Merge branch 'main' into feat/secretsBatchUI

backend/src/services/app-connection/app-connection-enums.ts

@@ -28,7 +28,9 @@ export enum AppConnection {
   Flyio = "flyio",
   GitLab = "gitlab",
   Cloudflare = "cloudflare",
-  Zabbix = "zabbix"
+  Zabbix = "zabbix",
+  Railway = "railway",
+  Bitbucket = "bitbucket"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -50,6 +50,11 @@ import {
   getAzureKeyVaultConnectionListItem,
   validateAzureKeyVaultConnectionCredentials
 } from "./azure-key-vault";
+import {
+  BitbucketConnectionMethod,
+  getBitbucketConnectionListItem,
+  validateBitbucketConnectionCredentials
+} from "./bitbucket";
 import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
 import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
 import {
@@ -86,6 +91,7 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
 import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
 import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
+import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
 import { RenderConnectionMethod } from "./render/render-connection-enums";
 import { getRenderConnectionListItem, validateRenderConnectionCredentials } from "./render/render-connection-fns";
 import {
@@ -138,7 +144,9 @@ export const listAppConnectionOptions = () => {
     getFlyioConnectionListItem(),
     getGitLabConnectionListItem(),
     getCloudflareConnectionListItem(),
-    getZabbixConnectionListItem()
+    getZabbixConnectionListItem(),
+    getRailwayConnectionListItem(),
+    getBitbucketConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -219,7 +227,9 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Flyio]: validateFlyioConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.GitLab]: validateGitLabConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Cloudflare]: validateCloudflareConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Zabbix]: validateZabbixConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.Zabbix]: validateZabbixConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Railway]: validateRailwayConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Bitbucket]: validateBitbucketConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
@@ -256,6 +266,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case VercelConnectionMethod.ApiToken:
     case OnePassConnectionMethod.ApiToken:
     case CloudflareConnectionMethod.APIToken:
+    case BitbucketConnectionMethod.ApiToken:
     case ZabbixConnectionMethod.ApiToken:
       return "API Token";
     case PostgresConnectionMethod.UsernameAndPassword:
@@ -337,7 +348,9 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Flyio]: platformManagedCredentialsNotSupported,
   [AppConnection.GitLab]: platformManagedCredentialsNotSupported,
   [AppConnection.Cloudflare]: platformManagedCredentialsNotSupported,
-  [AppConnection.Zabbix]: platformManagedCredentialsNotSupported
+  [AppConnection.Zabbix]: platformManagedCredentialsNotSupported,
+  [AppConnection.Railway]: platformManagedCredentialsNotSupported,
+  [AppConnection.Bitbucket]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (

backend/src/services/app-connection/app-connection-maps.ts

@@ -30,7 +30,9 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.Flyio]: "Fly.io",
   [AppConnection.GitLab]: "GitLab",
   [AppConnection.Cloudflare]: "Cloudflare",
-  [AppConnection.Zabbix]: "Zabbix"
+  [AppConnection.Zabbix]: "Zabbix",
+  [AppConnection.Railway]: "Railway",
+  [AppConnection.Bitbucket]: "Bitbucket"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -63,5 +65,7 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.Flyio]: AppConnectionPlanType.Regular,
   [AppConnection.GitLab]: AppConnectionPlanType.Regular,
   [AppConnection.Cloudflare]: AppConnectionPlanType.Regular,
-  [AppConnection.Zabbix]: AppConnectionPlanType.Regular
+  [AppConnection.Zabbix]: AppConnectionPlanType.Regular,
+  [AppConnection.Railway]: AppConnectionPlanType.Regular,
+  [AppConnection.Bitbucket]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -45,6 +45,8 @@ import { azureClientSecretsConnectionService } from "./azure-client-secrets/azur
 import { ValidateAzureDevOpsConnectionCredentialsSchema } from "./azure-devops/azure-devops-schemas";
 import { azureDevOpsConnectionService } from "./azure-devops/azure-devops-service";
 import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
+import { ValidateBitbucketConnectionCredentialsSchema } from "./bitbucket";
+import { bitbucketConnectionService } from "./bitbucket/bitbucket-connection-service";
 import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
 import { ValidateCloudflareConnectionCredentialsSchema } from "./cloudflare/cloudflare-connection-schema";
@@ -70,6 +72,8 @@ import { ValidateLdapConnectionCredentialsSchema } from "./ldap";
 import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
 import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
+import { ValidateRailwayConnectionCredentialsSchema } from "./railway";
+import { railwayConnectionService } from "./railway/railway-connection-service";
 import { ValidateRenderConnectionCredentialsSchema } from "./render/render-connection-schema";
 import { renderConnectionService } from "./render/render-connection-service";
 import { ValidateTeamCityConnectionCredentialsSchema } from "./teamcity";
@@ -122,7 +126,9 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Flyio]: ValidateFlyioConnectionCredentialsSchema,
   [AppConnection.GitLab]: ValidateGitLabConnectionCredentialsSchema,
   [AppConnection.Cloudflare]: ValidateCloudflareConnectionCredentialsSchema,
-  [AppConnection.Zabbix]: ValidateZabbixConnectionCredentialsSchema
+  [AppConnection.Zabbix]: ValidateZabbixConnectionCredentialsSchema,
+  [AppConnection.Railway]: ValidateRailwayConnectionCredentialsSchema,
+  [AppConnection.Bitbucket]: ValidateBitbucketConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -533,6 +539,8 @@ export const appConnectionServiceFactory = ({
     flyio: flyioConnectionService(connectAppConnectionById),
     gitlab: gitlabConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     cloudflare: cloudflareConnectionService(connectAppConnectionById),
-    zabbix: zabbixConnectionService(connectAppConnectionById)
+    zabbix: zabbixConnectionService(connectAppConnectionById),
+    railway: railwayConnectionService(connectAppConnectionById),
+    bitbucket: bitbucketConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -56,6 +56,12 @@ import {
   TAzureKeyVaultConnectionInput,
   TValidateAzureKeyVaultConnectionCredentialsSchema
 } from "./azure-key-vault";
+import {
+  TBitbucketConnection,
+  TBitbucketConnectionConfig,
+  TBitbucketConnectionInput,
+  TValidateBitbucketConnectionCredentialsSchema
+} from "./bitbucket";
 import {
   TCamundaConnection,
   TCamundaConnectionConfig,
@@ -135,6 +141,12 @@ import {
   TPostgresConnectionInput,
   TValidatePostgresConnectionCredentialsSchema
 } from "./postgres";
+import {
+  TRailwayConnection,
+  TRailwayConnectionConfig,
+  TRailwayConnectionInput,
+  TValidateRailwayConnectionCredentialsSchema
+} from "./railway";
 import {
   TRenderConnection,
   TRenderConnectionConfig,
@@ -202,7 +214,9 @@ export type TAppConnection = { id: string } & (
   | TFlyioConnection
   | TGitLabConnection
   | TCloudflareConnection
+  | TBitbucketConnection
   | TZabbixConnection
+  | TRailwayConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -239,7 +253,9 @@ export type TAppConnectionInput = { id: string } & (
   | TFlyioConnectionInput
   | TGitLabConnectionInput
   | TCloudflareConnectionInput
+  | TBitbucketConnectionInput
   | TZabbixConnectionInput
+  | TRailwayConnectionInput
 );
 
