Merge branch 'main' into feat/secretsBatchUI

frontend/src/components/secret-scanning/forms/SecretScanningDataSourceConfigFields/BitbucketDataSourceConfigFields.tsx

@@ -0,0 +1,172 @@
+import { useEffect } from "react";
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { MultiValue, SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { FilterableSelect, FormControl, Select, SelectItem, Tooltip } from "@app/components/v2";
+import {
+  TBitbucketRepo,
+  TBitbucketWorkspace,
+  useBitbucketConnectionListRepositories,
+  useBitbucketConnectionListWorkspaces
+} from "@app/hooks/api/appConnections/bitbucket";
+import { SecretScanningDataSource } from "@app/hooks/api/secretScanningV2";
+
+import { TSecretScanningDataSourceForm } from "../schemas";
+import { SecretScanningDataSourceConnectionField } from "../SecretScanningDataSourceConnectionField";
+
+enum ScanMethod {
+  AllRepositories = "all-repositories",
+  SelectRepositories = "select-repositories"
+}
+
+export const BitbucketDataSourceConfigFields = () => {
+  const { control, watch, setValue } = useFormContext<
+    TSecretScanningDataSourceForm & {
+      type: SecretScanningDataSource.Bitbucket;
+    }
+  >();
+
+  const connectionId = useWatch({ control, name: "connection.id" });
+  const isUpdate = Boolean(watch("id"));
+
+  const selectedWorkspaceSlug = useWatch({ control, name: "config.workspaceSlug" });
+
+  const { data: workspaces, isPending: areWorkspacesLoading } =
+    useBitbucketConnectionListWorkspaces(connectionId, { enabled: Boolean(connectionId) });
+
+  const { data: repositories, isPending: areRepositoriesLoading } =
+    useBitbucketConnectionListRepositories(connectionId, selectedWorkspaceSlug, {
+      enabled: Boolean(connectionId) && Boolean(selectedWorkspaceSlug)
+    });
+
+  const includeRepos = watch("config.includeRepos");
+
+  const scanMethod =
+    !includeRepos || includeRepos[0] === "*"
+      ? ScanMethod.AllRepositories
+      : ScanMethod.SelectRepositories;
+
+  useEffect(() => {
+    if (!includeRepos) {
+      setValue("config.includeRepos", ["*"]);
+    }
+  }, [includeRepos, setValue]);
+
+  return (
+    <>
+      <SecretScanningDataSourceConnectionField
+        isUpdate={isUpdate}
+        onChange={() => {
+          if (scanMethod === ScanMethod.SelectRepositories) {
+            setValue("config.workspaceSlug", "");
+            setValue("config.includeRepos", []);
+          }
+        }}
+      />
+      <Controller
+        name="config.workspaceSlug"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Workspace"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content={<>Ensure that your connection has the correct permissions.</>}
+              >
+                <div>
+                  <span>Don&#39;t see the workspaces you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={areWorkspacesLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={value ? { slug: value } : null}
+              onChange={(newValue) => {
+                onChange((newValue as SingleValue<TBitbucketWorkspace>)?.slug);
+                if (scanMethod === ScanMethod.SelectRepositories) {
+                  setValue("config.includeRepos", []);
+                }
+              }}
+              options={workspaces}
+              placeholder="Select workspace..."
+              getOptionLabel={(option) => option.slug}
+              getOptionValue={(option) => option.slug}
+            />
+          </FormControl>
+        )}
+      />
+      <FormControl label="Scan Repositories">
+        <Select
+          value={scanMethod}
+          onValueChange={(val) => {
+            setValue("config.includeRepos", val === ScanMethod.AllRepositories ? ["*"] : []);
+          }}
+          className="w-full border border-mineshaft-500 capitalize"
+          position="popper"
+          dropdownContainerClassName="max-w-none"
+          isDisabled={!connectionId}
+        >
+          {Object.values(ScanMethod).map((method) => {
+            return (
+              <SelectItem className="capitalize" value={method} key={method}>
+                {method.replace("-", " ")}
+              </SelectItem>
+            );
+          })}
+        </Select>
+      </FormControl>
+      {scanMethod === ScanMethod.SelectRepositories && (
+        <Controller
+          name="config.includeRepos"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              isError={Boolean(error)}
+              errorText={error?.message}
+              label="Include Repositories"
+              helperText={
+                <Tooltip
+                  className="max-w-md"
+                  content={<>Ensure that your connection has the correct permissions.</>}
+                >
+                  <div>
+                    <span>Don&#39;t see the repository you&#39;re looking for?</span>{" "}
+                    <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                  </div>
+                </Tooltip>
+              }
+            >
+              <FilterableSelect
+                menuPlacement="top"
+                isLoading={areRepositoriesLoading && Boolean(connectionId)}
+                isDisabled={!connectionId || !selectedWorkspaceSlug}
+                isMulti
+                value={repositories?.filter((repository) =>
+                  (value as string[]).includes(repository.full_name)
+                )}
+                onChange={(newValue) => {
+                  onChange(
+                    newValue ? (newValue as MultiValue<TBitbucketRepo>).map((p) => p.full_name) : []
+                  );
+                }}
+                options={repositories}
+                placeholder="Select repositories..."
+                getOptionLabel={(option) => option.full_name}
+                getOptionValue={(option) => option.full_name}
+              />
+            </FormControl>
+          )}
+        />
+      )}
+    </>
+  );
+};

frontend/src/components/secret-scanning/forms/SecretScanningDataSourceConfigFields/SecretScanningDataSourceConfigFields.tsx

@@ -5,10 +5,12 @@ import { RESOURCE_DESCRIPTION_HELPER } from "@app/helpers/secretScanningV2";
 import { SecretScanningDataSource } from "@app/hooks/api/secretScanningV2";
 
 import { TSecretScanningDataSourceForm } from "../schemas";
+import { BitbucketDataSourceConfigFields } from "./BitbucketDataSourceConfigFields";
 import { GitHubDataSourceConfigFields } from "./GitHubDataSourceConfigFields";
 
 const COMPONENT_MAP: Record<SecretScanningDataSource, React.FC> = {
-  [SecretScanningDataSource.GitHub]: GitHubDataSourceConfigFields
+  [SecretScanningDataSource.GitHub]: GitHubDataSourceConfigFields,
+  [SecretScanningDataSource.Bitbucket]: BitbucketDataSourceConfigFields
 };
 
 export const SecretScanningDataSourceConfigFields = () => {

frontend/src/components/secret-scanning/forms/SecretScanningDataSourceReviewFields/BitbucketDataSourceReviewFields.tsx

@@ -0,0 +1,28 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretScanningDataSource } from "@app/hooks/api/secretScanningV2";
+
+import { TSecretScanningDataSourceForm } from "../schemas";
+import { SecretScanningDataSourceConfigReviewSection } from "./shared";
+
+export const BitbucketDataSourceReviewFields = () => {
+  const { watch } = useFormContext<
+    TSecretScanningDataSourceForm & {
+      type: SecretScanningDataSource.Bitbucket;
+    }
+  >();
+
+  const [{ includeRepos, workspaceSlug }, connection] = watch(["config", "connection"]);
+  const shouldScanAll = includeRepos[0] === "*";
+
+  return (
+    <SecretScanningDataSourceConfigReviewSection>
+      {connection && <GenericFieldLabel label="Connection">{connection.name}</GenericFieldLabel>}
+      <GenericFieldLabel label="Workspace Slug">{workspaceSlug}</GenericFieldLabel>
+      <GenericFieldLabel label="Scan Repositories">
+        {shouldScanAll ? "All" : includeRepos.join(", ")}
+      </GenericFieldLabel>
+    </SecretScanningDataSourceConfigReviewSection>
+  );
+};

frontend/src/components/secret-scanning/forms/SecretScanningDataSourceReviewFields/SecretScanningDataSourceReviewFields.tsx

