretSync.Render),
-  destinationConfig: RenderSyncDestinationConfigSchema
-});
-
-export const CreateRenderSyncSchema = GenericCreateSecretSyncFieldsSchema(
-  SecretSync.Render,
-  RenderSyncOptionsConfig
-).extend({
-  destinationConfig: RenderSyncDestinationConfigSchema
-});
-
-export const UpdateRenderSyncSchema = GenericUpdateSecretSyncFieldsSchema(
-  SecretSync.Render,
-  RenderSyncOptionsConfig
-).extend({
-  destinationConfig: RenderSyncDestinationConfigSchema.optional()
-});
-
-export const RenderSyncListItemSchema = z.object({
-  name: z.literal("Render"),
-  connection: z.literal(AppConnection.Render),
-  destination: z.literal(SecretSync.Render),
-  canImportSecrets: z.literal(true)
-});

backend/src/services/secret-sync/render/render-sync-types.ts

@@ -1,20 +0,0 @@
-import z from "zod";
-
-import { TRenderConnection } from "@app/services/app-connection/render/render-connection-types";
-
-import { CreateRenderSyncSchema, RenderSyncListItemSchema, RenderSyncSchema } from "./render-sync-schemas";
-
-export type TRenderSyncListItem = z.infer<typeof RenderSyncListItemSchema>;
-
-export type TRenderSync = z.infer<typeof RenderSyncSchema>;
-
-export type TRenderSyncInput = z.infer<typeof CreateRenderSyncSchema>;
-
-export type TRenderSyncWithCredentials = TRenderSync & {
-  connection: TRenderConnection;
-};
-
-export type TRenderSecret = {
-  key: string;
-  value: string;
-};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -15,9 +15,7 @@ export enum SecretSync {
   HCVault = "hashicorp-vault",
   TeamCity = "teamcity",
   OCIVault = "oci-vault",
-  OnePass = "1password",
-  Render = "render",
-  Flyio = "flyio"
+  OnePass = "1password"
 }
 
 export enum SecretSyncInitialSyncBehavior {

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -29,13 +29,11 @@ import { AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION, azureAppConfigurationSyncFact
 import { AZURE_DEVOPS_SYNC_LIST_OPTION, azureDevOpsSyncFactory } from "./azure-devops";
 import { AZURE_KEY_VAULT_SYNC_LIST_OPTION, azureKeyVaultSyncFactory } from "./azure-key-vault";
 import { CAMUNDA_SYNC_LIST_OPTION, camundaSyncFactory } from "./camunda";
-import { FLYIO_SYNC_LIST_OPTION, FlyioSyncFns } from "./flyio";
 import { GCP_SYNC_LIST_OPTION } from "./gcp";
 import { GcpSyncFns } from "./gcp/gcp-sync-fns";
 import { HC_VAULT_SYNC_LIST_OPTION, HCVaultSyncFns } from "./hc-vault";
 import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
-import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
 import { SECRET_SYNC_PLAN_MAP } from "./secret-sync-maps";
 import { TEAMCITY_SYNC_LIST_OPTION, TeamCitySyncFns } from "./teamcity";
 import { TERRAFORM_CLOUD_SYNC_LIST_OPTION, TerraformCloudSyncFns } from "./terraform-cloud";
@@ -59,9 +57,7 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.HCVault]: HC_VAULT_SYNC_LIST_OPTION,
   [SecretSync.TeamCity]: TEAMCITY_SYNC_LIST_OPTION,
   [SecretSync.OCIVault]: OCI_VAULT_SYNC_LIST_OPTION,
-  [SecretSync.OnePass]: ONEPASS_SYNC_LIST_OPTION,
-  [SecretSync.Render]: RENDER_SYNC_LIST_OPTION,
-  [SecretSync.Flyio]: FLYIO_SYNC_LIST_OPTION
+  [SecretSync.OnePass]: ONEPASS_SYNC_LIST_OPTION
 };
 