 export type TSqlConnectionInput =
@@ -284,7 +300,9 @@ export type TAppConnectionConfig =
   | TFlyioConnectionConfig
   | TGitLabConnectionConfig
   | TCloudflareConnectionConfig
-  | TZabbixConnectionConfig;
+  | TBitbucketConnectionConfig
+  | TZabbixConnectionConfig
+  | TRailwayConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -316,7 +334,9 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateFlyioConnectionCredentialsSchema
   | TValidateGitLabConnectionCredentialsSchema
   | TValidateCloudflareConnectionCredentialsSchema
-  | TValidateZabbixConnectionCredentialsSchema;
+  | TValidateBitbucketConnectionCredentialsSchema
+  | TValidateZabbixConnectionCredentialsSchema
+  | TValidateRailwayConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/app-connection/bitbucket/bitbucket-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum BitbucketConnectionMethod {
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/bitbucket/bitbucket-connection-fns.ts

@@ -0,0 +1,117 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { BitbucketConnectionMethod } from "./bitbucket-connection-enums";
+import {
+  TBitbucketConnection,
+  TBitbucketConnectionConfig,
+  TBitbucketRepo,
+  TBitbucketWorkspace
+} from "./bitbucket-connection-types";
+
+export const getBitbucketConnectionListItem = () => {
+  return {
+    name: "Bitbucket" as const,
+    app: AppConnection.Bitbucket as const,
+    methods: Object.values(BitbucketConnectionMethod) as [BitbucketConnectionMethod.ApiToken]
+  };
+};
+
+export const getBitbucketUser = async ({ email, apiToken }: { email: string; apiToken: string }) => {
+  try {
+    const { data } = await request.get<{ username: string }>(`${IntegrationUrls.BITBUCKET_API_URL}/2.0/user`, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${email}:${apiToken}`).toString("base64")}`,
+        Accept: "application/json"
+      }
+    });
+
+    return data;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate connection: verify credentials"
+    });
+  }
+};
+
+export const validateBitbucketConnectionCredentials = async (config: TBitbucketConnectionConfig) => {
+  await getBitbucketUser(config.credentials);
+  return config.credentials;
+};
+
+interface BitbucketWorkspacesResponse {
+  values: TBitbucketWorkspace[];
+  next?: string;
+}
+
+export const listBitbucketWorkspaces = async (appConnection: TBitbucketConnection) => {
+  const { email, apiToken } = appConnection.credentials;
+
+  const headers = {
+    Authorization: `Basic ${Buffer.from(`${email}:${apiToken}`).toString("base64")}`,
+    Accept: "application/json"
+  };
+
+  let allWorkspaces: TBitbucketWorkspace[] = [];
+  let nextUrl: string | undefined = `${IntegrationUrls.BITBUCKET_API_URL}/2.0/workspaces?pagelen=100`;
+  let iterationCount = 0;
+
+  // Limit to 10 iterations, fetching at most 10 * 100 = 1000 workspaces
+  while (nextUrl && iterationCount < 10) {
+    // eslint-disable-next-line no-await-in-loop
+    const { data }: { data: BitbucketWorkspacesResponse } = await request.get<BitbucketWorkspacesResponse>(nextUrl, {
+      headers
+    });
+
+    allWorkspaces = allWorkspaces.concat(data.values.map((workspace) => ({ slug: workspace.slug })));
+    nextUrl = data.next;
+    iterationCount += 1;
+  }
+
+  return allWorkspaces;
+};
+
+interface BitbucketRepositoriesResponse {
+  values: TBitbucketRepo[];
+  next?: string;
+}
+
+export const listBitbucketRepositories = async (appConnection: TBitbucketConnection, workspaceSlug: string) => {
+  const { email, apiToken } = appConnection.credentials;
+
+  const headers = {
+    Authorization: `Basic ${Buffer.from(`${email}:${apiToken}`).toString("base64")}`,
+    Accept: "application/json"
+  };
+
+  let allRepos: TBitbucketRepo[] = [];
+  let nextUrl: string | undefined =
+    `${IntegrationUrls.BITBUCKET_API_URL}/2.0/repositories/${encodeURIComponent(workspaceSlug)}?pagelen=100`;
+  let iterationCount = 0;
+
+  // Limit to 10 iterations, fetching at most 10 * 100 = 1000 repositories
+  while (nextUrl && iterationCount < 10) {
+    // eslint-disable-next-line no-await-in-loop
+    const { data }: { data: BitbucketRepositoriesResponse } = await request.get<BitbucketRepositoriesResponse>(
+      nextUrl,
+      {
+        headers
+      }
+    );
+
+    allRepos = allRepos.concat(data.values);
+    nextUrl = data.next;
+    iterationCount += 1;
+  }
+
+  return allRepos;
+};

backend/src/services/app-connection/bitbucket/bitbucket-connection-schemas.ts

@@ -0,0 +1,72 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { BitbucketConnectionMethod } from "./bitbucket-connection-enums";
+
+export const BitbucketConnectionAccessTokenCredentialsSchema = z.object({
+  apiToken: z
+    .string()
+    .trim()
+    .min(1, "API Token required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.BITBUCKET.apiToken),
+  email: z
+    .string()
+    .email()
+    .trim()
+    .min(1, "Email required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.BITBUCKET.email)
+});
+
+const BaseBitbucketConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Bitbucket) });
+
+export const BitbucketConnectionSchema = BaseBitbucketConnectionSchema.extend({
+  method: z.literal(BitbucketConnectionMethod.ApiToken),
+  credentials: BitbucketConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedBitbucketConnectionSchema = z.discriminatedUnion("method", [
+  BaseBitbucketConnectionSchema.extend({
+    method: z.literal(BitbucketConnectionMethod.ApiToken),
+    credentials: BitbucketConnectionAccessTokenCredentialsSchema.pick({
+      email: true
+    })
+  })
+]);
+
+export const ValidateBitbucketConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(BitbucketConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.Bitbucket).method),
+    credentials: BitbucketConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Bitbucket).credentials
+    )
+  })
+]);
+
+export const CreateBitbucketConnectionSchema = ValidateBitbucketConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Bitbucket)
+);
+
+export const UpdateBitbucketConnectionSchema = z
+  .object({
+    credentials: BitbucketConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Bitbucket).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Bitbucket));
+
+export const BitbucketConnectionListItemSchema = z.object({
+  name: z.literal("Bitbucket"),
+  app: z.literal(AppConnection.Bitbucket),
+  methods: z.nativeEnum(BitbucketConnectionMethod).array()
+});