@@ -4,10 +4,12 @@ import { GenericFieldLabel } from "@app/components/v2";
 import { SecretScanningDataSource } from "@app/hooks/api/secretScanningV2";
 
 import { TSecretScanningDataSourceForm } from "../schemas";
+import { BitbucketDataSourceReviewFields } from "./BitbucketDataSourceReviewFields";
 import { GitHubDataSourceReviewFields } from "./GitHubDataSourceReviewFields";
 
 const COMPONENT_MAP: Record<SecretScanningDataSource, React.FC> = {
-  [SecretScanningDataSource.GitHub]: GitHubDataSourceReviewFields
+  [SecretScanningDataSource.GitHub]: GitHubDataSourceReviewFields,
+  [SecretScanningDataSource.Bitbucket]: BitbucketDataSourceReviewFields
 };
 
 export const SecretScanningDataSourceReviewFields = () => {

frontend/src/components/secret-scanning/forms/schemas/bitbucket-data-source-schema.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+
+import { SecretScanningDataSource } from "@app/hooks/api/secretScanningV2";
+
+import { BaseSecretScanningDataSourceSchema } from "./base-secret-scanning-data-source-schema";
+
+export const BitbucketDataSourceSchema = z
+  .object({
+    type: z.literal(SecretScanningDataSource.Bitbucket),
+    config: z.object({
+      workspaceSlug: z.string().min(1, "Workspace Required").max(128),
+      includeRepos: z
+        .string()
+        .array()
+        .min(1, "One or more repositories required")
+        .max(100, "Cannot configure more than 100 repositories")
+    })
+  })
+  .merge(BaseSecretScanningDataSourceSchema({ isConnectionRequired: true }));

frontend/src/components/secret-scanning/forms/schemas/index.ts

@@ -1,9 +1,11 @@
 import { z } from "zod";
 
+import { BitbucketDataSourceSchema } from "./bitbucket-data-source-schema";
 import { GitHubDataSourceSchema } from "./github-data-source-schema";
 
 export const SecretScanningDataSourceSchema = z.discriminatedUnion("type", [
-  GitHubDataSourceSchema
+  GitHubDataSourceSchema,
+  BitbucketDataSourceSchema
 ]);
 
 export type TSecretScanningDataSourceForm = z.infer<typeof SecretScanningDataSourceSchema>;

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/1PasswordSyncFields.tsx

@@ -60,7 +60,7 @@ export const OnePassSyncFields = () => {
               menuPlacement="top"
               isLoading={isVaultsLoading && Boolean(connectionId)}
               isDisabled={!connectionId}
-              value={vaults?.find((v) => v.id === value) ?? null}
+              value={vaults?.find((v) => v.id === value) || null}
               onChange={(option) => onChange((option as SingleValue<TOnePassVault>)?.id ?? null)}
               options={vaults}
               placeholder="Select a vault..."

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/OCIVaultSyncFields.tsx

@@ -120,7 +120,7 @@ export const OCIVaultSyncFields = () => {
               menuPlacement="top"
               isLoading={isVaultsLoading && Boolean(connectionId)}
               isDisabled={!connectionId || !selectedCompartment}
-              value={vaults?.find((v) => v.id === value) ?? null}
+              value={vaults?.find((v) => v.id === value) || null}
               onChange={(option) => {
                 onChange((option as SingleValue<{ id: string }>)?.id ?? null);
                 setValue("destinationConfig.keyOcid", "");

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/RailwaySyncFields.tsx

@@ -0,0 +1,138 @@
+import { useMemo } from "react";
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl } from "@app/components/v2";
+import {
+  TRailwayProject,
+  useRailwayConnectionListProjects
+} from "@app/hooks/api/appConnections/railway";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const RailwaySyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.Railway }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+  const projectId = useWatch({ name: "destinationConfig.projectId", control });
+
+  const { data: projects = [], isPending: isProjectsLoading } = useRailwayConnectionListProjects(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  const environments = useMemo(() => {
+    return projects.find((p) => p.id === projectId)?.environments ?? [];
+  }, [projects, projectId]);
+
+  const services = useMemo(() => {
+    return projects.find((p) => p.id === projectId)?.services ?? [];
+  }, [projects, projectId]);
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.environmentId", "");
+          setValue("destinationConfig.projectId", "");
+          setValue("destinationConfig.serviceId", "");
+          setValue("destinationConfig.projectName", "");
+          setValue("destinationConfig.environmentName", "");
+          setValue("destinationConfig.serviceName", "");
+        }}
+      />
+      <Controller
+        name="destinationConfig.projectId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Select a project"
+            tooltipClassName="max-w-md"
+          >
+            <FilterableSelect
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={projects.find((p) => p.id === value) ?? null}
+              onChange={(option) => {
+                const v = option as SingleValue<TRailwayProject>;
+                onChange(v?.id ?? null);
+                setValue("destinationConfig.projectName", v?.name ?? "");
+              }}
+              options={projects}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        name="destinationConfig.environmentId"
+        disabled={!connectionId || !projectId}
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Select an environment"
+            tooltipClassName="max-w-md"
+          >
+            <FilterableSelect
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={environments.find((p) => p.id === value) ?? null}
+              onChange={(option) => {
+                const v = option as SingleValue<TRailwayProject>;
+                onChange(v?.id ?? null);
+                setValue("destinationConfig.environmentName", v?.name ?? "");
+              }}
+              options={environments}
+              placeholder="Select an environment..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+
+      <Controller
+        name="destinationConfig.serviceId"
+        disabled={!connectionId || !projectId}
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Select a service"
+            tooltipClassName="max-w-md"
+            tooltipText="By default secrets are created as shared variables in Railway."
+            helperText="Scope your secrets to a specific service within the environment."
+          >
+            <FilterableSelect
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={services.find((p) => p.id === value) ?? null}
+              onChange={(option) => {
+                const v = option as SingleValue<TRailwayProject>;
+                onChange(v?.id ?? null);
+                setValue("destinationConfig.serviceName", v?.name ?? "");
+              }}
+              options={services}
+              placeholder="Select a service..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx

@@ -20,6 +20,7 @@ import { HCVaultSyncFields } from "./HCVaultSyncFields";
 import { HerokuSyncFields } from "./HerokuSyncFields";
 import { HumanitecSyncFields } from "./HumanitecSyncFields";
 import { OCIVaultSyncFields } from "./OCIVaultSyncFields";
+import { RailwaySyncFields } from "./RailwaySyncFields";
 import { RenderSyncFields } from "./RenderSyncFields";
 import { TeamCitySyncFields } from "./TeamCitySyncFields";
 import { TerraformCloudSyncFields } from "./TerraformCloudSyncFields";
@@ -79,6 +80,8 @@ export const SecretSyncDestinationFields = () => {
       return <CloudflarePagesSyncFields />;
     case SecretSync.Zabbix:
       return <ZabbixSyncFields />;
+    case SecretSync.Railway:
+      return <RailwaySyncFields />;
     default:
       throw new Error(`Unhandled Destination Config Field: ${destination}`);
   }

frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx

@@ -59,6 +59,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
     case SecretSync.GitLab:
     case SecretSync.CloudflarePages:
     case SecretSync.Zabbix:
+    case SecretSync.Railway:
       AdditionalSyncOptionsFieldsComponent = null;
       break;
     default:

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/RailwaySyncReviewFields.tsx

@@ -0,0 +1,29 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { useRailwayConnectionListProjects } from "@app/hooks/api/appConnections/railway";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const RailwaySyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Railway }>();
+  const connectionId = watch("connection.id");
+  const projectId = watch("destinationConfig.projectId");
+  const environmentId = watch("destinationConfig.environmentId");
+
+  const { data: projects = [] } = useRailwayConnectionListProjects(connectionId, {
+    enabled: Boolean(connectionId)
+  });
+
+  const project = projects.find((p) => p.id === projectId);
+  const environment = project?.environments.find((e) => e.id === environmentId);
+
+  return (
+    <>
+      <GenericFieldLabel label="Project">{project?.name ?? projectId}</GenericFieldLabel>
+      <GenericFieldLabel label="Environment">
+        {environment?.name ?? environmentId}
+      </GenericFieldLabel>
+    </>
+  );
+};

frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx

@@ -30,6 +30,7 @@ import { HerokuSyncReviewFields } from "./HerokuSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
 import { OCIVaultSyncReviewFields } from "./OCIVaultSyncReviewFields";
 import { OnePassSyncReviewFields } from "./OnePassSyncReviewFields";
+import { RailwaySyncReviewFields } from "./RailwaySyncReviewFields";
 import { RenderSyncReviewFields } from "./RenderSyncReviewFields";
 import { TeamCitySyncReviewFields } from "./TeamCitySyncReviewFields";
 import { TerraformCloudSyncReviewFields } from "./TerraformCloudSyncReviewFields";
@@ -128,6 +129,9 @@ export const SecretSyncReviewFields = () => {
     case SecretSync.Zabbix:
       DestinationFieldsComponent = <ZabbixSyncReviewFields />;
       break;
+    case SecretSync.Railway:
+      DestinationFieldsComponent = <RailwaySyncReviewFields />;
+      break;
     default:
       throw new Error(`Unhandled Destination Review Fields: ${destination}`);
   }

