Merge branch 'main' into feat/team-autonomy-product-migration

2026-09-22 13:39:35 +00:00 · 2025-07-01 20:21:00 -04:00
parent a64c2173e7 5ced43574d
commit 0379ba4eb1
22 changed files with 128 additions and 2921 deletions
--- a/backend/src/db/migrations/20250627010508_env-overrides.ts
+++ b/backend/src/db/migrations/20250627010508_env-overrides.ts
@@ -1,21 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.SuperAdmin, "encryptedEnvOverrides");
-  if (!hasColumn) {
-    await knex.schema.alterTable(TableName.SuperAdmin, (t) => {
-      t.binary("encryptedEnvOverrides").nullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasColumn = await knex.schema.hasColumn(TableName.SuperAdmin, "encryptedEnvOverrides");
-  if (hasColumn) {
-    await knex.schema.alterTable(TableName.SuperAdmin, (t) => {
-      t.dropColumn("encryptedEnvOverrides");
-    });
-  }
-}
--- a/backend/src/db/schemas/super-admin.ts
+++ b/backend/src/db/schemas/super-admin.ts
@@ -34,8 +34,7 @@ export const SuperAdminSchema = z.object({
  encryptedGitHubAppConnectionClientSecret: zodBuffer.nullable().optional(),
  encryptedGitHubAppConnectionSlug: zodBuffer.nullable().optional(),
  encryptedGitHubAppConnectionId: zodBuffer.nullable().optional(),
-  encryptedGitHubAppConnectionPrivateKey: zodBuffer.nullable().optional(),
-  encryptedEnvOverrides: zodBuffer.nullable().optional()
+  encryptedGitHubAppConnectionPrivateKey: zodBuffer.nullable().optional()
 });

 export type TSuperAdmin = z.infer<typeof SuperAdminSchema>;
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -2,7 +2,6 @@ import { z } from "zod";

 import { QueueWorkerProfile } from "@app/lib/types";

-import { BadRequestError } from "../errors";
 import { removeTrailingSlash } from "../fn";
 import { CustomLogger } from "../logger/logger";
 import { zpStr } from "../zod";
@@ -342,11 +341,8 @@ const envSchema = z

 export type TEnvConfig = Readonly<z.infer<typeof envSchema>>;
 let envCfg: TEnvConfig;
-let originalEnvConfig: TEnvConfig;

 export const getConfig = () => envCfg;
-export const getOriginalConfig = () => originalEnvConfig;
-
 // cannot import singleton logger directly as it needs config to load various transport
 export const initEnvConfig = (logger?: CustomLogger) => {
  const parsedEnv = envSchema.safeParse(process.env);
@@ -356,115 +352,10 @@ export const initEnvConfig = (logger?: CustomLogger) => {
    process.exit(-1);
  }

-  const config = Object.freeze(parsedEnv.data);
-  envCfg = config;
-
-  if (!originalEnvConfig) {
-    originalEnvConfig = config;
-  }
-
+  envCfg = Object.freeze(parsedEnv.data);
  return envCfg;
 };

-// A list of environment variables that can be overwritten
-export const overwriteSchema: {
-  [key: string]: {
-    name: string;
-    fields: { key: keyof TEnvConfig; description?: string }[];
-  };
-} = {
-  azure: {
-    name: "Azure",
-    fields: [
-      {
-        key: "INF_APP_CONNECTION_AZURE_CLIENT_ID",
-        description: "The Application (Client) ID of your Azure application."
-      },
-      {
-        key: "INF_APP_CONNECTION_AZURE_CLIENT_SECRET",
-        description: "The Client Secret of your Azure application."
-      }
-    ]
-  },
-  google_sso: {
-    name: "Google SSO",
-    fields: [
-      {
-        key: "CLIENT_ID_GOOGLE_LOGIN",
-        description: "The Client ID of your GCP OAuth2 application."
-      },
-      {
-        key: "CLIENT_SECRET_GOOGLE_LOGIN",
-        description: "The Client Secret of your GCP OAuth2 application."
-      }
-    ]
-  },
-  github_sso: {
-    name: "GitHub SSO",
-    fields: [
-      {
-        key: "CLIENT_ID_GITHUB_LOGIN",
-        description: "The Client ID of your GitHub OAuth application."
-      },
-      {
-        key: "CLIENT_SECRET_GITHUB_LOGIN",
-        description: "The Client Secret of your GitHub OAuth application."
-      }
-    ]
-  },
-  gitlab_sso: {
-    name: "GitLab SSO",
-    fields: [
-      {
-        key: "CLIENT_ID_GITLAB_LOGIN",
-        description: "The Client ID of your GitLab application."
-      },
-      {
-        key: "CLIENT_SECRET_GITLAB_LOGIN",
-        description: "The Secret of your GitLab application."
-      },
-      {
-        key: "CLIENT_GITLAB_LOGIN_URL",
-        description:
-          "The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to https://gitlab.com."
-      }
-    ]
-  }
-};
-
-export const overridableKeys = new Set(
-  Object.values(overwriteSchema).flatMap(({ fields }) => fields.map(({ key }) => key))
-);
-
-export const validateOverrides = (config: Record<string, string>) => {
-  const allowedOverrides = Object.fromEntries(
-    Object.entries(config).filter(([key]) => overridableKeys.has(key as keyof z.input<typeof envSchema>))
-  );
-
-  const tempEnv: Record<string, unknown> = { ...process.env, ...allowedOverrides };
-  const parsedResult = envSchema.safeParse(tempEnv);
-
-  if (!parsedResult.success) {
-    const errorDetails = parsedResult.error.issues
-      .map((issue) => `Key: "${issue.path.join(".")}", Error: ${issue.message}`)
-      .join("\n");
-    throw new BadRequestError({ message: errorDetails });
-  }
-};
-
-export const overrideEnvConfig = (config: Record<string, string>) => {
-  const allowedOverrides = Object.fromEntries(
-    Object.entries(config).filter(([key]) => overridableKeys.has(key as keyof z.input<typeof envSchema>))
-  );
-
-  const tempEnv: Record<string, unknown> = { ...process.env, ...allowedOverrides };
-  const parsedResult = envSchema.safeParse(tempEnv);
-
-  if (parsedResult.success) {
-    envCfg = Object.freeze(parsedResult.data);
-  }
-};
-
 export const formatSmtpConfig = () => {
  const tlsOptions: {
    rejectUnauthorized: boolean;
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -1187,7 +1187,9 @@ export const registerRoutes = async (
    projectEnvDAL,
    snapshotService,
    projectDAL,
-    folderCommitService
+    folderCommitService,
+    secretApprovalPolicyService,
+    secretV2BridgeDAL
  });