backend/src/services/app-connection/bitbucket/bitbucket-connection-service.ts

@@ -0,0 +1,33 @@
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listBitbucketRepositories, listBitbucketWorkspaces } from "./bitbucket-connection-fns";
+import { TBitbucketConnection, TGetBitbucketRepositoriesDTO } from "./bitbucket-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TBitbucketConnection>;
+
+export const bitbucketConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listWorkspaces = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Bitbucket, connectionId, actor);
+    const workspaces = await listBitbucketWorkspaces(appConnection);
+    return workspaces;
+  };
+
+  const listRepositories = async (
+    { connectionId, workspaceSlug }: TGetBitbucketRepositoriesDTO,
+    actor: OrgServiceActor
+  ) => {
+    const appConnection = await getAppConnection(AppConnection.Bitbucket, connectionId, actor);
+    const repositories = await listBitbucketRepositories(appConnection, workspaceSlug);
+    return repositories;
+  };
+
+  return {
+    listWorkspaces,
+    listRepositories
+  };
+};

backend/src/services/app-connection/bitbucket/bitbucket-connection-types.ts

@@ -0,0 +1,40 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  BitbucketConnectionSchema,
+  CreateBitbucketConnectionSchema,
+  ValidateBitbucketConnectionCredentialsSchema
+} from "./bitbucket-connection-schemas";
+
+export type TBitbucketConnection = z.infer<typeof BitbucketConnectionSchema>;
+
+export type TBitbucketConnectionInput = z.infer<typeof CreateBitbucketConnectionSchema> & {
+  app: AppConnection.Bitbucket;
+};
+
+export type TValidateBitbucketConnectionCredentialsSchema = typeof ValidateBitbucketConnectionCredentialsSchema;
+
+export type TBitbucketConnectionConfig = DiscriminativePick<
+  TBitbucketConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TGetBitbucketRepositoriesDTO = {
+  connectionId: string;
+  workspaceSlug: string;
+};
+
+export type TBitbucketWorkspace = {
+  slug: string;
+};
+
+export type TBitbucketRepo = {
+  uuid: string;
+  full_name: string; // workspace-slug/repo-slug
+  slug: string;
+};

backend/src/services/app-connection/bitbucket/index.ts

@@ -0,0 +1,4 @@
+export * from "./bitbucket-connection-enums";
+export * from "./bitbucket-connection-fns";
+export * from "./bitbucket-connection-schemas";
+export * from "./bitbucket-connection-types";

backend/src/services/app-connection/railway/index.ts

@@ -0,0 +1,4 @@
+export * from "./railway-connection-constants";
+export * from "./railway-connection-fns";
+export * from "./railway-connection-schemas";
+export * from "./railway-connection-types";

backend/src/services/app-connection/railway/railway-connection-constants.ts

@@ -0,0 +1,5 @@
+export enum RailwayConnectionMethod {
+  AccountToken = "account-token",
+  ProjectToken = "project-token",
+  TeamToken = "team-token"
+}

backend/src/services/app-connection/railway/railway-connection-fns.ts

@@ -0,0 +1,66 @@
+/* eslint-disable no-await-in-loop */
+import { AxiosError } from "axios";
+
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { RailwayConnectionMethod } from "./railway-connection-constants";
+import { RailwayPublicAPI } from "./railway-connection-public-client";
+import { TRailwayConnection, TRailwayConnectionConfig } from "./railway-connection-types";
+
+export const getRailwayConnectionListItem = () => {
+  return {
+    name: "Railway" as const,
+    app: AppConnection.Railway as const,
+    methods: Object.values(RailwayConnectionMethod)
+  };
+};
+
+export const validateRailwayConnectionCredentials = async (config: TRailwayConnectionConfig) => {
+  const { credentials, method } = config;
+
+  try {
+    await RailwayPublicAPI.healthcheck({
+      method,
+      credentials
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to validate connection - verify credentials"
+    });
+  }
+
+  return credentials;
+};
+
+export const listProjects = async (appConnection: TRailwayConnection) => {
+  const { credentials, method } = appConnection;
+
+  try {
+    return await RailwayPublicAPI.listProjects({
+      method,
+      credentials
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list projects: ${error.message || "Unknown error"}`
+      });
+    }
+
+    if (error instanceof BadRequestError) {
+      throw error;
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list projects",
+      error
+    });
+  }
+};