frontend/src/components/secret-syncs/forms/schemas/railway-sync-destination-schema.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const RailwaySyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.Railway),
+    destinationConfig: z.object({
+      projectId: z.string().min(1, "Project ID is required"),
+      projectName: z.string(),
+      environmentName: z.string(),
+      environmentId: z.string().min(1, "Environment is required"),
+      serviceId: z.string().optional(),
+      serviceName: z.string().optional()
+    })
+  })
+);

frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts

@@ -17,6 +17,7 @@ import { HCVaultSyncDestinationSchema } from "./hc-vault-sync-destination-schema
 import { HerokuSyncDestinationSchema } from "./heroku-sync-destination-schema";
 import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
 import { OCIVaultSyncDestinationSchema } from "./oci-vault-sync-destination-schema";
+import { RailwaySyncDestinationSchema } from "./railway-sync-destination-schema";
 import { RenderSyncDestinationSchema } from "./render-sync-destination-schema";
 import { TeamCitySyncDestinationSchema } from "./teamcity-sync-destination-schema";
 import { TerraformCloudSyncDestinationSchema } from "./terraform-cloud-destination-schema";
@@ -47,7 +48,8 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
   FlyioSyncDestinationSchema,
   GitlabSyncDestinationSchema,
   CloudflarePagesSyncDestinationSchema,
-  ZabbixSyncDestinationSchema
+  ZabbixSyncDestinationSchema,
+  RailwaySyncDestinationSchema
 ]);
 
 export const SecretSyncFormSchema = SecretSyncUnionSchema;

frontend/src/components/utilities/parseSecrets.ts

@@ -77,3 +77,91 @@ export const parseJson = (src: ArrayBuffer | string) => {
   });
   return env;
 };
+
+/**
+ * Parses simple flat YAML with support for multiline strings using |, |-, and >.
+ * @param {ArrayBuffer | string} src
+ * @returns {Record<string, { value: string, comments: string[] }>}
+ */
+export function parseYaml(src: ArrayBuffer | string) {
+  const result: Record<string, { value: string; comments: string[] }> = {};
+
+  const content = src.toString().replace(/\r\n?/g, "\n");
+  const lines = content.split("\n");
+
+  let i = 0;
+  let comments: string[] = [];
+
+  while (i < lines.length) {
+    const line = lines[i].trim();
+
+    // Collect comment
+    if (line.startsWith("#")) {
+      comments.push(line.slice(1).trim());
+      i += 1; // move to next line
+    } else {
+      // Match key: value or key: |, key: >, etc.
+      const keyMatch = lines[i].match(/^([\w.-]+)\s*:\s*(.*)$/);
+      if (keyMatch) {
+        const [, key, rawValue] = keyMatch;
+        let value = rawValue.trim();
+
+        // Multiline string handling
+        if (value === "|-" || value === "|" || value === ">") {
+          const isFolded = value === ">";
+
+          const baseIndent = lines[i + 1]?.match(/^(\s*)/)?.[1]?.length ?? 0;
+          const collectedLines: string[] = [];
+
+          i += 1; // move to first content line
+
+          while (i < lines.length) {
+            const current = lines[i];
+            const currentIndent = current.match(/^(\s*)/)?.[1]?.length ?? 0;
+
+            if (current.trim() === "" || currentIndent >= baseIndent) {
+              collectedLines.push(current.slice(baseIndent));
+              i += 1; // move to next line
+            } else {
+              break;
+            }
+          }
+
+          if (isFolded) {
+            // Join lines with space for `>` folded style
+            value = collectedLines.map((l) => l.trim()).join(" ");
+          } else {
+            // Keep lines with newlines for `|` and `|-`
+            value = collectedLines.join("\n");
+          }
+        } else {
+          // Inline value — strip quotes and inline comment
+          const commentIndex = value.indexOf(" #");
+          if (commentIndex !== -1) {
+            value = value.slice(0, commentIndex).trim();
+          }
+
+          // Remove surrounding quotes
+          if (
+            (value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))
+          ) {
+            value = value.slice(1, -1);
+          }
+
+          i += 1; // advance to next line
+        }
+
+        result[key] = {
+          value,
+          comments: [...comments]
+        };
+        comments = []; // reset
+      } else {
+        i += 1; // skip unknown line
+      }
+    }
+  }
+
+  return result;
+}

frontend/src/config/env.ts

@@ -26,6 +26,7 @@ export const envConfig = {
       import.meta.env.VITE_TELEMETRY_CAPTURING_ENABLED === true
     );
   },
+
   get PLATFORM_VERSION() {
     return import.meta.env.VITE_INFISICAL_PLATFORM_VERSION;
   }

frontend/src/helpers/appConnections.ts

@@ -40,8 +40,10 @@ import {
   WindmillConnectionMethod,
   ZabbixConnectionMethod
 } from "@app/hooks/api/appConnections/types";
+import { BitbucketConnectionMethod } from "@app/hooks/api/appConnections/types/bitbucket-connection";
 import { HerokuConnectionMethod } from "@app/hooks/api/appConnections/types/heroku-connection";
 import { OCIConnectionMethod } from "@app/hooks/api/appConnections/types/oci-connection";
+import { RailwayConnectionMethod } from "@app/hooks/api/appConnections/types/railway-connection";
 import { RenderConnectionMethod } from "@app/hooks/api/appConnections/types/render-connection";
 
 export const APP_CONNECTION_MAP: Record<
@@ -90,7 +92,9 @@ export const APP_CONNECTION_MAP: Record<
   [AppConnection.Flyio]: { name: "Fly.io", image: "Flyio.svg" },
   [AppConnection.Gitlab]: { name: "GitLab", image: "GitLab.png" },
   [AppConnection.Cloudflare]: { name: "Cloudflare", image: "Cloudflare.png" },
-  [AppConnection.Zabbix]: { name: "Zabbix", image: "Zabbix.png" }
+  [AppConnection.Zabbix]: { name: "Zabbix", image: "Zabbix.png" },
+  [AppConnection.Railway]: { name: "Railway", image: "Railway.png" },
+  [AppConnection.Bitbucket]: { name: "Bitbucket", image: "Bitbucket.png" }
 };
 
 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
@@ -122,6 +126,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case VercelConnectionMethod.ApiToken:
     case OnePassConnectionMethod.ApiToken:
     case CloudflareConnectionMethod.ApiToken:
+    case BitbucketConnectionMethod.ApiToken:
     case ZabbixConnectionMethod.ApiToken:
       return { name: "API Token", icon: faKey };
     case PostgresConnectionMethod.UsernameAndPassword:
@@ -143,6 +148,12 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
       return { name: "Simple Bind", icon: faLink };
     case HerokuConnectionMethod.AuthToken:
       return { name: "Auth Token", icon: faKey };
+    case RailwayConnectionMethod.AccountToken:
+      return { name: "Account Token", icon: faKey };
+    case RailwayConnectionMethod.TeamToken:
+      return { name: "Team Token", icon: faKey };
+    case RailwayConnectionMethod.ProjectToken:
+      return { name: "Project Token", icon: faKey };
     case RenderConnectionMethod.ApiKey:
       return { name: "API Key", icon: faKey };
     default:

frontend/src/helpers/secretScanningV2.ts

@@ -19,6 +19,11 @@ export const SECRET_SCANNING_DATA_SOURCE_MAP: Record<
     name: "GitHub",
     image: "GitHub.png",
     size: 45
+  },
+  [SecretScanningDataSource.Bitbucket]: {
+    name: "Bitbucket",
+    image: "Bitbucket.png",
+    size: 45
   }
 };
 
@@ -26,7 +31,8 @@ export const SECRET_SCANNING_DATA_SOURCE_CONNECTION_MAP: Record<
   SecretScanningDataSource,
   AppConnection
 > = {
-  [SecretScanningDataSource.GitHub]: AppConnection.GitHubRadar
+  [SecretScanningDataSource.GitHub]: AppConnection.GitHubRadar,
+  [SecretScanningDataSource.Bitbucket]: AppConnection.Bitbucket
 };
 
 export const RESOURCE_DESCRIPTION_HELPER: Record<
@@ -45,6 +51,13 @@ export const RESOURCE_DESCRIPTION_HELPER: Record<
     singularNoun: "repository",
     pluralTitle: "Repositories",
     singularTitle: "Repository"
+  },
+  [SecretScanningDataSource.Bitbucket]: {
+    verb: "push",
+    pluralNoun: "repositories",
+    singularNoun: "repository",
+    pluralTitle: "Repositories",
+    singularTitle: "Repository"
   }
 };
 

frontend/src/helpers/secretSyncs.ts

@@ -85,6 +85,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
   [SecretSync.Zabbix]: {
     name: "Zabbix",
     image: "Zabbix.png"
+  },
+  [SecretSync.Railway]: {
+    name: "Railway",
+    image: "Railway.png"
   }
 };
 