  const secretImportService = secretImportServiceFactory({
@@ -2042,10 +2044,6 @@ export const registerRoutes = async (
      cronJobs.push(adminIntegrationsSyncJob);
    }
  }
-  const configSyncJob = await superAdminService.initializeEnvConfigSync();
-  if (configSyncJob) {
-    cronJobs.push(configSyncJob);
-  }

  server.decorate<FastifyZodProvider["store"]>("store", {
    user: userDAL,
--- a/backend/src/server/routes/v1/admin-router.ts
+++ b/backend/src/server/routes/v1/admin-router.ts
@@ -8,7 +8,7 @@ import {
  SuperAdminSchema,
  UsersSchema
 } from "@app/db/schemas";
-import { getConfig, overridableKeys } from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { invalidateCacheLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
@@ -42,8 +42,7 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
            encryptedGitHubAppConnectionClientSecret: true,
            encryptedGitHubAppConnectionSlug: true,
            encryptedGitHubAppConnectionId: true,
-            encryptedGitHubAppConnectionPrivateKey: true,
-            encryptedEnvOverrides: true
+            encryptedGitHubAppConnectionPrivateKey: true
          }).extend({
            isMigrationModeOn: z.boolean(),
            defaultAuthOrgSlug: z.string().nullable(),
@@ -111,14 +110,11 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
          .refine((content) => DOMPurify.sanitize(content) === content, {
            message: "Page frame content contains unsafe HTML."
          })
-          .optional(),
-        envOverrides: z.record(z.enum(Array.from(overridableKeys) as [string, ...string[]]), z.string()).optional()
+          .optional()
      }),
      response: {
        200: z.object({
-          config: SuperAdminSchema.omit({
-            encryptedEnvOverrides: true
-          }).extend({
+          config: SuperAdminSchema.extend({
            defaultAuthOrgSlug: z.string().nullable()
          })
        })
@@ -385,41 +381,6 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
    }
  });

-  server.route({
-    method: "GET",
-    url: "/env-overrides",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      response: {
-        200: z.record(
-          z.string(),
-          z.object({
-            name: z.string(),
-            fields: z
-              .object({
-                key: z.string(),
-                value: z.string(),
-                hasEnvEntry: z.boolean(),
-                description: z.string().optional()
-              })
-              .array()
-          })
-        )
-      }
-    },
-    onRequest: (req, res, done) => {
-      verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN])(req, res, () => {
-        verifySuperAdmin(req, res, done);
-      });
-    },
-    handler: async () => {
-      const envOverrides = await server.services.superAdmin.getEnvOverridesOrganized();
-      return envOverrides;
-    }
-  });
-
  server.route({
    method: "DELETE",
    url: "/user-management/users/:userId",
--- a/backend/src/services/secret-folder/secret-folder-service.ts
+++ b/backend/src/services/secret-folder/secret-folder-service.ts
@@ -2,9 +2,10 @@ import { ForbiddenError, subject } from "@casl/ability";
 import path from "path";
 import { v4 as uuidv4, validate as uuidValidate } from "uuid";

-import { TSecretFoldersInsert } from "@app/db/schemas";
+import { ActionProjectType, TSecretFolders, TSecretFoldersInsert } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
 import { PgSqlLock } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -14,6 +15,7 @@ import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 import { ChangeType, CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
+import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
 import {
  TCreateFolderDTO,
@@ -34,6 +36,8 @@ type TSecretFolderServiceFactoryDep = {
  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestFolderVersions" | "create" | "insertMany" | "find">;
  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
  projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
+  secretApprovalPolicyService: Pick<TSecretApprovalPolicyServiceFactory, "getSecretApprovalPolicy">;
+  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "findByFolderIds">;
 };

 export type TSecretFolderServiceFactory = ReturnType<typeof secretFolderServiceFactory>;
@@ -45,7 +49,9 @@ export const secretFolderServiceFactory = ({
  projectEnvDAL,
  folderVersionDAL,
  folderCommitService,
-  projectDAL
+  projectDAL,
+  secretApprovalPolicyService,
+  secretV2BridgeDAL
 }: TSecretFolderServiceFactoryDep) => {
  const createFolder = async ({
    projectId,
@@ -461,6 +467,66 @@ export const secretFolderServiceFactory = ({
    return { folder: newFolder, old: folder };
  };