backend/src/services/app-connection/railway/railway-connection-public-client.ts

@@ -0,0 +1,237 @@
+/* eslint-disable class-methods-use-this */
+import { AxiosError, AxiosInstance, AxiosResponse } from "axios";
+
+import { createRequestClient } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { RailwayConnectionMethod } from "./railway-connection-constants";
+import {
+  RailwayAccountWorkspaceListSchema,
+  RailwayGetProjectsByProjectTokenSchema,
+  RailwayGetSubscriptionTypeSchema,
+  RailwayProjectsListSchema
+} from "./railway-connection-schemas";
+import { RailwayProject, TRailwayConnectionConfig, TRailwayResponse } from "./railway-connection-types";
+
+type RailwaySendReqOptions = Pick<TRailwayConnectionConfig, "credentials" | "method">;
+
+export function getRailwayAuthHeaders(method: RailwayConnectionMethod, token: string): Record<string, string> {
+  switch (method) {
+    case RailwayConnectionMethod.AccountToken:
+    case RailwayConnectionMethod.TeamToken:
+      return {
+        Authorization: token
+      };
+    case RailwayConnectionMethod.ProjectToken:
+      return {
+        "Project-Access-Token": token
+      };
+    default:
+      throw new Error(`Unsupported Railway connection method`);
+  }
+}
+
+export function getRailwayRatelimiter(headers: AxiosResponse["headers"]): {
+  isRatelimited: boolean;
+  maxAttempts: number;
+  wait: () => Promise<void>;
+} {
+  const retryAfter: number | undefined = headers["Retry-After"] as number | undefined;
+  const requestsLeft = parseInt(headers["X-RateLimit-Remaining"] as string, 10);
+  const limitResetAt = headers["X-RateLimit-Reset"] as string;
+
+  const now = +new Date();
+  const nextReset = +new Date(limitResetAt);
+
+  const remaining = Math.min(0, nextReset - now);
+
+  const wait = () => {
+    return new Promise<void>((res) => {
+      setTimeout(res, remaining);
+    });
+  };
+
+  return {
+    isRatelimited: Boolean(retryAfter || requestsLeft === 0),
+    wait,
+    maxAttempts: 3
+  };
+}
+
+class RailwayPublicClient {
+  private client: AxiosInstance;
+
+  constructor() {
+    this.client = createRequestClient({
+      method: "POST",
+      baseURL: IntegrationUrls.RAILWAY_API_URL,
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  }
+
+  async send<T extends TRailwayResponse>(
+    query: string,
+    options: RailwaySendReqOptions,
+    variables: Record<string, string | Record<string, string>> = {},
+    retryAttempt: number = 0
+  ): Promise<T["data"] | undefined> {
+    const body = {
+      query,
+      variables
+    };
+
+    const response = await this.client.request<T>({
+      data: body,
+      headers: getRailwayAuthHeaders(options.method, options.credentials.apiToken)
+    });
+
+    const { errors } = response.data;
+
+    if (Array.isArray(errors) && errors.length > 0) {
+      throw new AxiosError(errors[0].message);
+    }
+
+    const limiter = getRailwayRatelimiter(response.headers);
+
+    if (limiter.isRatelimited && retryAttempt <= limiter.maxAttempts) {
+      await limiter.wait();
+      return this.send(query, options, variables, retryAttempt + 1);
+    }
+
+    return response.data.data;
+  }
+
+  healthcheck(config: RailwaySendReqOptions) {
+    switch (config.method) {
+      case RailwayConnectionMethod.AccountToken:
+        return this.send(`{ me { teams { edges { node { id } } } } }`, config);
+      case RailwayConnectionMethod.ProjectToken:
+        return this.send(`{ projectToken { projectId environmentId project { id } } }`, config);
+      case RailwayConnectionMethod.TeamToken:
+        return this.send(`{ projects { edges { node { id name team { id } } } } }`, config);
+      default:
+        throw new Error(`Unsupported Railway connection method`);
+    }
+  }
+
+  async getSubscriptionType(config: RailwaySendReqOptions & { projectId: string }) {
+    const res = await this.send(
+      `query project($projectId: String!) { project(id: $projectId) { subscriptionType }}`,
+      config,
+      {
+        projectId: config.projectId
+      }
+    );
+
+    const data = await RailwayGetSubscriptionTypeSchema.parseAsync(res);
+
+    return data.project.subscriptionType;
+  }
+
+  async listProjects(config: RailwaySendReqOptions): Promise<RailwayProject[]> {
+    switch (config.method) {
+      case RailwayConnectionMethod.TeamToken: {
+        const res = await this.send(
+          `{ projects { edges { node { id, name, services{ edges{ node { id, name } } } environments { edges { node { name, id } } } } } } }`,
+          config
+        );
+
+        const data = await RailwayProjectsListSchema.parseAsync(res);
+
+        return data.projects.edges.map((p) => ({
+          id: p.node.id,
+          name: p.node.name,
+          environments: p.node.environments.edges.map((e) => e.node),
+          services: p.node.services.edges.map((s) => s.node)
+        }));
+      }
+
+      case RailwayConnectionMethod.AccountToken: {
+        const res = await this.send(
+          `{ me { workspaces { id, name, team{ projects{ edges{ node{ id, name, services{ edges { node { name, id } } } environments { edges { node { name, id } } } } } } } } } }`,
+          config
+        );
+
+        const data = await RailwayAccountWorkspaceListSchema.parseAsync(res);
+
+        return data.me.workspaces.flatMap((w) =>
+          w.team.projects.edges.map((p) => ({
+            id: p.node.id,
+            name: p.node.name,
+            environments: p.node.environments.edges.map((e) => e.node),
+            services: p.node.services.edges.map((s) => s.node)
+          }))
+        );
+      }
+
+      case RailwayConnectionMethod.ProjectToken: {
+        const res = await this.send(
+          `query { projectToken { project { id, name, services { edges { node { name, id } } } environments { edges { node { name, id } } } } } }`,
+          config
+        );
+
+        const data = await RailwayGetProjectsByProjectTokenSchema.parseAsync(res);
+
+        const p = data.projectToken.project;
+
+        return [
+          {
+            id: p.id,
+            name: p.name,
+            environments: p.environments.edges.map((e) => e.node),
+            services: p.services.edges.map((s) => s.node)
+          }
+        ];
+      }
+
+      default:
+        throw new Error(`Unsupported Railway connection method`);
+    }
+  }
+
+  async getVariables(
+    config: RailwaySendReqOptions,
+    variables: { projectId: string; environmentId: string; serviceId?: string }
+  ) {
+    const res = await this.send<TRailwayResponse<{ variables: Record<string, string> }>>(
+      `query variables($environmentId: String!, $projectId: String!, $serviceId: String) { variables( projectId: $projectId, environmentId: $environmentId, serviceId: $serviceId ) }`,
+      config,
+      variables
+    );
+
+    if (!res?.variables) {
+      throw new BadRequestError({
+        message: "Failed to get railway variables - empty response"
+      });
+    }
+
+    return res.variables;
+  }
+
+  async deleteVariable(
+    config: RailwaySendReqOptions,
+    variables: { input: { projectId: string; environmentId: string; name: string; serviceId?: string } }
+  ) {
+    await this.send<TRailwayResponse<{ variables: Record<string, string> }>>(
+      `mutation variableDelete($input: VariableDeleteInput!) { variableDelete(input: $input) }`,
+      config,
+      variables
+    );
+  }
+
+  async upsertVariable(
+    config: RailwaySendReqOptions,
+    variables: { input: { projectId: string; environmentId: string; name: string; value: string; serviceId?: string } }
+  ) {
+    await this.send<TRailwayResponse<{ variables: Record<string, string> }>>(
+      `mutation variableUpsert($input: VariableUpsertInput!) { variableUpsert(input: $input) }`,
+      config,
+      variables
+    );
+  }
+}
+
+export const RailwayPublicAPI = new RailwayPublicClient();

backend/src/services/app-connection/railway/railway-connection-schemas.ts

@@ -0,0 +1,117 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { RailwayConnectionMethod } from "./railway-connection-constants";
+
+export const RailwayConnectionMethodSchema = z
+  .nativeEnum(RailwayConnectionMethod)
+  .describe(AppConnections.CREATE(AppConnection.Railway).method);
+
+export const RailwayConnectionAccessTokenCredentialsSchema = z.object({
+  apiToken: z
+    .string()
+    .trim()
+    .min(1, "API Token required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.RAILWAY.apiToken)
+});
+
+const BaseRailwayConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.Railway)
+});
+
+export const RailwayConnectionSchema = BaseRailwayConnectionSchema.extend({
+  method: RailwayConnectionMethodSchema,
+  credentials: RailwayConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedRailwayConnectionSchema = z.discriminatedUnion("method", [
+  BaseRailwayConnectionSchema.extend({
+    method: RailwayConnectionMethodSchema,
+    credentials: RailwayConnectionAccessTokenCredentialsSchema.pick({})
+  })
+]);
+
+export const ValidateRailwayConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: RailwayConnectionMethodSchema,
+    credentials: RailwayConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Railway).credentials
+    )
+  })
+]);
+
+export const CreateRailwayConnectionSchema = ValidateRailwayConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Railway)
+);
+
+export const UpdateRailwayConnectionSchema = z
+  .object({
+    credentials: RailwayConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Railway).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Railway));
+
+export const RailwayConnectionListItemSchema = z.object({
+  name: z.literal("Railway"),
+  app: z.literal(AppConnection.Railway),
+  methods: z.nativeEnum(RailwayConnectionMethod).array()
+});
+
+export const RailwayResourceSchema = z.object({
+  node: z.object({
+    id: z.string(),
+    name: z.string()
+  })
+});
+
+export const RailwayProjectEdgeSchema = z.object({
+  node: z.object({
+    id: z.string(),
+    name: z.string(),
+    services: z.object({
+      edges: z.array(RailwayResourceSchema)
+    }),
+    environments: z.object({
+      edges: z.array(RailwayResourceSchema)
+    })
+  })
+});
+
+export const RailwayProjectsListSchema = z.object({
+  projects: z.object({
+    edges: z.array(RailwayProjectEdgeSchema)
+  })
+});
+
+export const RailwayAccountWorkspaceListSchema = z.object({
+  me: z.object({
+    workspaces: z.array(
+      z.object({
+        id: z.string(),
+        name: z.string(),
+        team: RailwayProjectsListSchema
+      })
+    )
+  })
+});
+
+export const RailwayGetProjectsByProjectTokenSchema = z.object({
+  projectToken: z.object({
+    project: RailwayProjectEdgeSchema.shape.node
+  })
+});
+
+export const RailwayGetSubscriptionTypeSchema = z.object({
+  project: z.object({
+    subscriptionType: z.enum(["free", "hobby", "pro", "trial"])
+  })
+});