@@ -111,7 +115,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.Flyio]: AppConnection.Flyio,
   [SecretSync.GitLab]: AppConnection.Gitlab,
   [SecretSync.CloudflarePages]: AppConnection.Cloudflare,
-  [SecretSync.Zabbix]: AppConnection.Zabbix
+  [SecretSync.Zabbix]: AppConnection.Zabbix,
+  [SecretSync.Railway]: AppConnection.Railway
 };
 
 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<

frontend/src/hooks/api/accessApproval/types.ts

@@ -170,7 +170,7 @@ export type TCreateAccessPolicyDTO = {
   approvers?: Approver[];
   bypassers?: Bypasser[];
   approvals?: number;
-  secretPath?: string;
+  secretPath: string;
   enforcementLevel?: EnforcementLevel;
   allowedSelfApprovals: boolean;
   approvalsRequired?: { numberOfApprovals: number; stepNumber: number }[];

frontend/src/hooks/api/admin/types.ts

@@ -40,6 +40,7 @@ export type TServerConfig = {
   trustLdapEmails: boolean;
   trustOidcEmails: boolean;
   isSecretScanningDisabled: boolean;
+  kubernetesAutoFetchServiceAccountToken: boolean;
   defaultAuthOrgSlug: string | null;
   defaultAuthOrgId: string | null;
   defaultAuthOrgAuthMethod?: string | null;

frontend/src/hooks/api/appConnections/bitbucket/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/bitbucket/queries.tsx

@@ -0,0 +1,70 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import {
+  TBitbucketConnectionListRepositoriesResponse,
+  TBitbucketConnectionListWorkspacesResponse,
+  TBitbucketRepo,
+  TBitbucketWorkspace
+} from "./types";
+
+const bitbucketConnectionKeys = {
+  all: [...appConnectionKeys.all, "bitbucket"] as const,
+  listRepos: (connectionId: string, workspaceSlug: string) =>
+    [...bitbucketConnectionKeys.all, "repos", connectionId, workspaceSlug] as const,
+  listWorkspaces: (connectionId: string) =>
+    [...bitbucketConnectionKeys.all, "workspaces", connectionId] as const
+};
+
+export const useBitbucketConnectionListWorkspaces = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TBitbucketWorkspace[],
+      unknown,
+      TBitbucketWorkspace[],
+      ReturnType<typeof bitbucketConnectionKeys.listWorkspaces>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: bitbucketConnectionKeys.listWorkspaces(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TBitbucketConnectionListWorkspacesResponse>(
+        `/api/v1/app-connections/bitbucket/${connectionId}/workspaces`
+      );
+
+      return data.workspaces;
+    },
+    ...options
+  });
+};
+
+export const useBitbucketConnectionListRepositories = (
+  connectionId: string,
+  workspaceSlug: string,
+  options?: Omit<
+    UseQueryOptions<
+      TBitbucketRepo[],
+      unknown,
+      TBitbucketRepo[],
+      ReturnType<typeof bitbucketConnectionKeys.listRepos>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: bitbucketConnectionKeys.listRepos(connectionId, workspaceSlug),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TBitbucketConnectionListRepositoriesResponse>(
+        `/api/v1/app-connections/bitbucket/${connectionId}/repositories?workspaceSlug=${encodeURIComponent(workspaceSlug)}`
+      );
+
+      return data.repositories;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/bitbucket/types.ts

@@ -0,0 +1,17 @@
+export type TBitbucketWorkspace = {
+  slug: string;
+};
+
+export type TBitbucketRepo = {
+  uuid: string;
+  slug: string;
+  full_name: string; // workspace-slug/repo-slug
+};
+
+export type TBitbucketConnectionListWorkspacesResponse = {
+  workspaces: TBitbucketWorkspace[];
+};
+
+export type TBitbucketConnectionListRepositoriesResponse = {
+  repositories: TBitbucketRepo[];
+};

frontend/src/hooks/api/appConnections/enums.ts

@@ -28,5 +28,7 @@ export enum AppConnection {
   Flyio = "flyio",
   Gitlab = "gitlab",
   Cloudflare = "cloudflare",
-  Zabbix = "zabbix"
+  Bitbucket = "bitbucket",
+  Zabbix = "zabbix",
+  Railway = "railway"
 }

frontend/src/hooks/api/appConnections/railway/index.ts

@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";

frontend/src/hooks/api/appConnections/railway/queries.tsx

@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+import { appConnectionKeys } from "@app/hooks/api/appConnections";
+
+import { TRailwayProject } from "./types";
+
+const railwayConnectionKeys = {
+  all: [...appConnectionKeys.all, "railway"] as const,
+  listSecretScopes: (connectionId: string) =>
+    [...railwayConnectionKeys.all, "workspace-scopes", connectionId] as const
+};
+
+export const useRailwayConnectionListProjects = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TRailwayProject[],
+      unknown,
+      TRailwayProject[],
+      ReturnType<typeof railwayConnectionKeys.listSecretScopes>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: railwayConnectionKeys.listSecretScopes(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ projects: TRailwayProject[] }>(
+        `/api/v1/app-connections/railway/${connectionId}/projects`
+      );
+
+      return data.projects;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/railway/types.ts

@@ -0,0 +1,12 @@
+export type TRailwayProject = {
+  id: string;
+  name: string;
+  environments: Array<{
+    id: string;
+    name: string;
+  }>;
+  services: Array<{
+    id: string;
+    name: string;
+  }>;
+};

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -132,10 +132,18 @@ export type TCloudflareConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Cloudflare;
 };
 
+export type TBitbucketConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Bitbucket;
+};
+
 export type TZabbixConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Zabbix;
 };
 
+export type TRailwayConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Railway;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
@@ -164,7 +172,9 @@ export type TAppConnectionOption =
   | TFlyioConnectionOption
   | TGitlabConnectionOption
   | TCloudflareConnectionOption
-  | TZabbixConnectionOption;
+  | TBitbucketConnectionOption
+  | TZabbixConnectionOption
+  | TRailwayConnectionOption;
 
 export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
@@ -196,5 +206,7 @@ export type TAppConnectionOptionMap = {
   [AppConnection.Flyio]: TFlyioConnectionOption;
   [AppConnection.Gitlab]: TGitlabConnectionOption;
   [AppConnection.Cloudflare]: TCloudflareConnectionOption;
+  [AppConnection.Bitbucket]: TBitbucketConnectionOption;
   [AppConnection.Zabbix]: TZabbixConnectionOption;
+  [AppConnection.Railway]: TRailwayConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/bitbucket-connection.ts

@@ -0,0 +1,14 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum BitbucketConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TBitbucketConnection = TRootAppConnection & { app: AppConnection.Bitbucket } & {
+  method: BitbucketConnectionMethod.ApiToken;
+  credentials: {
+    email: string;
+    apiToken: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/index.ts

@@ -7,6 +7,7 @@ import { TAzureAppConfigurationConnection } from "./azure-app-configuration-conn
 import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
 import { TAzureDevOpsConnection } from "./azure-devops-connection";
 import { TAzureKeyVaultConnection } from "./azure-key-vault-connection";
+import { TBitbucketConnection } from "./bitbucket-connection";
 import { TCamundaConnection } from "./camunda-connection";
 import { TCloudflareConnection } from "./cloudflare-connection";
 import { TDatabricksConnection } from "./databricks-connection";
@@ -24,6 +25,7 @@ import { TMySqlConnection } from "./mysql-connection";
 import { TOCIConnection } from "./oci-connection";
 import { TOracleDBConnection } from "./oracledb-connection";
 import { TPostgresConnection } from "./postgres-connection";
+import { TRailwayConnection } from "./railway-connection";
 import { TRenderConnection } from "./render-connection";
 import { TTeamCityConnection } from "./teamcity-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
@@ -38,6 +40,7 @@ export * from "./azure-app-configuration-connection";
 export * from "./azure-client-secrets-connection";
 export * from "./azure-devops-connection";
 export * from "./azure-key-vault-connection";
+export * from "./bitbucket-connection";
 export * from "./camunda-connection";
 export * from "./cloudflare-connection";
 export * from "./databricks-connection";
@@ -92,7 +95,9 @@ export type TAppConnection =
   | TFlyioConnection
   | TGitLabConnection
   | TCloudflareConnection
-  | TZabbixConnection;
+  | TBitbucketConnection
+  | TZabbixConnection
+  | TRailwayConnection;
 