+  const $checkFolderPolicy = async ({
+    projectId,
+    environment,
+    parentId
+  }: {
+    projectId: string;
+    environment: string;
+    parentId: string;
+  }) => {
+    // get environment root folder (as it's needed to get all folders under it)
+    const rootFolder = await folderDAL.findBySecretPath(projectId, environment, "/");
+    if (!rootFolder) throw new NotFoundError({ message: `Root folder not found` });
+    // get all folders under environment root folder
+    const folderPaths = await folderDAL.findByEnvsDeep({ parentIds: [rootFolder.id] });
+
+    // create a map of folders by parent id
+    const normalizeKey = (key: string | null | undefined): string => key ?? "root";
+    const folderMap = new Map<string, (TSecretFolders & { path: string; depth: number; environment: string })[]>();
+    for (const folder of folderPaths) {
+      if (!folderMap.has(normalizeKey(folder.parentId))) {
+        folderMap.set(normalizeKey(folder.parentId), []);
+      }
+      folderMap.get(normalizeKey(folder.parentId))?.push(folder);
+    }
+
+    // Recursively collect all folders under the given parentId
+    const collectDescendants = (
+      id: string
+    ): (TSecretFolders & { path: string; depth: number; environment: string })[] => {
+      const children = folderMap.get(normalizeKey(id)) || [];
+      return [...children, ...children.flatMap((child) => collectDescendants(child.id))];
+    };
+
+    const foldersUnderParent = collectDescendants(parentId);
+
+    const folderPolicyPaths = foldersUnderParent.map((folder) => ({
+      path: folder.path,
+      id: folder.id
+    }));
+
+    // get secrets under the given folders
+    const secrets = await secretV2BridgeDAL.findByFolderIds({ folderIds: folderPolicyPaths.map((p) => p.id) });
+    for await (const folderPolicyPath of folderPolicyPaths) {
+      // eslint-disable-next-line no-continue
+      if (!secrets.some((s) => s.folderId === folderPolicyPath.id)) continue;
+      const policy = await secretApprovalPolicyService.getSecretApprovalPolicy(
+        projectId,
+        environment,
+        folderPolicyPath.path
+      );
+      // if there is a policy and there are secrets under the given folder, throw error
+      if (policy) {
+        throw new BadRequestError({
+          message: `You cannot delete the selected folder because it contains one or more secrets that are protected by the change policy "${policy.name}" at folder path "${folderPolicyPath.path}". Please remove the secrets at folder path "${folderPolicyPath.path}" and try again.`,
+          name: "DeleteFolderProtectedByPolicy"
+        });
+      }
+    }
+  };
+
  const deleteFolder = async ({
    projectId,
    actor,
@@ -494,6 +560,8 @@ export const secretFolderServiceFactory = ({
          message: `Folder with path '${secretPath}' in environment with slug '${environment}' not found`
        });

+      await $checkFolderPolicy({ projectId, environment, parentId: parentFolder.id });
+
      const [doc] = await folderDAL.delete(
        {
          envId: env.id,
--- a/backend/src/services/super-admin/super-admin-service.ts
+++ b/backend/src/services/super-admin/super-admin-service.ts
@@ -5,13 +5,7 @@ import jwt from "jsonwebtoken";
 import { IdentityAuthMethod, OrgMembershipRole, TSuperAdmin, TSuperAdminUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
-import {
-  getConfig,
-  getOriginalConfig,
-  overrideEnvConfig,
-  overwriteSchema,
-  validateOverrides
-} from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -39,7 +33,6 @@ import { TInvalidateCacheQueueFactory } from "./invalidate-cache-queue";
 import { TSuperAdminDALFactory } from "./super-admin-dal";
 import {
  CacheType,
-  EnvOverrides,
  LoginMethod,
  TAdminBootstrapInstanceDTO,
  TAdminGetIdentitiesDTO,
@@ -241,45 +234,6 @@ export const superAdminServiceFactory = ({
    adminIntegrationsConfig = config;
  };

-  const getEnvOverrides = async () => {
-    const serverCfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
-
-    if (!serverCfg || !serverCfg.encryptedEnvOverrides) {
-      return {};
-    }
-
-    const decrypt = kmsService.decryptWithRootKey();
-
-    const overrides = JSON.parse(decrypt(serverCfg.encryptedEnvOverrides).toString()) as Record<string, string>;
-
-    return overrides;
-  };
-
-  const getEnvOverridesOrganized = async (): Promise<EnvOverrides> => {
-    const overrides = await getEnvOverrides();
-    const ogConfig = getOriginalConfig();
-
-    return Object.fromEntries(
-      Object.entries(overwriteSchema).map(([groupKey, groupDef]) => [
-        groupKey,
-        {
-          name: groupDef.name,
-          fields: groupDef.fields.map(({ key, description }) => ({
-            key,
-            description,
-            value: overrides[key] || "",
-            hasEnvEntry: !!(ogConfig as unknown as Record<string, string | undefined>)[key]
-          }))
-        }
-      ])
-    );
-  };
-
-  const $syncEnvConfig = async () => {
-    const config = await getEnvOverrides();
-    overrideEnvConfig(config);
-  };
-
  const updateServerCfg = async (
    data: TSuperAdminUpdate & {
      slackClientId?: string;
@@ -292,7 +246,6 @@ export const superAdminServiceFactory = ({
      gitHubAppConnectionSlug?: string;
      gitHubAppConnectionId?: string;
      gitHubAppConnectionPrivateKey?: string;
-      envOverrides?: Record<string, string>;
    },
    userId: string
  ) => {
@@ -421,17 +374,6 @@ export const superAdminServiceFactory = ({
      gitHubAppConnectionSettingsUpdated = true;
    }