backend/src/services/app-connection/railway/railway-connection-service.ts

@@ -0,0 +1,30 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listProjects as getRailwayProjects } from "./railway-connection-fns";
+import { TRailwayConnection } from "./railway-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TRailwayConnection>;
+
+export const railwayConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Railway, connectionId, actor);
+    try {
+      const projects = await getRailwayProjects(appConnection);
+
+      return projects;
+    } catch (error) {
+      logger.error(error, "Failed to establish connection with Railway");
+      return [];
+    }
+  };
+
+  return {
+    listProjects
+  };
+};

backend/src/services/app-connection/railway/railway-connection-types.ts

@@ -0,0 +1,79 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateRailwayConnectionSchema,
+  RailwayConnectionSchema,
+  ValidateRailwayConnectionCredentialsSchema
+} from "./railway-connection-schemas";
+
+export type TRailwayConnection = z.infer<typeof RailwayConnectionSchema>;
+
+export type TRailwayConnectionInput = z.infer<typeof CreateRailwayConnectionSchema> & {
+  app: AppConnection.Railway;
+};
+
+export type TValidateRailwayConnectionCredentialsSchema = typeof ValidateRailwayConnectionCredentialsSchema;
+
+export type TRailwayConnectionConfig = DiscriminativePick<TRailwayConnection, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
+
+export type TRailwayService = {
+  id: string;
+  name: string;
+};
+
+export type TRailwayEnvironment = {
+  id: string;
+  name: string;
+};
+
+export type RailwayProject = {
+  id: string;
+  name: string;
+  services: TRailwayService[];
+  environments: TRailwayEnvironment[];
+};
+
+export type TRailwayResponse<T = unknown> = {
+  data?: T;
+  errors?: {
+    message: string;
+  }[];
+};
+
+export type TAccountProjectListResponse = TRailwayResponse<{
+  projects: {
+    edges: TProjectEdge[];
+  };
+}>;
+
+export interface TProjectEdge {
+  node: {
+    id: string;
+    name: string;
+    services: {
+      edges: TServiceEdge[];
+    };
+    environments: {
+      edges: TEnvironmentEdge[];
+    };
+  };
+}
+
+type TServiceEdge = {
+  node: {
+    id: string;
+    name: string;
+  };
+};
+
+type TEnvironmentEdge = {
+  node: {
+    id: string;
+    name: string;
+  };
+};

backend/src/services/integration-auth/integration-app-list.ts

@@ -814,9 +814,9 @@ const getAppsCloudflareWorkers = async ({ accessToken, accountId }: { accessToke
 };
 
 /**
- * Return list of repositories for the BitBucket integration based on provided BitBucket workspace
+ * Return list of repositories for the Bitbucket integration based on provided Bitbucket workspace
  */
-const getAppsBitBucket = async ({ accessToken, workspaceSlug }: { accessToken: string; workspaceSlug?: string }) => {
+const getAppsBitbucket = async ({ accessToken, workspaceSlug }: { accessToken: string; workspaceSlug?: string }) => {
   interface RepositoriesResponse {
     size: number;
     page: number;
@@ -1302,7 +1302,7 @@ export const getApps = async ({
       });
 
     case Integrations.BITBUCKET:
-      return getAppsBitBucket({
+      return getAppsBitbucket({
         accessToken,
         workspaceSlug
       });

backend/src/services/integration-auth/integration-list.ts

@@ -342,7 +342,7 @@ export const getIntegrationOptions = async () => {
     {
       name: "Bitbucket",
       slug: "bitbucket",
-      image: "BitBucket.png",
+      image: "Bitbucket.png",
       isAvailable: true,
       type: "oauth",
       clientId: appCfg.CLIENT_ID_BITBUCKET,

backend/src/services/integration-auth/integration-sync-secret.ts

@@ -3921,9 +3921,9 @@ const syncSecretsCloudflareWorkers = async ({
 };
 
 /**
- * Sync/push [secrets] to BitBucket repo with name [integration.app]
+ * Sync/push [secrets] to Bitbucket repo with name [integration.app]
  */
-const syncSecretsBitBucket = async ({
+const syncSecretsBitbucket = async ({
   integration,
   secrets,
   accessToken
@@ -4832,7 +4832,7 @@ export const syncIntegrationSecrets = async ({
       });
       break;
     case Integrations.BITBUCKET:
-      await syncSecretsBitBucket({
+      await syncSecretsBitbucket({
         integration,
         secrets,
         accessToken

backend/src/services/integration-auth/integration-token.ts

@@ -64,7 +64,7 @@ type ExchangeCodeGitlabResponse = {
   created_at: number;
 };
 
-type ExchangeCodeBitBucketResponse = {
+type ExchangeCodeBitbucketResponse = {
   access_token: string;
   token_type: string;
   expires_in: number;
@@ -392,10 +392,10 @@ const exchangeCodeGitlab = async ({ code, url }: { code: string; url?: string })
 };
 
 /**
- * Return [accessToken], [accessExpiresAt], and [refreshToken] for BitBucket
+ * Return [accessToken], [accessExpiresAt], and [refreshToken] for Bitbucket
  * code-token exchange
  */
-const exchangeCodeBitBucket = async ({ code }: { code: string }) => {
+const exchangeCodeBitbucket = async ({ code }: { code: string }) => {
   const accessExpiresAt = new Date();
   const appCfg = getConfig();
   if (!appCfg.CLIENT_SECRET_BITBUCKET || !appCfg.CLIENT_ID_BITBUCKET) {
@@ -403,7 +403,7 @@ const exchangeCodeBitBucket = async ({ code }: { code: string }) => {
   }
 
   const res = (
-    await request.post<ExchangeCodeBitBucketResponse>(
+    await request.post<ExchangeCodeBitbucketResponse>(
       IntegrationUrls.BITBUCKET_TOKEN_URL,
       new URLSearchParams({
         grant_type: "authorization_code",
@@ -490,7 +490,7 @@ export const exchangeCode = async ({
         url
       });
     case Integrations.BITBUCKET:
-      return exchangeCodeBitBucket({
+      return exchangeCodeBitbucket({
         code
       });
     default:
@@ -524,7 +524,7 @@ type RefreshTokenGitLabResponse = {
   created_at: number;
 };
 