 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
 
@@ -149,5 +154,7 @@ export type TAppConnectionMap = {
   [AppConnection.Flyio]: TFlyioConnection;
   [AppConnection.Gitlab]: TGitLabConnection;
   [AppConnection.Cloudflare]: TCloudflareConnection;
+  [AppConnection.Bitbucket]: TBitbucketConnection;
   [AppConnection.Zabbix]: TZabbixConnection;
+  [AppConnection.Railway]: TRailwayConnection;
 };

frontend/src/hooks/api/appConnections/types/railway-connection.ts

@@ -0,0 +1,15 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum RailwayConnectionMethod {
+  AccountToken = "account-token",
+  ProjectToken = "project-token",
+  TeamToken = "team-token"
+}
+
+export type TRailwayConnection = TRootAppConnection & { app: AppConnection.Railway } & {
+  method: RailwayConnectionMethod;
+  credentials: {
+    apiToken: string;
+  };
+};

frontend/src/hooks/api/dynamicSecret/types.ts

@@ -54,7 +54,8 @@ export enum SqlProviders {
 
 export enum DynamicSecretAwsIamAuth {
   AssumeRole = "assume-role",
-  AccessKey = "access-key"
+  AccessKey = "access-key",
+  IRSA = "irsa"
 }
 
 export type TDynamicSecretProvider =
@@ -111,6 +112,14 @@ export type TDynamicSecretProvider =
             policyDocument?: string;
             userGroups?: string;
             policyArns?: string;
+          }
+        | {
+            method: DynamicSecretAwsIamAuth.IRSA;
+            region: string;
+            awsPath?: string;
+            policyDocument?: string;
+            userGroups?: string;
+            policyArns?: string;
           };
     }
   | {

frontend/src/hooks/api/identities/mutations.tsx

@@ -3,6 +3,7 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import { organizationKeys } from "../organization/queries";
+import { subscriptionQueryKeys } from "../subscriptions/queries";
 import { identitiesKeys } from "./queries";
 import {
   AddIdentityAliCloudAuthDTO,
@@ -82,6 +83,9 @@ export const useCreateIdentity = () => {
       queryClient.invalidateQueries({
         queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
       });
+      queryClient.invalidateQueries({
+        queryKey: subscriptionQueryKeys.getOrgSubsription(organizationId)
+      });
     }
   });
 };
@@ -123,6 +127,9 @@ export const useDeleteIdentity = () => {
       queryClient.invalidateQueries({
         queryKey: organizationKeys.getOrgIdentityMemberships(organizationId)
       });
+      queryClient.invalidateQueries({
+        queryKey: subscriptionQueryKeys.getOrgSubsription(organizationId)
+      });
     }
   });
 };

frontend/src/hooks/api/integrationAuth/index.tsx

@@ -4,7 +4,7 @@ export {
   useDeleteIntegrationAuth,
   useDeleteIntegrationAuths,
   useGetIntegrationAuthApps,
-  useGetIntegrationAuthBitBucketWorkspaces,
+  useGetIntegrationAuthBitbucketWorkspaces,
   useGetIntegrationAuthById,
   useGetIntegrationAuthChecklyGroups,
   useGetIntegrationAuthCircleCIOrganizations,

frontend/src/hooks/api/integrationAuth/queries.tsx

@@ -6,8 +6,8 @@ import { TReactQueryOptions } from "@app/types/reactQuery";
 import { workspaceKeys } from "../workspace";
 import {
   App,
-  BitBucketEnvironment,
-  BitBucketWorkspace,
+  BitbucketEnvironment,
+  BitbucketWorkspace,
   ChecklyGroup,
   CircleCIOrganization,
   Environment,
@@ -98,9 +98,9 @@ const integrationAuthKeys = {
     integrationAuthId: string;
     appId: string;
   }) => [{ integrationAuthId, appId }, "integrationAuthRailwayServices"] as const,
-  getIntegrationAuthBitBucketWorkspaces: (integrationAuthId: string) =>
+  getIntegrationAuthBitbucketWorkspaces: (integrationAuthId: string) =>
     [{ integrationAuthId }, "integrationAuthBitbucketWorkspaces"] as const,
-  getIntegrationAuthBitBucketEnvironments: (
+  getIntegrationAuthBitbucketEnvironments: (
     integrationAuthId: string,
     workspaceSlug: string,
     repoSlug: string
@@ -446,23 +446,23 @@ const fetchIntegrationAuthRailwayServices = async ({
   return services;
 };
 
-const fetchIntegrationAuthBitBucketWorkspaces = async (integrationAuthId: string) => {
+const fetchIntegrationAuthBitbucketWorkspaces = async (integrationAuthId: string) => {
   const {
     data: { workspaces }
-  } = await apiRequest.get<{ workspaces: BitBucketWorkspace[] }>(
+  } = await apiRequest.get<{ workspaces: BitbucketWorkspace[] }>(
     `/api/v1/integration-auth/${integrationAuthId}/bitbucket/workspaces`
   );
   return workspaces;
 };
 
-const fetchIntegrationAuthBitBucketEnvironments = async (
+const fetchIntegrationAuthBitbucketEnvironments = async (
   integrationAuthId: string,
   workspaceSlug: string,
   repoSlug: string
 ) => {
   const {
     data: { environments }
-  } = await apiRequest.get<{ environments: BitBucketEnvironment[] }>(
+  } = await apiRequest.get<{ environments: BitbucketEnvironment[] }>(
     `/api/v1/integration-auth/${integrationAuthId}/bitbucket/environments`,
     {
       params: {
@@ -833,10 +833,10 @@ export const useGetIntegrationAuthRailwayServices = ({
   });
 };
 
-export const useGetIntegrationAuthBitBucketWorkspaces = (integrationAuthId: string) => {
+export const useGetIntegrationAuthBitbucketWorkspaces = (integrationAuthId: string) => {
   return useQuery({
-    queryKey: integrationAuthKeys.getIntegrationAuthBitBucketWorkspaces(integrationAuthId),
-    queryFn: () => fetchIntegrationAuthBitBucketWorkspaces(integrationAuthId),
+    queryKey: integrationAuthKeys.getIntegrationAuthBitbucketWorkspaces(integrationAuthId),
+    queryFn: () => fetchIntegrationAuthBitbucketWorkspaces(integrationAuthId),
     enabled: true
   });
 };
@@ -858,7 +858,7 @@ export const useGetIntegrationAuthOctopusDeployScopeValues = (
     ...options
   });
 
-export const useGetIntegrationAuthBitBucketEnvironments = (
+export const useGetIntegrationAuthBitbucketEnvironments = (
   {
     integrationAuthId,
     workspaceSlug,
@@ -871,13 +871,13 @@ export const useGetIntegrationAuthBitBucketEnvironments = (
   options?: TReactQueryOptions["options"]
 ) => {
   return useQuery({
-    queryKey: integrationAuthKeys.getIntegrationAuthBitBucketEnvironments(
+    queryKey: integrationAuthKeys.getIntegrationAuthBitbucketEnvironments(
       integrationAuthId,
       workspaceSlug,
       repoSlug
     ),
     queryFn: () =>
-      fetchIntegrationAuthBitBucketEnvironments(integrationAuthId, workspaceSlug, repoSlug),
+      fetchIntegrationAuthBitbucketEnvironments(integrationAuthId, workspaceSlug, repoSlug),
     ...options
   });
 };

frontend/src/hooks/api/integrationAuth/types.ts

@@ -78,13 +78,13 @@ export type Service = {
   serviceId: string;
 };
 
-export type BitBucketWorkspace = {
+export type BitbucketWorkspace = {
   uuid: string;
   name: string;
   slug: string;
 };
 