-    let envOverridesUpdated = false;
-    if (data.envOverrides !== undefined) {
-      // Verify input format
-      validateOverrides(data.envOverrides);
-
-      const encryptedEnvOverrides = encryptWithRoot(Buffer.from(JSON.stringify(data.envOverrides)));
-      updatedData.encryptedEnvOverrides = encryptedEnvOverrides;
-      updatedData.envOverrides = undefined;
-      envOverridesUpdated = true;
-    }
-
    const updatedServerCfg = await serverCfgDAL.updateById(ADMIN_CONFIG_DB_UUID, updatedData);

    await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(updatedServerCfg));
@@ -440,10 +382,6 @@ export const superAdminServiceFactory = ({
      await $syncAdminIntegrationConfig();
    }

-    if (envOverridesUpdated) {
-      await $syncEnvConfig();
-    }
-
    if (
      updatedServerCfg.encryptedMicrosoftTeamsAppId &&
      updatedServerCfg.encryptedMicrosoftTeamsClientSecret &&
@@ -876,18 +814,6 @@ export const superAdminServiceFactory = ({
    return job;
  };

-  const initializeEnvConfigSync = async () => {
-    logger.info("Setting up background sync process for environment overrides");
-
-    await $syncEnvConfig();
-
-    // sync every 5 minutes
-    const job = new CronJob("*/5 * * * *", $syncEnvConfig);
-    job.start();
-
-    return job;
-  };
-
  return {
    initServerCfg,
    updateServerCfg,
@@ -907,9 +833,6 @@ export const superAdminServiceFactory = ({
    getOrganizations,
    deleteOrganization,
    deleteOrganizationMembership,
-    initializeAdminIntegrationConfigSync,
-    initializeEnvConfigSync,
-    getEnvOverrides,
-    getEnvOverridesOrganized
+    initializeAdminIntegrationConfigSync
  };
 };
--- a/backend/src/services/super-admin/super-admin-types.ts
+++ b/backend/src/services/super-admin/super-admin-types.ts
@@ -1,5 +1,3 @@
-import { TEnvConfig } from "@app/lib/config/env";
-
 export type TAdminSignUpDTO = {
  email: string;
  password: string;
@@ -76,10 +74,3 @@ export type TAdminIntegrationConfig = {
    privateKey: string;
  };
 };
-
-export interface EnvOverrides {
-  [key: string]: {
-    name: string;
-    fields: { key: keyof TEnvConfig; value: string; hasEnvEntry: boolean; description?: string }[];
-  };
-}
--- a/cli/packages/cmd/user.go
+++ b/cli/packages/cmd/user.go
@@ -114,6 +114,11 @@ var userGetTokenCmd = &cobra.Command{
 			loggedInUserDetails = util.EstablishUserLoginSession()
 		}

+		plain, err := cmd.Flags().GetBool("plain")
+		if err != nil {
+			util.HandleError(err, "[infisical user get token]: Unable to get plain flag")
+		}
+
 		if err != nil {
 			util.HandleError(err, "[infisical user get token]: Unable to get logged in user token")
 		}
@@ -135,8 +140,12 @@ var userGetTokenCmd = &cobra.Command{
 			util.HandleError(err, "[infisical user get token]: Unable to parse token payload")
 		}

-		fmt.Println("Session ID:", tokenPayload.TokenVersionId)
-		fmt.Println("Token:", loggedInUserDetails.UserCredentials.JTWToken)
+		if plain {
+			fmt.Println(loggedInUserDetails.UserCredentials.JTWToken)
+		} else {
+			fmt.Println("Session ID:", tokenPayload.TokenVersionId)
+			fmt.Println("Token:", loggedInUserDetails.UserCredentials.JTWToken)
+		}
 	},
 }

@@ -240,7 +249,10 @@ var domainCmd = &cobra.Command{
 func init() {
 	updateCmd.AddCommand(domainCmd)
 	userCmd.AddCommand(updateCmd)
+
+	userGetTokenCmd.Flags().Bool("plain", false, "print token without formatting")
 	userGetCmd.AddCommand(userGetTokenCmd)
+
 	userCmd.AddCommand(userGetCmd)
 	userCmd.AddCommand(switchCmd)
 	rootCmd.AddCommand(userCmd)
--- a/docs/cli/commands/user.mdx
+++ b/docs/cli/commands/user.mdx
@@ -35,19 +35,40 @@ infisical user update domain
 <Accordion title="infisical user get token">
  Use this command to get your current Infisical access token and session information. This command requires you to be logged in.

-  The command will display:
+The command will display:

-  - Your session ID
-  - Your full JWT access token
+- Your session ID
+- Your full JWT access token

-  ```bash
-  infisical user get token
-  ```
+```bash
+infisical user get token
+```

-  Example output:
+Example output:
+
+```bash
+Session ID: abc123-xyz-456
+Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+```
+
+### Flags
+
+  <Accordion title="--plain">
+    Output only the JWT token without formatting (no session ID)
+
+    Default value: `false`
+
+    ```bash
+    # Example
+    infisical user get token --plain
+    ```
+
+    Example output:
+
+    ```bash
+    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+    ```
+
+  </Accordion>