-type RefreshTokenBitBucketResponse = {
+type RefreshTokenBitbucketResponse = {
   access_token: string;
   token_type: string;
   expires_in: number;
@@ -653,9 +653,9 @@ const exchangeRefreshGitLab = async ({ refreshToken, url }: { url?: string | nul
 
 /**
  * Return new access token by exchanging refresh token [refreshToken] for the
- * BitBucket integration
+ * Bitbucket integration
  */
-const exchangeRefreshBitBucket = async ({ refreshToken }: { refreshToken: string }) => {
+const exchangeRefreshBitbucket = async ({ refreshToken }: { refreshToken: string }) => {
   const accessExpiresAt = new Date();
   const appCfg = getConfig();
   if (!appCfg.CLIENT_SECRET_BITBUCKET || !appCfg.CLIENT_ID_BITBUCKET) {
@@ -664,7 +664,7 @@ const exchangeRefreshBitBucket = async ({ refreshToken }: { refreshToken: string
   const {
     data
   }: {
-    data: RefreshTokenBitBucketResponse;
+    data: RefreshTokenBitbucketResponse;
   } = await request.post(
     IntegrationUrls.BITBUCKET_TOKEN_URL,
     new URLSearchParams({
@@ -794,7 +794,7 @@ export const exchangeRefresh = async (
         url
       });
     case Integrations.BITBUCKET:
-      return exchangeRefreshBitBucket({
+      return exchangeRefreshBitbucket({
         refreshToken
       });
     case Integrations.GCP_SECRET_MANAGER:

backend/src/services/org-membership/org-membership-dal.ts

@@ -108,22 +108,22 @@ export const orgMembershipDALFactory = (db: TDbClient) => {
       const now = new Date();
       const oneWeekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);
       const oneMonthAgo = new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000);
-      const threeMonthsAgo = new Date(now.getTime() - 90 * 24 * 60 * 60 * 1000);
+      const twelveMonthsAgo = new Date(now.getTime() - 360 * 24 * 60 * 60 * 1000);
 
       const memberships = await db
         .replicaNode()(TableName.OrgMembership)
         .where("status", "invited")
         .where((qb) => {
-          // lastInvitedAt is null AND createdAt is between 1 week and 3 months ago
+          // lastInvitedAt is null AND createdAt is between 1 week and 12 months ago
           void qb
             .whereNull(`${TableName.OrgMembership}.lastInvitedAt`)
-            .whereBetween(`${TableName.OrgMembership}.createdAt`, [threeMonthsAgo, oneWeekAgo]);
+            .whereBetween(`${TableName.OrgMembership}.createdAt`, [twelveMonthsAgo, oneWeekAgo]);
         })
         .orWhere((qb) => {
           // lastInvitedAt is older than 1 week ago AND createdAt is younger than 1 month ago
           void qb
-            .where(`${TableName.OrgMembership}.lastInvitedAt`, "<", oneMonthAgo)
-            .where(`${TableName.OrgMembership}.createdAt`, ">", oneWeekAgo);
+            .where(`${TableName.OrgMembership}.lastInvitedAt`, "<", oneWeekAgo)
+            .where(`${TableName.OrgMembership}.createdAt`, ">", oneMonthAgo);
         });
 
       return memberships;
@@ -135,9 +135,22 @@ export const orgMembershipDALFactory = (db: TDbClient) => {
     }
   };
 
+  const updateLastInvitedAtByIds = async (membershipIds: string[]) => {
+    try {
+      if (membershipIds.length === 0) return;
+      await db(TableName.OrgMembership).whereIn("id", membershipIds).update({ lastInvitedAt: new Date() });
+    } catch (error) {
+      throw new DatabaseError({
+        error,
+        name: "Update last invited at by ids"
+      });
+    }
+  };
+
   return {
     ...orgMembershipOrm,
     findOrgMembershipById,
-    findRecentInvitedMemberships
+    findRecentInvitedMemberships,
+    updateLastInvitedAtByIds
   };
 };

backend/src/services/org/org-service.ts

@@ -36,6 +36,8 @@ import { getConfig } from "@app/lib/config/env";
 import { generateAsymmetricKeyPair } from "@app/lib/crypto";
 import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys } from "@app/lib/crypto/srp";
+import { applyJitter } from "@app/lib/dates";
+import { delay as delayMs } from "@app/lib/delay";
 import {
   BadRequestError,
   ForbiddenRequestError,
@@ -44,9 +46,10 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
+import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { isDisposableEmail } from "@app/lib/validator";
-import { TQueueServiceFactory } from "@app/queue";
+import { QueueName, TQueueServiceFactory } from "@app/queue";
 import { getDefaultOrgMembershipRoleForUpdateOrg } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
@@ -109,7 +112,12 @@ type TOrgServiceFactoryDep = {
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "insertMany" | "findLatestProjectKey" | "create">;
   orgMembershipDAL: Pick<
     TOrgMembershipDALFactory,
-    "findOrgMembershipById" | "findOne" | "findById" | "findRecentInvitedMemberships" | "updateById"
+    | "findOrgMembershipById"
+    | "findOne"
+    | "findById"
+    | "findRecentInvitedMemberships"
+    | "updateById"
+    | "updateLastInvitedAtByIds"
   >;
   incidentContactDAL: TIncidentContactsDALFactory;
   samlConfigDAL: Pick<TSamlConfigDALFactory, "findOne">;
@@ -763,6 +771,10 @@ export const orgServiceFactory = ({
       }
     });
 
+    await orgMembershipDAL.updateById(inviteeOrgMembership.id, {
+      lastInvitedAt: new Date()
+    });
+
     return { signupToken: undefined };
   };
 
@@ -900,14 +912,6 @@ export const orgServiceFactory = ({
 
         // if there exist no org membership we set is as given by the request
         if (!inviteeOrgMembership) {
-          if (plan?.slug !== "enterprise" && plan?.memberLimit && plan.membersUsed >= plan.memberLimit) {
-            // limit imposed on number of members allowed / number of members used exceeds the number of members allowed
-            throw new BadRequestError({
-              name: "InviteUser",
-              message: "Failed to invite member due to member limit reached. Upgrade plan to invite more members."
-            });
-          }
-
           if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
             // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
             throw new BadRequestError({
@@ -1429,10 +1433,13 @@ export const orgServiceFactory = ({
    * Re-send emails to users who haven't accepted an invite yet
    */
   const notifyInvitedUsers = async () => {
+    logger.info(`${QueueName.DailyResourceCleanUp}: notify invited users started`);
+
     const invitedUsers = await orgMembershipDAL.findRecentInvitedMemberships();
     const appCfg = getConfig();
 
     const orgCache: Record<string, { name: string; id: string } | undefined> = {};
+    const notifiedUsers: string[] = [];
 
     await Promise.all(
       invitedUsers.map(async (invitedUser) => {
@@ -1451,25 +1458,32 @@ export const orgServiceFactory = ({
         });
 
         if (invitedUser.inviteEmail) {
-          await smtpService.sendMail({
-            template: SmtpTemplates.OrgInvite,
-            subjectLine: `Reminder: You have been invited to ${org.name} on Infisical`,
-            recipients: [invitedUser.inviteEmail],
-            substitutions: {
-              organizationName: org.name,
-              email: invitedUser.inviteEmail,
-              organizationId: org.id.toString(),
-              token,
-              callback_url: `${appCfg.SITE_URL}/signupinvite`
-            }
-          });
-        }
+          await delayMs(Math.max(0, applyJitter(0, 2000)));
 