-export type BitBucketEnvironment = {
+export type BitbucketEnvironment = {
   uuid: string;
   name: string;
   slug: string;

frontend/src/hooks/api/secretApproval/types.ts

@@ -49,7 +49,7 @@ export type TCreateSecretPolicyDTO = {
   workspaceId: string;
   name?: string;
   environment: string;
-  secretPath?: string | null;
+  secretPath: string;
   approvers?: Approver[];
   bypassers?: Bypasser[];
   approvals?: number;
@@ -62,7 +62,7 @@ export type TUpdateSecretPolicyDTO = {
   name?: string;
   approvers?: Approver[];
   bypassers?: Bypasser[];
-  secretPath?: string | null;
+  secretPath?: string;
   approvals?: number;
   allowedSelfApprovals?: boolean;
   enforcementLevel?: EnforcementLevel;

frontend/src/hooks/api/secretScanningV2/enums.ts

@@ -1,5 +1,6 @@
 export enum SecretScanningDataSource {
-  GitHub = "github"
+  GitHub = "github",
+  Bitbucket = "bitbucket"
 }
 
 export enum SecretScanningScanStatus {

frontend/src/hooks/api/secretScanningV2/types/bitbucket-data-source.ts

@@ -0,0 +1,18 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import { SecretScanningDataSource } from "../enums";
+import { TSecretScanningDataSourceBase } from "./shared";
+
+export type TBitbucketDataSource = TSecretScanningDataSourceBase & {
+  type: SecretScanningDataSource.Bitbucket;
+  config: {
+    workspaceSlug: string;
+    includeRepos: string[];
+  };
+};
+
+export type TBitbucketDataSourceOption = {
+  name: string;
+  type: SecretScanningDataSource.Bitbucket;
+  connection: AppConnection.Bitbucket;
+};

frontend/src/hooks/api/secretScanningV2/types/index.ts

@@ -8,9 +8,10 @@ import {
   SecretScanningScanStatus,
   SecretScanningScanType
 } from "../enums";
+import { TBitbucketDataSource, TBitbucketDataSourceOption } from "./bitbucket-data-source";
 import { TGitHubDataSource, TGitHubDataSourceOption } from "./github-data-source";
 
-export type TSecretScanningDataSource = TGitHubDataSource;
+export type TSecretScanningDataSource = TGitHubDataSource | TBitbucketDataSource;
 
 export type TSecretScanningDataSourceWithDetails = TSecretScanningDataSource & {
   lastScannedAt: string | null;
@@ -23,7 +24,7 @@ export type TListSecretScanningDataSources = {
   dataSources: TSecretScanningDataSourceWithDetails[];
 };
 
-export type TSecretScanningDataSourceOption = TGitHubDataSourceOption;
+export type TSecretScanningDataSourceOption = TGitHubDataSourceOption | TBitbucketDataSourceOption;
 
 export type TListSecretScanningDataSourceOptions = {
   dataSourceOptions: TSecretScanningDataSourceOption[];

frontend/src/hooks/api/secretSyncs/enums.ts

@@ -21,7 +21,8 @@ export enum SecretSync {
   Flyio = "flyio",
   GitLab = "gitlab",
   CloudflarePages = "cloudflare-pages",
-  Zabbix = "zabbix"
+  Zabbix = "zabbix",
+  Railway = "railway"
 }
 
 export enum SecretSyncStatus {

frontend/src/hooks/api/secretSyncs/types/index.ts

@@ -19,6 +19,7 @@ import { THCVaultSync } from "./hc-vault-sync";
 import { THerokuSync } from "./heroku-sync";
 import { THumanitecSync } from "./humanitec-sync";
 import { TOCIVaultSync } from "./oci-vault-sync";
+import { TRailwaySync } from "./railway-sync";
 import { TTeamCitySync } from "./teamcity-sync";
 import { TTerraformCloudSync } from "./terraform-cloud-sync";
 import { TVercelSync } from "./vercel-sync";
@@ -55,7 +56,8 @@ export type TSecretSync =
   | TFlyioSync
   | TGitLabSync
   | TCloudflarePagesSync
-  | TZabbixSync;
+  | TZabbixSync
+  | TRailwaySync;
 
 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };
 

frontend/src/hooks/api/secretSyncs/types/railway-sync.ts

@@ -0,0 +1,22 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TRailwaySync = TRootSecretSync & {
+  destination: SecretSync.Railway;
+  destinationConfig: {
+    projectId: string;
+    projectName: string;
+
+    environmentName: string;
+    environmentId: string;
+
+    serviceId?: string;
+    serviceName?: string;
+  };
+  connection: {
+    app: AppConnection.Railway;
+    name: string;
+    id: string;
+  };
+};

frontend/src/hooks/api/users/queries.tsx

@@ -9,6 +9,7 @@ import { APIKeyDataV2 } from "../apiKeys/types";
 import { MfaMethod } from "../auth/types";
 import { TGroupWithProjectMemberships } from "../groups/types";
 import { setAuthToken } from "../reactQuery";
+import { subscriptionQueryKeys } from "../subscriptions/queries";
 import { workspaceKeys } from "../workspace";
 import { userKeys } from "./query-keys";
 import {
@@ -188,6 +189,9 @@ export const useAddUsersToOrg = () => {
     },
     onSuccess: (_, { organizationId, projects }) => {
       queryClient.invalidateQueries({ queryKey: userKeys.getOrgUsers(organizationId) });
+      queryClient.invalidateQueries({
+        queryKey: subscriptionQueryKeys.getOrgSubsription(organizationId)
+      });
 
       projects?.forEach((project) => {
         if (project.slug) {

frontend/src/layouts/AdminLayout/Sidebar.tsx

@@ -2,7 +2,7 @@ import { faChevronLeft } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Link, useMatchRoute } from "@tanstack/react-router";
 
-import { Menu, MenuGroup, MenuItem } from "@app/components/v2";
+import { Lottie, Menu, MenuGroup, MenuItem } from "@app/components/v2";
 
 const generalTabs = [
   {
@@ -50,7 +50,7 @@ const resourceTabs = [
   },
   {
     label: "Machine Identities",
-    icon: "key-user",
+    icon: "wrench",
     link: "/admin/resources/machine-identities"
   }
 ];
@@ -61,30 +61,6 @@ export const AdminSidebar = () => {
   return (
     <aside className="dark w-full border-r border-mineshaft-600 bg-gradient-to-tr from-mineshaft-700 via-mineshaft-800 to-mineshaft-900 md:w-60">
       <nav className="items-between flex h-full flex-col justify-between overflow-y-auto dark:[color-scheme:dark]">
-        <div className="flex-grow">
-          <Menu>
-            <MenuGroup title="General">
-              {generalTabs.map((tab) => {
-                const isActive = matchRoute({ to: tab.link, fuzzy: false });
-                return (
-                  <Link key={tab.link} to={tab.link}>
-                    <MenuItem isSelected={Boolean(isActive)}>{tab.label}</MenuItem>
-                  </Link>
-                );
-              })}
-            </MenuGroup>
-            <MenuGroup title="Resources">
-              {resourceTabs.map((tab) => {
-                const isActive = matchRoute({ to: tab.link, fuzzy: false });
-                return (
-                  <Link key={tab.link} to={tab.link}>
-                    <MenuItem isSelected={Boolean(isActive)}>{tab.label}</MenuItem>
-                  </Link>
-                );
-              })}
-            </MenuGroup>
-          </Menu>
-        </div>
         <Menu>
           <Link to="/organization/projects">
             <MenuItem
@@ -101,6 +77,46 @@ export const AdminSidebar = () => {
             </MenuItem>
           </Link>
         </Menu>
+        <div className="flex-grow">
+          <Menu>
+            <MenuGroup title="General">
+              {generalTabs.map((tab) => {
+                const isActive = matchRoute({ to: tab.link, fuzzy: false });
+                return (
+                  <Link key={tab.link} to={tab.link}>
+                    <MenuItem
+                      className="relative flex items-center gap-2 overflow-hidden rounded-none"
+                      leftIcon={
+                        <Lottie className="inline-block h-6 w-6 shrink-0" icon={tab.icon} />
+                      }
+                      isSelected={Boolean(isActive)}
+                    >
+                      {tab.label}
+                    </MenuItem>
+                  </Link>
+                );
+              })}
+            </MenuGroup>
+            <MenuGroup title="Resources">
+              {resourceTabs.map((tab) => {
+                const isActive = matchRoute({ to: tab.link, fuzzy: false });
+                return (
+                  <Link key={tab.link} to={tab.link}>
+                    <MenuItem
+                      className="relative flex items-center gap-2 overflow-hidden rounded-none"
+                      leftIcon={
+                        <Lottie className="inline-block h-6 w-6 shrink-0" icon={tab.icon} />
+                      }
+                      isSelected={Boolean(isActive)}
+                    >
+                      {tab.label}
+                    </MenuItem>
+                  </Link>
+                );
+              })}
+            </MenuGroup>
+          </Menu>
+        </div>
       </nav>
     </aside>
   );

frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx

@@ -54,33 +54,55 @@ const getPlan = (subscription: SubscriptionPlan) => {
   return "Free";
 };
 