-  ```bash
-  Session ID: abc123-xyz-456
-  Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
-  ```
 </Accordion>
--- a/docs/mint.json
+++ b/docs/mint.json
--- a/frontend/src/components/v2/HighlightText/HighlightText.tsx
+++ b/frontend/src/components/v2/HighlightText/HighlightText.tsx
@@ -1,42 +0,0 @@
-export const HighlightText = ({
-  text,
-  highlight,
-  highlightClassName
-}: {
-  text: string | undefined | null;
-  highlight: string;
-  highlightClassName?: string;
-}) => {
-  if (!text) return null;
-  const searchTerm = highlight.toLowerCase().trim();
-
-  if (!searchTerm) return <span>{text}</span>;
-
-  const parts: React.ReactNode[] = [];
-  let lastIndex = 0;
-
-  const escapedSearchTerm = searchTerm.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const regex = new RegExp(escapedSearchTerm, "gi");
-
-  text.replace(regex, (match: string, offset: number) => {
-    if (offset > lastIndex) {
-      parts.push(<span key={`pre-${lastIndex}`}>{text.substring(lastIndex, offset)}</span>);
-    }
-
-    parts.push(
-      <span key={`match-${offset}`} className={highlightClassName || "bg-yellow/30"}>
-        {match}
-      </span>
-    );
-
-    lastIndex = offset + match.length;
-
-    return match;
-  });
-
-  if (lastIndex < text.length) {
-    parts.push(<span key={`post-${lastIndex}`}>{text.substring(lastIndex)}</span>);
-  }
-
-  return parts;
-};
--- a/frontend/src/components/v2/HighlightText/index.tsx
+++ b/frontend/src/components/v2/HighlightText/index.tsx
@@ -1 +0,0 @@
-export { HighlightText } from "./HighlightText";
--- a/frontend/src/hooks/api/admin/queries.ts
+++ b/frontend/src/hooks/api/admin/queries.ts
@@ -10,7 +10,6 @@ import {
  AdminGetUsersFilters,
  AdminIntegrationsConfig,
  OrganizationWithProjects,
-  TGetEnvOverrides,
  TGetInvalidatingCacheStatus,
  TGetServerRootKmsEncryptionDetails,
  TServerConfig
@@ -32,8 +31,7 @@ export const adminQueryKeys = {
  getAdminSlackConfig: () => ["admin-slack-config"] as const,
  getServerEncryptionStrategies: () => ["server-encryption-strategies"] as const,
  getInvalidateCache: () => ["admin-invalidate-cache"] as const,
-  getAdminIntegrationsConfig: () => ["admin-integrations-config"] as const,
-  getEnvOverrides: () => ["env-overrides"] as const
+  getAdminIntegrationsConfig: () => ["admin-integrations-config"] as const
 };

 export const fetchServerConfig = async () => {
@@ -165,13 +163,3 @@ export const useGetInvalidatingCacheStatus = (enabled = true) => {
    refetchInterval: (data) => (data ? 3000 : false)
  });
 };
-
-export const useGetEnvOverrides = () => {
-  return useQuery({
-    queryKey: adminQueryKeys.getEnvOverrides(),
-    queryFn: async () => {
-      const { data } = await apiRequest.get<TGetEnvOverrides>("/api/v1/admin/env-overrides");
-      return data;
-    }
-  });
-};
--- a/frontend/src/hooks/api/admin/types.ts
+++ b/frontend/src/hooks/api/admin/types.ts
@@ -48,7 +48,6 @@ export type TServerConfig = {
  authConsentContent?: string;
  pageFrameContent?: string;
  invalidatingCache: boolean;
-  envOverrides?: Record<string, string>;
 };

 export type TUpdateServerConfigDTO = {
@@ -62,7 +61,6 @@ export type TUpdateServerConfigDTO = {
  gitHubAppConnectionSlug?: string;
  gitHubAppConnectionId?: string;
  gitHubAppConnectionPrivateKey?: string;
-  envOverrides?: Record<string, string>;
 } & Partial<TServerConfig>;

 export type TCreateAdminUserDTO = {
@@ -140,10 +138,3 @@ export type TInvalidateCacheDTO = {
 export type TGetInvalidatingCacheStatus = {
  invalidating: boolean;
 };
-
-export interface TGetEnvOverrides {
-  [key: string]: {
-    name: string;
-    fields: { key: string; value: string; hasEnvEntry: boolean; description?: string }[];
-  };
-}
--- a/frontend/src/layouts/AdminLayout/Sidebar.tsx
+++ b/frontend/src/layouts/AdminLayout/Sidebar.tsx
@@ -29,11 +29,6 @@ const generalTabs = [
    label: "Caching",
    icon: "note",
    link: "/admin/caching"
-  },
-  {
-    label: "Environment",
-    icon: "unlock",
-    link: "/admin/environment"
  }
 ];

--- a/frontend/src/pages/admin/EnvironmentPage/EnvironmentPage.tsx
+++ b/frontend/src/pages/admin/EnvironmentPage/EnvironmentPage.tsx
@@ -1,27 +0,0 @@
-import { Helmet } from "react-helmet";
-import { useTranslation } from "react-i18next";
-
-import { PageHeader } from "@app/components/v2";
-
-import { EnvironmentPageForm } from "./components";
-
-export const EnvironmentPage = () => {
-  const { t } = useTranslation();
-
-  return (
-    <div className="bg-bunker-800">
-      <Helmet>
-        <title>{t("common.head-title", { title: "Admin" })}</title>
-      </Helmet>
-      <div className="container mx-auto flex flex-col justify-between bg-bunker-800 text-white">
-        <div className="mx-auto mb-6 w-full max-w-7xl">
-          <PageHeader
-            title="Environment"
-            description="Manage the environment for your Infisical instance."
-          />
-          <EnvironmentPageForm />
-        </div>
-      </div>
-    </div>
-  );
-};
--- a/frontend/src/pages/admin/EnvironmentPage/components/EnvironmentPageForm.tsx
+++ b/frontend/src/pages/admin/EnvironmentPage/components/EnvironmentPageForm.tsx
@@ -1,245 +0,0 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { Control, Controller, useForm, useWatch } from "react-hook-form";
-import {
-  faChevronRight,
-  faExclamationTriangle,
-  faMagnifyingGlass
-} from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, Input, SecretInput, Tooltip } from "@app/components/v2";