-        await orgMembershipDAL.updateById(invitedUser.id, {
-          lastInvitedAt: new Date()
-        });
+          try {
+            await smtpService.sendMail({
+              template: SmtpTemplates.OrgInvite,
+              subjectLine: `Reminder: You have been invited to ${org.name} on Infisical`,
+              recipients: [invitedUser.inviteEmail],
+              substitutions: {
+                organizationName: org.name,
+                email: invitedUser.inviteEmail,
+                organizationId: org.id.toString(),
+                token,
+                callback_url: `${appCfg.SITE_URL}/signupinvite`
+              }
+            });
+            notifiedUsers.push(invitedUser.id);
+          } catch (err) {
+            logger.error(err, `${QueueName.DailyResourceCleanUp}: notify invited users failed to send email`);
+          }
+        }
       })
     );
+
+    await orgMembershipDAL.updateLastInvitedAtByIds(notifiedUsers);
+
+    logger.info(`${QueueName.DailyResourceCleanUp}: notify invited users completed`);
   };
 
   return {

backend/src/services/secret-folder/secret-folder-service.ts

@@ -223,7 +223,7 @@ export const secretFolderServiceFactory = ({
             }
           },
           message: "Folder created",
-          folderId: doc.id,
+          folderId: parentFolder.id,
           changes: [
             {
               type: CommitType.ADD,

backend/src/services/secret-sync/railway/railway-sync-constants.ts

@@ -0,0 +1,10 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const RAILWAY_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Railway",
+  destination: SecretSync.Railway,
+  connection: AppConnection.Railway,
+  canImportSecrets: true
+};

backend/src/services/secret-sync/railway/railway-sync-fns.ts

@@ -0,0 +1,124 @@
+/* eslint-disable @typescript-eslint/no-unsafe-member-access */
+/* eslint-disable @typescript-eslint/no-unsafe-assignment */
+
+import { RailwayPublicAPI } from "@app/services/app-connection/railway/railway-connection-public-client";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+
+import { SecretSyncError } from "../secret-sync-errors";
+import { TSecretMap } from "../secret-sync-types";
+import { TRailwaySyncWithCredentials } from "./railway-sync-types";
+
+export const RailwaySyncFns = {
+  async getSecrets(secretSync: TRailwaySyncWithCredentials): Promise<TSecretMap> {
+    try {
+      const config = secretSync.destinationConfig;
+
+      const variables = await RailwayPublicAPI.getVariables(secretSync.connection, {
+        projectId: config.projectId,
+        environmentId: config.environmentId,
+        serviceId: config.serviceId || undefined
+      });
+
+      const entries = {} as TSecretMap;
+
+      for (const [key, value] of Object.entries(variables)) {
+        // Skip importing private railway variables
+        // eslint-disable-next-line no-continue
+        if (key.startsWith("RAILWAY_")) continue;
+
+        entries[key] = {
+          value
+        };
+      }
+
+      return entries;
+    } catch (error) {
+      throw new SecretSyncError({
+        error,
+        message: "Failed to import secrets from Railway"
+      });
+    }
+  },
+
+  async syncSecrets(secretSync: TRailwaySyncWithCredentials, secretMap: TSecretMap) {
+    const {
+      environment,
+      syncOptions: { disableSecretDeletion, keySchema }
+    } = secretSync;
+    const railwaySecrets = await this.getSecrets(secretSync);
+    const config = secretSync.destinationConfig;
+
+    for await (const key of Object.keys(secretMap)) {
+      try {
+        const existing = railwaySecrets[key];
+
+        if (existing === undefined || existing.value !== secretMap[key].value) {
+          await RailwayPublicAPI.upsertVariable(secretSync.connection, {
+            input: {
+              projectId: config.projectId,
+              environmentId: config.environmentId,
+              serviceId: config.serviceId || undefined,
+              name: key,
+              value: secretMap[key].value ?? ""
+            }
+          });
+        }
+      } catch (error) {
+        throw new SecretSyncError({
+          error,
+          secretKey: key
+        });
+      }
+    }
+
+    if (disableSecretDeletion) return;
+
+    for await (const key of Object.keys(railwaySecrets)) {
+      try {
+        // eslint-disable-next-line no-continue
+        if (!matchesSchema(key, environment?.slug || "", keySchema)) continue;
+
+        if (!secretMap[key]) {
+          await RailwayPublicAPI.deleteVariable(secretSync.connection, {
+            input: {
+              projectId: config.projectId,
+              environmentId: config.environmentId,
+              serviceId: config.serviceId || undefined,
+              name: key
+            }
+          });
+        }
+      } catch (error) {
+        throw new SecretSyncError({
+          error,
+          secretKey: key
+        });
+      }
+    }
+  },
+
+  async removeSecrets(secretSync: TRailwaySyncWithCredentials, secretMap: TSecretMap) {
+    const existing = await this.getSecrets(secretSync);
+    const config = secretSync.destinationConfig;
+
+    for await (const secret of Object.keys(existing)) {
+      try {
+        if (secret in secretMap) {
+          await RailwayPublicAPI.deleteVariable(secretSync.connection, {
+            input: {
+              projectId: config.projectId,
+              environmentId: config.environmentId,
+              serviceId: config.serviceId || undefined,
+              name: secret
+            }
+          });
+        }
+      } catch (error) {
+        throw new SecretSyncError({
+          error,
+          secretKey: secret
+        });
+      }
+    }
+  }
+};

backend/src/services/secret-sync/railway/railway-sync-schemas.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+const RailwaySyncDestinationConfigSchema = z.object({
+  projectId: z
+    .string()
+    .trim()
+    .min(1, "Railway project ID required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.projectId),
+  projectName: z.string().trim().describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.projectName),
+  environmentId: z
+    .string()
+    .trim()
+    .min(1, "Railway environment ID required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.environmentId),
+  environmentName: z.string().trim().describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.environmentName),
+  serviceId: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.serviceId),
+  serviceName: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.RAILWAY.serviceName)
+});
+
+const RailwaySyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
+
+export const RailwaySyncSchema = BaseSecretSyncSchema(SecretSync.Railway, RailwaySyncOptionsConfig).extend({
+  destination: z.literal(SecretSync.Railway),
+  destinationConfig: RailwaySyncDestinationConfigSchema
+});
+
+export const CreateRailwaySyncSchema = GenericCreateSecretSyncFieldsSchema(
+  SecretSync.Railway,
+  RailwaySyncOptionsConfig
+).extend({
+  destinationConfig: RailwaySyncDestinationConfigSchema
+});
+
+export const UpdateRailwaySyncSchema = GenericUpdateSecretSyncFieldsSchema(
+  SecretSync.Railway,
+  RailwaySyncOptionsConfig
+).extend({
+  destinationConfig: RailwaySyncDestinationConfigSchema.optional()
+});
+
+export const RailwaySyncListItemSchema = z.object({
+  name: z.literal("Railway"),
+  connection: z.literal(AppConnection.Railway),
+  destination: z.literal(SecretSync.Railway),
+  canImportSecrets: z.literal(true)
+});