 export const listSecretSyncOptions = () => {
@@ -219,10 +215,6 @@ export const SecretSyncFns = {
         return OCIVaultSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.OnePass:
         return OnePassSyncFns.syncSecrets(secretSync, schemaSecretMap);
-      case SecretSync.Render:
-        return RenderSyncFns.syncSecrets(secretSync, schemaSecretMap);
-      case SecretSync.Flyio:
-        return FlyioSyncFns.syncSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -300,12 +292,6 @@ export const SecretSyncFns = {
       case SecretSync.OnePass:
         secretMap = await OnePassSyncFns.getSecrets(secretSync);
         break;
-      case SecretSync.Render:
-        secretMap = await RenderSyncFns.getSecrets(secretSync);
-        break;
-      case SecretSync.Flyio:
-        secretMap = await FlyioSyncFns.getSecrets(secretSync);
-        break;
       default:
         throw new Error(
           `Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -373,10 +359,6 @@ export const SecretSyncFns = {
         return OCIVaultSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.OnePass:
         return OnePassSyncFns.removeSecrets(secretSync, schemaSecretMap);
-      case SecretSync.Render:
-        return RenderSyncFns.removeSecrets(secretSync, schemaSecretMap);
-      case SecretSync.Flyio:
-        return FlyioSyncFns.removeSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -18,9 +18,7 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.HCVault]: "Hashicorp Vault",
   [SecretSync.TeamCity]: "TeamCity",
   [SecretSync.OCIVault]: "OCI Vault",
-  [SecretSync.OnePass]: "1Password",
-  [SecretSync.Render]: "Render",
-  [SecretSync.Flyio]: "Fly.io"
+  [SecretSync.OnePass]: "1Password"
 };
 
 export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -40,9 +38,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.HCVault]: AppConnection.HCVault,
   [SecretSync.TeamCity]: AppConnection.TeamCity,
   [SecretSync.OCIVault]: AppConnection.OCI,
-  [SecretSync.OnePass]: AppConnection.OnePass,
-  [SecretSync.Render]: AppConnection.Render,
-  [SecretSync.Flyio]: AppConnection.Flyio
+  [SecretSync.OnePass]: AppConnection.OnePass
 };
 
 export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
@@ -62,7 +58,5 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.HCVault]: SecretSyncPlanType.Regular,
   [SecretSync.TeamCity]: SecretSyncPlanType.Regular,
   [SecretSync.OCIVault]: SecretSyncPlanType.Enterprise,
-  [SecretSync.OnePass]: SecretSyncPlanType.Regular,
-  [SecretSync.Render]: SecretSyncPlanType.Regular,
-  [SecretSync.Flyio]: SecretSyncPlanType.Regular
+  [SecretSync.OnePass]: SecretSyncPlanType.Regular
 };

backend/src/services/secret-sync/secret-sync-service.ts

@@ -1,4 +1,4 @@
-import { ForbiddenError, subject } from "@casl/ability";
+import { ForbiddenError } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -89,17 +89,7 @@ export const secretSyncServiceFactory = ({
       projectId
     });
 
-    return secretSyncs.filter((secretSync) =>
-      permission.can(
-        ProjectPermissionSecretSyncActions.Read,
-        secretSync.environment && secretSync.folder
-          ? subject(ProjectPermissionSub.SecretSyncs, {
-              environment: secretSync.environment.slug,
-              secretPath: secretSync.folder.path
-            })
-          : ProjectPermissionSub.SecretSyncs
-      )
-    ) as TSecretSync[];
+    return secretSyncs as TSecretSync[];
   };
 
   const listSecretSyncsBySecretPath = async (
@@ -115,15 +105,7 @@ export const secretSyncServiceFactory = ({
       projectId
     });
 
-    if (
-      permission.cannot(
-        ProjectPermissionSecretSyncActions.Read,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment,
-          secretPath
-        })
-      )
-    ) {
+    if (permission.cannot(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs)) {
       return [];
     }
 
@@ -160,12 +142,7 @@ export const secretSyncServiceFactory = ({
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionSecretSyncActions.Read,
-      secretSync.environment && secretSync.folder
-        ? subject(ProjectPermissionSub.SecretSyncs, {
-            environment: secretSync.environment.slug,
-            secretPath: secretSync.folder.path
-          })
-        : ProjectPermissionSub.SecretSyncs
+      ProjectPermissionSub.SecretSyncs
     );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
@@ -202,12 +179,7 @@ export const secretSyncServiceFactory = ({
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionSecretSyncActions.Read,
-      secretSync.environment && secretSync.folder
-        ? subject(ProjectPermissionSub.SecretSyncs, {
-            environment: secretSync.environment.slug,
-            secretPath: secretSync.folder.path
-          })
-        : ProjectPermissionSub.SecretSyncs
+      ProjectPermissionSub.SecretSyncs
     );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
@@ -245,17 +217,13 @@ export const secretSyncServiceFactory = ({
 