-import { HighlightText } from "@app/components/v2/HighlightText";
-import { useGetEnvOverrides, useUpdateServerConfig } from "@app/hooks/api";
-
-type TForm = Record<string, string>;
-
-export const GroupContainer = ({
-  group,
-  control,
-  search
-}: {
-  group: {
-    fields: {
-      key: string;
-      value: string;
-      hasEnvEntry: boolean;
-      description?: string;
-    }[];
-    name: string;
-  };
-  control: Control<TForm, any, TForm>;
-  search: string;
-}) => {
-  const [open, setOpen] = useState(false);
-
-  return (
-    <div
-      key={group.name}
-      className="overflow-clip border border-b-0 border-mineshaft-600 bg-mineshaft-800 first:rounded-t-md last:rounded-b-md last:border-b"
-    >
-      <div
-        className="flex h-14 cursor-pointer items-center px-5 py-4 text-sm text-gray-300"
-        role="button"
-        tabIndex={0}
-        onClick={() => setOpen((o) => !o)}
-        onKeyDown={(e) => {
-          if (e.key === "Enter") {
-            setOpen((o) => !o);
-          }
-        }}
-      >
-        <FontAwesomeIcon
-          className={`mr-8 transition-transform duration-100 ${open || search ? "rotate-90" : ""}`}
-          icon={faChevronRight}
-        />
-
-        <div className="flex-grow select-none text-base">{group.name}</div>
-      </div>
-
-      {(open || search) && (
-        <div className="flex flex-col">
-          {group.fields.map((field) => (
-            <div
-              key={field.key}
-              className="flex items-center justify-between gap-4 border-t border-mineshaft-500 bg-mineshaft-700/50 p-4"
-            >
-              <div className="flex max-w-lg flex-col">
-                <span className="text-sm">
-                  <HighlightText text={field.key} highlight={search} />
-                </span>
-                <span className="text-sm text-mineshaft-400">
-                  <HighlightText text={field.description} highlight={search} />
-                </span>
-              </div>
-
-              <div className="flex grow items-center justify-end gap-2">
-                {field.hasEnvEntry && (
-                  <Tooltip
-                    content="Setting this value will override an existing environment variable"
-                    className="text-center"
-                  >
-                    <FontAwesomeIcon icon={faExclamationTriangle} className="text-yellow" />
-                  </Tooltip>
-                )}
-
-                <Controller
-                  control={control}
-                  name={field.key}
-                  render={({ field: formGenField, fieldState: { error } }) => (
-                    <FormControl
-                      isError={Boolean(error)}
-                      errorText={error?.message}
-                      className="mb-0 w-full max-w-sm"
-                    >
-                      <SecretInput
-                        {...formGenField}
-                        autoComplete="off"
-                        containerClassName="text-bunker-300 hover:border-mineshaft-400 border border-mineshaft-600 bg-bunker-600 px-2 py-1.5"
-                      />
-                    </FormControl>
-                  )}
-                />
-              </div>
-            </div>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-};
-
-export const EnvironmentPageForm = () => {
-  const { data: envOverrides } = useGetEnvOverrides();
-  const { mutateAsync: updateServerConfig } = useUpdateServerConfig();
-  const [search, setSearch] = useState("");
-
-  const allFields = useMemo(() => {
-    if (!envOverrides) return [];
-    return Object.values(envOverrides).flatMap((group) => group.fields);
-  }, [envOverrides]);
-
-  const formSchema = useMemo(() => {
-    return z.object(Object.fromEntries(allFields.map((field) => [field.key, z.string()])));
-  }, [allFields]);
-
-  const defaultValues = useMemo(() => {
-    const values: Record<string, string> = {};
-    allFields.forEach((field) => {
-      values[field.key] = field.value ?? "";
-    });
-    return values;
-  }, [allFields]);
-
-  const {
-    control,
-    handleSubmit,
-    reset,
-    formState: { isSubmitting, isDirty }
-  } = useForm<TForm>({
-    resolver: zodResolver(formSchema),
-    defaultValues
-  });
-
-  const formValues = useWatch({ control });
-
-  const filteredData = useMemo(() => {
-    if (!envOverrides) return [];
-
-    const searchTerm = search.toLowerCase().trim();
-    if (!searchTerm) {
-      return Object.values(envOverrides);
-    }
-
-    return Object.values(envOverrides)
-      .map((group) => {
-        const filteredFields = group.fields.filter(
-          (field) =>
-            field.key.toLowerCase().includes(searchTerm) ||
-            (field.description ?? "").toLowerCase().includes(searchTerm)
-        );
-
-        if (filteredFields.length > 0) {
-          return { ...group, fields: filteredFields };
-        }
-        return null;
-      })
-      .filter(Boolean);
-  }, [search, formValues, envOverrides]);
-
-  useEffect(() => {
-    reset(defaultValues);
-  }, [defaultValues, reset]);
-
-  const onSubmit = useCallback(
-    async (formData: TForm) => {
-      try {
-        const filteredFormData = Object.fromEntries(
-          Object.entries(formData).filter(([, value]) => value !== "")
-        );
-        await updateServerConfig({
-          envOverrides: filteredFormData
-        });
-
-        createNotification({
-          type: "success",