+const getFormattedSupportEmailLink = (variables: { org_id: string; domain: string }) => {
+  const email = "[email protected]";
+
+  const body = `Hello Infisical Support Team,
+
+Issue Details:
+[What you did]
+[What you expected to happen]
+[What actually happened]
+[Any error request IDs]
+[Any supporting screenshots or video recording of the issue/request at hand]
+
+Account Info:
+- Organization ID: ${variables.org_id}
+- Domain: ${variables.domain}
+
+Thank you,
+[Your Name]`;
+
+  return `mailto:${email}?body=${encodeURIComponent(body)}`;
+};
+
 export const INFISICAL_SUPPORT_OPTIONS = [
   [
     <FontAwesomeIcon key={1} className="pr-4 text-sm" icon={faSlack} />,
     "Support Forum",
-    "https://infisical.com/slack"
+    () => "https://infisical.com/slack"
   ],
   [
     <FontAwesomeIcon key={2} className="pr-4 text-sm" icon={faBook} />,
     "Read Docs",
-    "https://infisical.com/docs/documentation/getting-started/introduction"
+    () => "https://infisical.com/docs/documentation/getting-started/introduction"
   ],
   [
     <FontAwesomeIcon key={3} className="pr-4 text-sm" icon={faGithub} />,
     "GitHub Issues",
-    "https://github.com/Infisical/infisical/issues"
+    () => "https://github.com/Infisical/infisical/issues"
   ],
   [
     <FontAwesomeIcon key={4} className="pr-4 text-sm" icon={faEnvelope} />,
     "Email Support",
-    "mailto:[email protected]"
+    getFormattedSupportEmailLink
   ],
   [
     <FontAwesomeIcon key={5} className="pr-4 text-sm" icon={faUsers} />,
     "Instance Admins",
-    "server-admins"
+    () => "server-admins"
   ]
-];
+] as const;
 
 export const Navbar = () => {
   const { user } = useUser();
@@ -258,7 +280,15 @@ export const Navbar = () => {
           </div>
         </DropdownMenuTrigger>
         <DropdownMenuContent align="end" side="bottom" className="mt-3 p-1">
-          {INFISICAL_SUPPORT_OPTIONS.map(([icon, text, url]) => {
+          {INFISICAL_SUPPORT_OPTIONS.map(([icon, text, getUrl]) => {
+            const url =
+              text === "Email Support"
+                ? getUrl({
+                    org_id: currentOrg.id,
+                    domain: window.location.origin
+                  })
+                : getUrl();
+
             if (url === "server-admins" && isInfisicalCloud()) {
               return null;
             }

frontend/src/layouts/PersonalSettingsLayout/PersonalSettingsLayout.tsx

@@ -1,19 +1,11 @@
 import { useTranslation } from "react-i18next";
-import { faArrowLeft, faInfo, faMobile, faQuestion } from "@fortawesome/free-solid-svg-icons";
+import { faArrowLeft, faMobile } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Link, Outlet } from "@tanstack/react-router";
 
 import { WishForm } from "@app/components/features/WishForm";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger
-} from "@app/components/v2";
-import { envConfig } from "@app/config/env";
 
 import { InsecureConnectionBanner } from "../OrganizationLayout/components/InsecureConnectionBanner";
-import { INFISICAL_SUPPORT_OPTIONS } from "../OrganizationLayout/components/NavBar/Navbar";
 
 export const PersonalSettingsLayout = () => {
   const { t } = useTranslation();
@@ -36,37 +28,6 @@ export const PersonalSettingsLayout = () => {
               <div className="relative mt-10 flex w-full cursor-default flex-col items-center px-3 text-sm text-mineshaft-400">
                 {(window.location.origin.includes("https://app.infisical.com") ||
                   window.location.origin.includes("https://gamma.infisical.com")) && <WishForm />}
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <div className="mb-2 w-full pl-5 duration-200 hover:text-mineshaft-200">
-                      <FontAwesomeIcon icon={faQuestion} className="mr-3 px-[0.1rem]" />
-                      Help & Support
-                    </div>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="start" className="p-1">
-                    {INFISICAL_SUPPORT_OPTIONS.map(([icon, text, url]) => (
-                      <DropdownMenuItem key={url as string}>
-                        <a
-                          target="_blank"
-                          rel="noopener noreferrer"
-                          href={String(url)}
-                          className="flex w-full items-center rounded-md font-normal text-mineshaft-300 duration-200"
-                        >
-                          <div className="relative flex w-full cursor-pointer select-none items-center justify-start rounded-md">
-                            {icon}
-                            <div className="text-sm">{text}</div>
-                          </div>
-                        </a>
-                      </DropdownMenuItem>
-                    ))}
-                    {envConfig.PLATFORM_VERSION && (
-                      <div className="mb-2 mt-2 w-full cursor-default pl-5 text-sm duration-200 hover:text-mineshaft-200">
-                        <FontAwesomeIcon icon={faInfo} className="mr-4 px-[0.1rem]" />
-                        Version: {envConfig.PLATFORM_VERSION}
-                      </div>
-                    )}
-                  </DropdownMenuContent>
-                </DropdownMenu>
               </div>
               )
             </nav>

frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx

@@ -39,10 +39,6 @@ export const OrgMembersSection = () => {
   const { mutateAsync: deleteMutateAsync } = useDeleteOrgMembership();
   const { mutateAsync: updateOrgMembership } = useUpdateOrgMembership();
 
-  const isMoreUsersAllowed = subscription?.memberLimit
-    ? subscription.membersUsed < subscription.memberLimit
-    : true;
-
   const isMoreIdentitiesAllowed = subscription?.identityLimit
     ? subscription.identitiesUsed < subscription.identityLimit
     : true;
@@ -58,7 +54,7 @@ export const OrgMembersSection = () => {
       return;
     }
 
-    if ((!isMoreUsersAllowed || !isMoreIdentitiesAllowed) && !isEnterprise) {
+    if (!isMoreIdentitiesAllowed && !isEnterprise) {
       handlePopUpOpen("upgradePlan", {
         description: "You can add more members if you upgrade your Infisical plan."
       });

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx

@@ -16,6 +16,7 @@ import { AzureAppConfigurationConnectionForm } from "./AzureAppConfigurationConn
 import { AzureClientSecretsConnectionForm } from "./AzureClientSecretsConnectionForm";
 import { AzureDevOpsConnectionForm } from "./AzureDevOpsConnectionForm";
 import { AzureKeyVaultConnectionForm } from "./AzureKeyVaultConnectionForm";
+import { BitbucketConnectionForm } from "./BitbucketConnectionForm";
 import { CamundaConnectionForm } from "./CamundaConnectionForm";
 import { CloudflareConnectionForm } from "./CloudflareConnectionForm";
 import { DatabricksConnectionForm } from "./DatabricksConnectionForm";
@@ -33,6 +34,7 @@ import { MySqlConnectionForm } from "./MySqlConnectionForm";
 import { OCIConnectionForm } from "./OCIConnectionForm";
 import { OracleDBConnectionForm } from "./OracleDBConnectionForm";
 import { PostgresConnectionForm } from "./PostgresConnectionForm";
+import { RailwayConnectionForm } from "./RailwayConnectionForm";
 import { RenderConnectionForm } from "./RenderConnectionForm";
 import { TeamCityConnectionForm } from "./TeamCityConnectionForm";
 import { TerraformCloudConnectionForm } from "./TerraformCloudConnectionForm";
@@ -135,8 +137,12 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
       return <GitLabConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Cloudflare:
       return <CloudflareConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.Bitbucket:
+      return <BitbucketConnectionForm onSubmit={onSubmit} />;
     case AppConnection.Zabbix:
       return <ZabbixConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.Railway:
+      return <RailwayConnectionForm onSubmit={onSubmit} />;
     default:
       throw new Error(`Unhandled App ${app}`);
   }
@@ -231,8 +237,12 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
       return <GitLabConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.Cloudflare:
       return <CloudflareConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+    case AppConnection.Bitbucket:
+      return <BitbucketConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     case AppConnection.Zabbix:
       return <ZabbixConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+    case AppConnection.Railway:
+      return <RailwayConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
     default:
       throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
   }

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/BitbucketConnectionForm.tsx

@@ -0,0 +1,144 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { BitbucketConnectionMethod, TBitbucketConnection } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TBitbucketConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Bitbucket)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(BitbucketConnectionMethod.ApiToken),
+    credentials: z.object({
+      email: z.string().email().trim().min(1, "Email required"),
+      apiToken: z.string().trim().min(1, "API Token required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const BitbucketConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Bitbucket,
+      method: BitbucketConnectionMethod.ApiToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Bitbucket].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(BitbucketConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.email"
+          control={control}
+          shouldUnregister
+          render={({ field, fieldState: { error } }) => (
+            <FormControl errorText={error?.message} isError={Boolean(error?.message)} label="Email">
+              <Input {...field} placeholder="[email protected]" />
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.apiToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="API Token"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Bitbucket"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/RailwayConnectionForm.tsx