     ForbiddenError.from(projectPermission).throwUnlessCan(
       ProjectPermissionSecretSyncActions.Create,
-      subject(ProjectPermissionSub.SecretSyncs, { environment, secretPath })
+      ProjectPermissionSub.SecretSyncs
     );
 
-    throwIfMissingSecretReadValueOrDescribePermission(
-      projectPermission,
-      ProjectPermissionSecretActions.DescribeSecret,
-      {
-        environment,
-        secretPath
-      }
-    );
+    throwIfMissingSecretReadValueOrDescribePermission(projectPermission, ProjectPermissionSecretActions.ReadValue, {
+      environment,
+      secretPath
+    });
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
 
@@ -318,38 +286,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    // we always check the permission against the existing environment / secret path
-    // if no secret path / environment is present on the secret sync, we need to check without conditions
-    if (secretSync.environment?.slug && secretSync.folder?.path) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.Edit,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment: secretSync.environment.slug,
-          secretPath: secretSync.folder.path
-        })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.Edit,
-        ProjectPermissionSub.SecretSyncs
-      );
-    }
-
-    // if the user is updating the secret path or environment, we need to check the permission against the new values
-    if (secretPath || environment) {
-      const environmentToCheck = environment || secretSync.environment?.slug || "";
-      const secretPathToCheck = secretPath || secretSync.folder?.path || "";
-
-      if (environmentToCheck && secretPathToCheck) {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionSecretSyncActions.Edit,
-          subject(ProjectPermissionSub.SecretSyncs, {
-            environment: environmentToCheck,
-            secretPath: secretPathToCheck
-          })
-        );
-      }
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Edit,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -375,7 +315,7 @@ export const secretSyncServiceFactory = ({
       if (!updatedEnvironment || !updatedSecretPath)
         throw new BadRequestError({ message: "Must specify both source environment and secret path" });
 
-      throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret, {
+      throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
         environment: updatedEnvironment,
         secretPath: updatedSecretPath
       });
@@ -434,20 +374,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    if (secretSync.environment?.slug && secretSync.folder?.path) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.Delete,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment: secretSync.environment.slug,
-          secretPath: secretSync.folder.path
-        })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.Delete,
-        ProjectPermissionSub.SecretSyncs
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.Delete,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -511,20 +441,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    if (secretSync.environment?.slug && secretSync.folder?.path) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.SyncSecrets,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment: secretSync.environment.slug,
-          secretPath: secretSync.folder.path
-        })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.SyncSecrets,
-        ProjectPermissionSub.SecretSyncs
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.SyncSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -583,20 +503,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    if (secretSync.environment?.slug && secretSync.folder?.path) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.ImportSecrets,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment: secretSync.environment.slug,
-          secretPath: secretSync.folder.path
-        })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.ImportSecrets,
-        ProjectPermissionSub.SecretSyncs
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.ImportSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({
@@ -649,20 +559,10 @@ export const secretSyncServiceFactory = ({
       projectId: secretSync.projectId
     });
 
-    if (secretSync.environment?.slug && secretSync.folder?.path) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.RemoveSecrets,
-        subject(ProjectPermissionSub.SecretSyncs, {
-          environment: secretSync.environment.slug,
-          secretPath: secretSync.folder.path
-        })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretSyncActions.RemoveSecrets,
-        ProjectPermissionSub.SecretSyncs
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretSyncActions.RemoveSecrets,
+      ProjectPermissionSub.SecretSyncs
+    );
 
     if (secretSync.connection.app !== SECRET_SYNC_CONNECTION_MAP[destination])
       throw new BadRequestError({