-          text: "Environment overrides updated successfully. It can take up to 5 minutes to take effect."
-        });
-
-        reset(formData);
-      } catch (error) {
-        const errorMessage =
-          (error as any)?.response?.data?.message ||
-          (error as any)?.message ||
-          "An unknown error occurred";
-        createNotification({
-          type: "error",
-          title: "Failed to update environment overrides",
-          text: errorMessage
-        });
-      }
-    },
-    [reset, updateServerConfig]
-  );
-
-  return (
-    <form
-      className="flex flex-col gap-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4"
-      onSubmit={handleSubmit(onSubmit)}
-    >
-      <div className="flex w-full flex-row items-center justify-between">
-        <div>
-          <div className="flex items-start gap-1">
-            <p className="text-xl font-semibold text-mineshaft-100">Overrides</p>
-          </div>
-          <p className="text-sm text-bunker-300">Override specific environment variables.</p>
-        </div>
-
-        <div className="flex flex-row gap-2">
-          <Button
-            type="submit"
-            variant="outline_bg"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting || !isDirty}
-          >
-            Save Overrides
-          </Button>
-        </div>
-      </div>
-      <Input
-        value={search}
-        onChange={(e) => setSearch(e.target.value)}
-        leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
-        placeholder="Search for keys, descriptions, and values..."
-        className="flex-1"
-      />
-      <div className="flex flex-col">
-        {filteredData.map((group) => (
-          <GroupContainer group={group!} control={control} search={search} />
-        ))}
-      </div>
-    </form>
-  );
-};
--- a/frontend/src/pages/admin/EnvironmentPage/components/index.ts
+++ b/frontend/src/pages/admin/EnvironmentPage/components/index.ts
@@ -1 +0,0 @@
-export { EnvironmentPageForm } from "./EnvironmentPageForm";
--- a/frontend/src/pages/admin/EnvironmentPage/route.tsx
+++ b/frontend/src/pages/admin/EnvironmentPage/route.tsx
@@ -1,25 +0,0 @@
-import { createFileRoute, linkOptions } from "@tanstack/react-router";
-
-import { EnvironmentPage } from "./EnvironmentPage";
-
-export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/admin/_admin-layout/environment"
-)({
-  component: EnvironmentPage,
-  beforeLoad: async () => {
-    return {
-      breadcrumbs: [
-        {
-          label: "Admin",
-          link: linkOptions({ to: "/admin" })
-        },
-        {
-          label: "Environment",
-          link: linkOptions({
-            to: "/admin/environment"
-          })
-        }
-      ]
-    };
-  }
-});
--- a/frontend/src/routeTree.gen.ts
+++ b/frontend/src/routeTree.gen.ts
@@ -43,7 +43,6 @@ import { Route as authProviderSuccessPageRouteImport } from './pages/auth/Provid
 import { Route as authProviderErrorPageRouteImport } from './pages/auth/ProviderErrorPage/route'
 import { Route as userPersonalSettingsPageRouteImport } from './pages/user/PersonalSettingsPage/route'
 import { Route as adminIntegrationsPageRouteImport } from './pages/admin/IntegrationsPage/route'
-import { Route as adminEnvironmentPageRouteImport } from './pages/admin/EnvironmentPage/route'
 import { Route as adminEncryptionPageRouteImport } from './pages/admin/EncryptionPage/route'
 import { Route as adminCachingPageRouteImport } from './pages/admin/CachingPage/route'
 import { Route as adminAuthenticationPageRouteImport } from './pages/admin/AuthenticationPage/route'
@@ -566,12 +565,6 @@ const adminIntegrationsPageRouteRoute = adminIntegrationsPageRouteImport.update(
  } as any,
 )

-const adminEnvironmentPageRouteRoute = adminEnvironmentPageRouteImport.update({
-  id: '/environment',
-  path: '/environment',
-  getParentRoute: () => adminLayoutRoute,
-} as any)
-
 const adminEncryptionPageRouteRoute = adminEncryptionPageRouteImport.update({
  id: '/encryption',
  path: '/encryption',
@@ -2187,13 +2180,6 @@ declare module '@tanstack/react-router' {
      preLoaderRoute: typeof adminEncryptionPageRouteImport
      parentRoute: typeof adminLayoutImport
    }
-    '/_authenticate/_inject-org-details/admin/_admin-layout/environment': {
-      id: '/_authenticate/_inject-org-details/admin/_admin-layout/environment'
-      path: '/environment'
-      fullPath: '/admin/environment'
-      preLoaderRoute: typeof adminEnvironmentPageRouteImport
-      parentRoute: typeof adminLayoutImport
-    }
    '/_authenticate/_inject-org-details/admin/_admin-layout/integrations': {
      id: '/_authenticate/_inject-org-details/admin/_admin-layout/integrations'
      path: '/integrations'
@@ -4134,7 +4120,6 @@ interface adminLayoutRouteChildren {
  adminAuthenticationPageRouteRoute: typeof adminAuthenticationPageRouteRoute
  adminCachingPageRouteRoute: typeof adminCachingPageRouteRoute
  adminEncryptionPageRouteRoute: typeof adminEncryptionPageRouteRoute
-  adminEnvironmentPageRouteRoute: typeof adminEnvironmentPageRouteRoute
  adminIntegrationsPageRouteRoute: typeof adminIntegrationsPageRouteRoute
  adminMachineIdentitiesResourcesPageRouteRoute: typeof adminMachineIdentitiesResourcesPageRouteRoute
  adminOrganizationResourcesPageRouteRoute: typeof adminOrganizationResourcesPageRouteRoute
@@ -4146,7 +4131,6 @@ const adminLayoutRouteChildren: adminLayoutRouteChildren = {
  adminAuthenticationPageRouteRoute: adminAuthenticationPageRouteRoute,