backend/src/services/secret-sync/railway/railway-sync-types.ts

@@ -0,0 +1,31 @@
+import z from "zod";
+
+import { TRailwayConnection } from "@app/services/app-connection/railway";
+
+import { CreateRailwaySyncSchema, RailwaySyncListItemSchema, RailwaySyncSchema } from "./railway-sync-schemas";
+
+export type TRailwaySyncListItem = z.infer<typeof RailwaySyncListItemSchema>;
+
+export type TRailwaySync = z.infer<typeof RailwaySyncSchema>;
+
+export type TRailwaySyncInput = z.infer<typeof CreateRailwaySyncSchema>;
+
+export type TRailwaySyncWithCredentials = TRailwaySync & {
+  connection: TRailwayConnection;
+};
+
+export type TRailwaySecret = {
+  createdAt: string;
+  environmentId?: string | null;
+  id: string;
+  isSealed: boolean;
+  name: string;
+  serviceId?: string | null;
+  updatedAt: string;
+};
+
+export type TRailwayVariablesGraphResponse = {
+  data: {
+    variables: Record<string, string>;
+  };
+};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -21,7 +21,8 @@ export enum SecretSync {
   Flyio = "flyio",
   GitLab = "gitlab",
   CloudflarePages = "cloudflare-pages",
-  Zabbix = "zabbix"
+  Zabbix = "zabbix",
+  Railway = "railway"
 }
 
 export enum SecretSyncInitialSyncBehavior {

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -39,6 +39,8 @@ import { HC_VAULT_SYNC_LIST_OPTION, HCVaultSyncFns } from "./hc-vault";
 import { HEROKU_SYNC_LIST_OPTION, HerokuSyncFns } from "./heroku";
 import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
+import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
+import { RailwaySyncFns } from "./railway/railway-sync-fns";
 import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
 import { SECRET_SYNC_PLAN_MAP } from "./secret-sync-maps";
 import { TEAMCITY_SYNC_LIST_OPTION, TeamCitySyncFns } from "./teamcity";
@@ -70,7 +72,8 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.Flyio]: FLYIO_SYNC_LIST_OPTION,
   [SecretSync.GitLab]: GITLAB_SYNC_LIST_OPTION,
   [SecretSync.CloudflarePages]: CLOUDFLARE_PAGES_SYNC_LIST_OPTION,
-  [SecretSync.Zabbix]: ZABBIX_SYNC_LIST_OPTION
+  [SecretSync.Zabbix]: ZABBIX_SYNC_LIST_OPTION,
+  [SecretSync.Railway]: RAILWAY_SYNC_LIST_OPTION
 };
 
 export const listSecretSyncOptions = () => {
@@ -240,6 +243,8 @@ export const SecretSyncFns = {
         return CloudflarePagesSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.Zabbix:
         return ZabbixSyncFns.syncSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Railway:
+        return RailwaySyncFns.syncSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -335,6 +340,9 @@ export const SecretSyncFns = {
       case SecretSync.Zabbix:
         secretMap = await ZabbixSyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Railway:
+        secretMap = await RailwaySyncFns.getSecrets(secretSync);
+        break;
       default:
         throw new Error(
           `Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -414,6 +422,8 @@ export const SecretSyncFns = {
         return CloudflarePagesSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.Zabbix:
         return ZabbixSyncFns.removeSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Railway:
+        return RailwaySyncFns.removeSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -24,7 +24,8 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.Flyio]: "Fly.io",
   [SecretSync.GitLab]: "GitLab",
   [SecretSync.CloudflarePages]: "Cloudflare Pages",
-  [SecretSync.Zabbix]: "Zabbix"
+  [SecretSync.Zabbix]: "Zabbix",
+  [SecretSync.Railway]: "Railway"
 };
 
 export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -50,7 +51,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.Flyio]: AppConnection.Flyio,
   [SecretSync.GitLab]: AppConnection.GitLab,
   [SecretSync.CloudflarePages]: AppConnection.Cloudflare,
-  [SecretSync.Zabbix]: AppConnection.Zabbix
+  [SecretSync.Zabbix]: AppConnection.Zabbix,
+  [SecretSync.Railway]: AppConnection.Railway
 };
 
 export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
@@ -76,5 +78,6 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.Flyio]: SecretSyncPlanType.Regular,
   [SecretSync.GitLab]: SecretSyncPlanType.Regular,
   [SecretSync.CloudflarePages]: SecretSyncPlanType.Regular,
-  [SecretSync.Zabbix]: SecretSyncPlanType.Regular
+  [SecretSync.Zabbix]: SecretSyncPlanType.Regular,
+  [SecretSync.Railway]: SecretSyncPlanType.Regular
 };

backend/src/services/secret-sync/secret-sync-types.ts

@@ -94,6 +94,12 @@ import {
   THumanitecSyncListItem,
   THumanitecSyncWithCredentials
 } from "./humanitec";
+import {
+  TRailwaySync,
+  TRailwaySyncInput,
+  TRailwaySyncListItem,
+  TRailwaySyncWithCredentials
+} from "./railway/railway-sync-types";
 import {
   TRenderSync,
   TRenderSyncInput,
@@ -138,7 +144,8 @@ export type TSecretSync =
   | TFlyioSync
   | TGitLabSync
   | TCloudflarePagesSync
-  | TZabbixSync;
+  | TZabbixSync
+  | TRailwaySync;
 
 export type TSecretSyncWithCredentials =
   | TAwsParameterStoreSyncWithCredentials
@@ -163,7 +170,8 @@ export type TSecretSyncWithCredentials =
   | TFlyioSyncWithCredentials
   | TGitLabSyncWithCredentials
   | TCloudflarePagesSyncWithCredentials
-  | TZabbixSyncWithCredentials;
+  | TZabbixSyncWithCredentials
+  | TRailwaySyncWithCredentials;
 
 export type TSecretSyncInput =
   | TAwsParameterStoreSyncInput
@@ -188,7 +196,8 @@ export type TSecretSyncInput =
   | TFlyioSyncInput
   | TGitLabSyncInput
   | TCloudflarePagesSyncInput
-  | TZabbixSyncInput;
+  | TZabbixSyncInput
+  | TRailwaySyncInput;
 
 export type TSecretSyncListItem =
   | TAwsParameterStoreSyncListItem
@@ -213,7 +222,8 @@ export type TSecretSyncListItem =
   | TFlyioSyncListItem
   | TGitLabSyncListItem
   | TCloudflarePagesSyncListItem
-  | TZabbixSyncListItem;
+  | TZabbixSyncListItem
+  | TRailwaySyncListItem;
 
 export type TSyncOptionsConfig = {
   canImportSecrets: boolean;