backend/src/services/secret-sync/secret-sync-types.ts

@@ -72,7 +72,6 @@ import {
   TAzureKeyVaultSyncListItem,
   TAzureKeyVaultSyncWithCredentials
 } from "./azure-key-vault";
-import { TFlyioSync, TFlyioSyncInput, TFlyioSyncListItem, TFlyioSyncWithCredentials } from "./flyio/flyio-sync-types";
 import { TGcpSync, TGcpSyncInput, TGcpSyncListItem, TGcpSyncWithCredentials } from "./gcp";
 import {
   THCVaultSync,
@@ -86,12 +85,6 @@ import {
   THumanitecSyncListItem,
   THumanitecSyncWithCredentials
 } from "./humanitec";
-import {
-  TRenderSync,
-  TRenderSyncInput,
-  TRenderSyncListItem,
-  TRenderSyncWithCredentials
-} from "./render/render-sync-types";
 import {
   TTeamCitySync,
   TTeamCitySyncInput,
@@ -123,9 +116,7 @@ export type TSecretSync =
   | THCVaultSync
   | TTeamCitySync
   | TOCIVaultSync
-  | TOnePassSync
-  | TRenderSync
-  | TFlyioSync;
+  | TOnePassSync;
 
 export type TSecretSyncWithCredentials =
   | TAwsParameterStoreSyncWithCredentials
@@ -144,9 +135,7 @@ export type TSecretSyncWithCredentials =
   | THCVaultSyncWithCredentials
   | TTeamCitySyncWithCredentials
   | TOCIVaultSyncWithCredentials
-  | TOnePassSyncWithCredentials
-  | TRenderSyncWithCredentials
-  | TFlyioSyncWithCredentials;
+  | TOnePassSyncWithCredentials;
 
 export type TSecretSyncInput =
   | TAwsParameterStoreSyncInput
@@ -165,9 +154,7 @@ export type TSecretSyncInput =
   | THCVaultSyncInput
   | TTeamCitySyncInput
   | TOCIVaultSyncInput
-  | TOnePassSyncInput
-  | TRenderSyncInput
-  | TFlyioSyncInput;
+  | TOnePassSyncInput;
 
 export type TSecretSyncListItem =
   | TAwsParameterStoreSyncListItem
@@ -186,9 +173,7 @@ export type TSecretSyncListItem =
   | THCVaultSyncListItem
   | TTeamCitySyncListItem
   | TOCIVaultSyncListItem
-  | TOnePassSyncListItem
-  | TRenderSyncListItem
-  | TFlyioSyncListItem;
+  | TOnePassSyncListItem;
 
 export type TSyncOptionsConfig = {
   canImportSecrets: boolean;

docs/api-reference/endpoints/app-connections/flyio/available.mdx

@@ -1,4 +0,0 @@
----
-title: "Available"
-openapi: "GET /api/v1/app-connections/flyio/available"
----

docs/api-reference/endpoints/app-connections/flyio/create.mdx

@@ -1,8 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/app-connections/flyio"
----
-
-<Note>
-    Check out the configuration docs for [Fly.io Connections](/integrations/app-connections/flyio) to learn how to obtain the required credentials.
-</Note>

docs/api-reference/endpoints/app-connections/flyio/delete.mdx

@@ -1,4 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/app-connections/flyio/{connectionId}"
----

docs/api-reference/endpoints/app-connections/flyio/get-by-id.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by ID"
-openapi: "GET /api/v1/app-connections/flyio/{connectionId}"
----

docs/api-reference/endpoints/app-connections/flyio/get-by-name.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by Name"
-openapi: "GET /api/v1/app-connections/flyio/connection-name/{connectionName}"
----

docs/api-reference/endpoints/app-connections/flyio/list.mdx

@@ -1,4 +0,0 @@
----
-title: "List"
-openapi: "GET /api/v1/app-connections/flyio"
----

docs/api-reference/endpoints/app-connections/flyio/update.mdx

@@ -1,8 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/app-connections/flyio/{connectionId}"
----
-
-<Note>
-    Check out the configuration docs for [Fly.io Connections](/integrations/app-connections/flyio) to learn how to obtain the required credentials.
-</Note>

docs/api-reference/endpoints/app-connections/render/available.mdx

@@ -1,4 +0,0 @@
----
-title: "Available"
-openapi: "GET /api/v1/app-connections/render/available"
----