  adminCachingPageRouteRoute: adminCachingPageRouteRoute,
  adminEncryptionPageRouteRoute: adminEncryptionPageRouteRoute,
-  adminEnvironmentPageRouteRoute: adminEnvironmentPageRouteRoute,
  adminIntegrationsPageRouteRoute: adminIntegrationsPageRouteRoute,
  adminMachineIdentitiesResourcesPageRouteRoute:
    adminMachineIdentitiesResourcesPageRouteRoute,
@@ -4349,7 +4333,6 @@ export interface FileRoutesByFullPath {
  '/admin/authentication': typeof adminAuthenticationPageRouteRoute
  '/admin/caching': typeof adminCachingPageRouteRoute
  '/admin/encryption': typeof adminEncryptionPageRouteRoute
-  '/admin/environment': typeof adminEnvironmentPageRouteRoute
  '/admin/integrations': typeof adminIntegrationsPageRouteRoute
  '/organization/app-connections': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationAppConnectionsRouteWithChildren
  '/organization/gateways': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationGatewaysRouteWithChildren
@@ -4546,7 +4529,6 @@ export interface FileRoutesByTo {
  '/admin/authentication': typeof adminAuthenticationPageRouteRoute
  '/admin/caching': typeof adminCachingPageRouteRoute
  '/admin/encryption': typeof adminEncryptionPageRouteRoute
-  '/admin/environment': typeof adminEnvironmentPageRouteRoute
  '/admin/integrations': typeof adminIntegrationsPageRouteRoute
  '/projects/$projectId': typeof projectLayoutGeneralRouteWithChildren
  '/secret-manager/$projectId': typeof AuthenticateInjectOrgDetailsOrgLayoutSecretManagerProjectIdRouteWithChildren
@@ -4743,7 +4725,6 @@ export interface FileRoutesById {
  '/_authenticate/_inject-org-details/admin/_admin-layout/authentication': typeof adminAuthenticationPageRouteRoute
  '/_authenticate/_inject-org-details/admin/_admin-layout/caching': typeof adminCachingPageRouteRoute
  '/_authenticate/_inject-org-details/admin/_admin-layout/encryption': typeof adminEncryptionPageRouteRoute
-  '/_authenticate/_inject-org-details/admin/_admin-layout/environment': typeof adminEnvironmentPageRouteRoute
  '/_authenticate/_inject-org-details/admin/_admin-layout/integrations': typeof adminIntegrationsPageRouteRoute
  '/_authenticate/_inject-org-details/_org-layout/organization/app-connections': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationAppConnectionsRouteWithChildren
  '/_authenticate/_inject-org-details/_org-layout/organization/gateways': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationGatewaysRouteWithChildren
@@ -4953,7 +4934,6 @@ export interface FileRouteTypes {
    | '/admin/authentication'
    | '/admin/caching'
    | '/admin/encryption'
-    | '/admin/environment'
    | '/admin/integrations'
    | '/organization/app-connections'
    | '/organization/gateways'
@@ -5149,7 +5129,6 @@ export interface FileRouteTypes {
    | '/admin/authentication'
    | '/admin/caching'
    | '/admin/encryption'
-    | '/admin/environment'
    | '/admin/integrations'
    | '/projects/$projectId'
    | '/secret-manager/$projectId'
@@ -5344,7 +5323,6 @@ export interface FileRouteTypes {
    | '/_authenticate/_inject-org-details/admin/_admin-layout/authentication'
    | '/_authenticate/_inject-org-details/admin/_admin-layout/caching'
    | '/_authenticate/_inject-org-details/admin/_admin-layout/encryption'
-    | '/_authenticate/_inject-org-details/admin/_admin-layout/environment'
    | '/_authenticate/_inject-org-details/admin/_admin-layout/integrations'
    | '/_authenticate/_inject-org-details/_org-layout/organization/app-connections'
    | '/_authenticate/_inject-org-details/_org-layout/organization/gateways'
@@ -5751,7 +5729,6 @@ export const routeTree = rootRoute
        "/_authenticate/_inject-org-details/admin/_admin-layout/authentication",
        "/_authenticate/_inject-org-details/admin/_admin-layout/caching",
        "/_authenticate/_inject-org-details/admin/_admin-layout/encryption",
-        "/_authenticate/_inject-org-details/admin/_admin-layout/environment",
        "/_authenticate/_inject-org-details/admin/_admin-layout/integrations",
        "/_authenticate/_inject-org-details/admin/_admin-layout/resources/machine-identities",
        "/_authenticate/_inject-org-details/admin/_admin-layout/resources/organizations",
@@ -5798,10 +5775,6 @@ export const routeTree = rootRoute
      "filePath": "admin/EncryptionPage/route.tsx",
      "parent": "/_authenticate/_inject-org-details/admin/_admin-layout"
    },
-    "/_authenticate/_inject-org-details/admin/_admin-layout/environment": {
-      "filePath": "admin/EnvironmentPage/route.tsx",
-      "parent": "/_authenticate/_inject-org-details/admin/_admin-layout"
-    },
    "/_authenticate/_inject-org-details/admin/_admin-layout/integrations": {
      "filePath": "admin/IntegrationsPage/route.tsx",
      "parent": "/_authenticate/_inject-org-details/admin/_admin-layout"
--- a/frontend/src/routes.ts
+++ b/frontend/src/routes.ts
@@ -8,7 +8,6 @@ const adminRoute = route("/admin", [
    index("admin/GeneralPage/route.tsx"),
    route("/encryption", "admin/EncryptionPage/route.tsx"),
    route("/authentication", "admin/AuthenticationPage/route.tsx"),
-    route("/environment", "admin/EnvironmentPage/route.tsx"),
    route("/integrations", "admin/IntegrationsPage/route.tsx"),
    route("/caching", "admin/CachingPage/route.tsx"),
    route("/resources/organizations", "admin/OrganizationResourcesPage/route.tsx"),
				`@@ -1 +0,0 @@`
				`export { HighlightText } from "./HighlightText";`
				`@@ -1 +0,0 @@`
				`export { EnvironmentPageForm } from "./EnvironmentPageForm";`