docs/api-reference/endpoints/app-connections/render/create.mdx

@@ -1,10 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/app-connections/render"
----
-
-<Note>
-  Check out the configuration docs for [Render
-  Connections](/integrations/app-connections/render) to learn how to obtain the
-  required credentials.
-</Note>

docs/api-reference/endpoints/app-connections/render/delete.mdx

@@ -1,4 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/app-connections/render/{connectionId}"
----

docs/api-reference/endpoints/app-connections/render/get-by-id.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by ID"
-openapi: "GET /api/v1/app-connections/render/{connectionId}"
----

docs/api-reference/endpoints/app-connections/render/get-by-name.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by Name"
-openapi: "GET /api/v1/app-connections/render/connection-name/{connectionName}"
----

docs/api-reference/endpoints/app-connections/render/list.mdx

@@ -1,4 +0,0 @@
----
-title: "List"
-openapi: "GET /api/v1/app-connections/render"
----

docs/api-reference/endpoints/app-connections/render/update.mdx

@@ -1,10 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/app-connections/render/{connectionId}"
----
-
-<Note>
-  Check out the configuration docs for [Render
-  Connections](/integrations/app-connections/render) to learn how to obtain the
-  required credentials.
-</Note>

docs/api-reference/endpoints/secret-syncs/flyio/create.mdx

@@ -1,4 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/secret-syncs/flyio"
----

docs/api-reference/endpoints/secret-syncs/flyio/delete.mdx

@@ -1,4 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/secret-syncs/flyio/{syncId}"
----

docs/api-reference/endpoints/secret-syncs/flyio/get-by-id.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by ID"
-openapi: "GET /api/v1/secret-syncs/flyio/{syncId}"
----

docs/api-reference/endpoints/secret-syncs/flyio/get-by-name.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by Name"
-openapi: "GET /api/v1/secret-syncs/flyio/sync-name/{syncName}"
----

docs/api-reference/endpoints/secret-syncs/flyio/import-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Import Secrets"
-openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/import-secrets"
----

docs/api-reference/endpoints/secret-syncs/flyio/list.mdx

@@ -1,4 +0,0 @@
----
-title: "List"
-openapi: "GET /api/v1/secret-syncs/flyio"
----

docs/api-reference/endpoints/secret-syncs/flyio/remove-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Remove Secrets"
-openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/remove-secrets"
----

docs/api-reference/endpoints/secret-syncs/flyio/sync-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Sync Secrets"
-openapi: "POST /api/v1/secret-syncs/flyio/{syncId}/sync-secrets"
----

docs/api-reference/endpoints/secret-syncs/flyio/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/secret-syncs/flyio/{syncId}"
----

docs/api-reference/endpoints/secret-syncs/render/create.mdx

@@ -1,4 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/secret-syncs/render"
----

docs/api-reference/endpoints/secret-syncs/render/delete.mdx

@@ -1,4 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/secret-syncs/render/{syncId}"
----

docs/api-reference/endpoints/secret-syncs/render/get-by-id.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by ID"
-openapi: "GET /api/v1/secret-syncs/render/{syncId}"
----

docs/api-reference/endpoints/secret-syncs/render/get-by-name.mdx

@@ -1,4 +0,0 @@
----
-title: "Get by Name"
-openapi: "GET /api/v1/secret-syncs/render/sync-name/{syncName}"
----

docs/api-reference/endpoints/secret-syncs/render/import-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Import Secrets"
-openapi: "POST /api/v1/secret-syncs/render/{syncId}/import-secrets"
----

docs/api-reference/endpoints/secret-syncs/render/list.mdx

@@ -1,4 +0,0 @@
----
-title: "List"
-openapi: "GET /api/v1/secret-syncs/render"
----

docs/api-reference/endpoints/secret-syncs/render/remove-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Remove Secrets"
-openapi: "POST /api/v1/secret-syncs/render/{syncId}/remove-secrets"
----

docs/api-reference/endpoints/secret-syncs/render/sync-secrets.mdx

@@ -1,4 +0,0 @@
----
-title: "Sync Secrets"
-openapi: "POST /api/v1/secret-syncs/render/{syncId}/sync-secrets"
----

docs/api-reference/endpoints/secret-syncs/render/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/secret-syncs/render/{syncId}"
----