@@ -0,0 +1,135 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  RailwayConnectionMethod,
+  TRailwayConnection
+} from "@app/hooks/api/appConnections/types/railway-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TRailwayConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Railway)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.nativeEnum(RailwayConnectionMethod),
+    credentials: z.object({
+      apiToken: z.string().trim().min(1, "Service API Token required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const RailwayConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Railway,
+      method: RailwayConnectionMethod.AccountToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The type of token you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Railway].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Token Type"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(RailwayConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.apiToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Token Value"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Railway"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};

frontend/src/pages/organization/AuditLogsPage/components/LogFilterItem.tsx

@@ -1,3 +1,5 @@
+import { faInfoCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { twMerge } from "tailwind-merge";
 
 import { Button, Tooltip } from "@app/components/v2";
@@ -8,25 +10,41 @@ type Props = {
   label: string;
   onClear: () => void;
   children: React.ReactNode;
+  tooltipText?: string;
 };
 
-export const LogFilterItem = ({ label, onClear, hoverTooltip, children, className }: Props) => {
+export const LogFilterItem = ({
+  label,
+  onClear,
+  hoverTooltip,
+  children,
+  className,
+  tooltipText
+}: Props) => {
   return (
-    <Tooltip className="relative top-4" content={hoverTooltip} isDisabled={!hoverTooltip}>
-      <div className={twMerge("flex flex-col justify-between", className)}>
-        <div className="flex items-center justify-between pr-1">
-          <p className="text-xs opacity-60">{label}</p>
-          <Button
-            onClick={() => onClear()}
-            variant="link"
-            className="font-normal text-mineshaft-400 transition-all duration-75 hover:text-mineshaft-300"
-            size="xs"
-          >
-            Clear
-          </Button>
-        </div>
-        {children}
+    <div className={twMerge("flex flex-col justify-between", className)}>
+      <div className="flex items-center pr-1">
+        <p className="text-xs opacity-60">{label}</p>
+        {tooltipText && (
+          <Tooltip content={tooltipText} className="max-w-sm">
+            <FontAwesomeIcon
+              icon={faInfoCircle}
+              className="-mt-[0.05rem] ml-1 text-[11px] text-mineshaft-400"
+            />
+          </Tooltip>
+        )}
+        <Button
+          onClick={() => onClear()}
+          variant="link"
+          className="ml-auto font-normal text-mineshaft-400 transition-all duration-75 hover:text-mineshaft-300"
+          size="xs"
+        >
+          Clear
+        </Button>
       </div>
-    </Tooltip>
+      <Tooltip className="relative top-4" content={hoverTooltip} isDisabled={!hoverTooltip}>
+        <div>{children}</div>
+      </Tooltip>
+    </div>
   );
 };

frontend/src/pages/organization/AuditLogsPage/components/LogsFilter.tsx

@@ -366,6 +366,7 @@ export const LogsFilter = ({ presets, setFilter, filter }: Props) => {
                     </LogFilterItem>
                     <LogFilterItem
                       label="Secret Path"
+                      tooltipText="Enter the exact secret path (wildcards like * are not supported)"
                       hoverTooltip={
                         !selectedProject
                           ? "Select a project before filtering by secret path."
@@ -380,10 +381,7 @@ export const LogsFilter = ({ presets, setFilter, filter }: Props) => {
                         control={control}
                         name="secretPath"
                         render={({ field: { onChange, value, ...field } }) => (
-                          <FormControl
-                            tooltipText="Filter audit logs related to events that occurred on a specific secret path."
-                            className="w-full"
-                          >
+                          <FormControl className="w-full">
                             <Input
                               placeholder="Enter secret path"
                               className="disabled:cursor-not-allowed"
@@ -403,6 +401,7 @@ export const LogsFilter = ({ presets, setFilter, filter }: Props) => {
                           ? "Select a project before filtering by secret key."
                           : undefined
                       }
+                      tooltipText="Enter the exact secret key name (wildcards like * are not supported)"
                       className={twMerge(!selectedProject && "opacity-50")}
                       label="Secret Key"
                       onClear={() => {
@@ -413,10 +412,7 @@ export const LogsFilter = ({ presets, setFilter, filter }: Props) => {
                         control={control}
                         name="secretKey"
                         render={({ field: { onChange, value, ...field } }) => (
-                          <FormControl
-                            tooltipText="Filter audit logs related to a specific secret."
-                            className="w-full"
-                          >
+                          <FormControl className="w-full">
                             <Input
                               isDisabled={!selectedProject}
                               {...field}

frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/components/IntegrationAuditLogsSection.tsx

@@ -70,7 +70,7 @@ export const IntegrationAuditLogsSection = ({ integration }: Props) => {
                     upgrade your subscription
                   </a>
                 </a>
-              )}
+              )}{" "}
               to view integration logs
             </p>
           </div>

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/RailwaySyncDestinationCol.tsx

@@ -0,0 +1,14 @@
+import { TRailwaySync } from "@app/hooks/api/secretSyncs/types/railway-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TRailwaySync;
+};
+
+export const RailwaySyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx

@@ -17,6 +17,7 @@ import { HCVaultSyncDestinationCol } from "./HCVaultSyncDestinationCol";
 import { HerokuSyncDestinationCol } from "./HerokuSyncDestinationCol";
 import { HumanitecSyncDestinationCol } from "./HumanitecSyncDestinationCol";
 import { OCIVaultSyncDestinationCol } from "./OCIVaultSyncDestinationCol";
+import { RailwaySyncDestinationCol } from "./RailwaySyncDestinationCol";
 import { RenderSyncDestinationCol } from "./RenderSyncDestinationCol";
 import { TeamCitySyncDestinationCol } from "./TeamCitySyncDestinationCol";
 import { TerraformCloudSyncDestinationCol } from "./TerraformCloudSyncDestinationCol";
@@ -76,6 +77,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
       return <CloudflarePagesSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.Zabbix:
       return <ZabbixSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.Railway:
+      return <RailwaySyncDestinationCol secretSync={secretSync} />;
     default:
       throw new Error(
         `Unhandled Secret Sync Destination Col: ${(secretSync as TSecretSync).destination}`

frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts

@@ -156,6 +156,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
         throw new Error(`Unhandled Zabbix Scope Destination Col Values ${destination}`);
       }
       break;
+    case SecretSync.Railway:
+      primaryText = "Railway Project";
+      secondaryText = destinationConfig.projectName;
+      break;
     default:
       throw new Error(`Unhandled Destination Col Values ${destination}`);
   }

frontend/src/pages/secret-manager/SecretApprovalsPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx

@@ -55,7 +55,7 @@ const formSchema = z
   .object({
     environment: z.object({ slug: z.string(), name: z.string() }),
     name: z.string().optional(),
-    secretPath: z.string().optional(),
+    secretPath: z.string().trim().min(1),
     approvals: z.number().min(1).default(1),
     userApprovers: z
       .object({ type: z.literal(ApproverType.User), id: z.string() })
@@ -93,20 +93,19 @@ const formSchema = z
       .optional()
   })
   .superRefine((data, ctx) => {
-    if (
-      data.policyType === PolicyType.ChangePolicy &&
-      !(data.groupApprovers.length || data.userApprovers.length)
-    ) {
-      ctx.addIssue({
-        path: ["userApprovers"],
-        code: z.ZodIssueCode.custom,
-        message: "At least one approver should be provided"
-      });
-      ctx.addIssue({
-        path: ["groupApprovers"],
-        code: z.ZodIssueCode.custom,
-        message: "At least one approver should be provided"
-      });
+    if (data.policyType === PolicyType.ChangePolicy) {
+      if (!(data.groupApprovers.length || data.userApprovers.length)) {
+        ctx.addIssue({
+          path: ["userApprovers"],
+          code: z.ZodIssueCode.custom,
+          message: "At least one approver should be provided"
+        });
+        ctx.addIssue({
+          path: ["groupApprovers"],
+          code: z.ZodIssueCode.custom,
+          message: "At least one approver should be provided"
+        });
+      }
     }
   });
 
@@ -127,6 +126,7 @@ const Form = ({
     control,
     handleSubmit,
     watch,
+    resetField,
     formState: { isSubmitting }
   } = useForm<TFormSchema>({
     resolver: zodResolver(formSchema),
@@ -177,6 +177,7 @@ const Form = ({
       : undefined,
     defaultValues: !editValues
       ? {
+          secretPath: "/",
           sequenceApprovers: [{ approvals: 1 }]
         }
       : undefined
@@ -405,7 +406,10 @@ const Form = ({
                 <Select
                   isDisabled={isEditMode}
                   value={value}
-                  onValueChange={(val) => onChange(val as PolicyType)}
+                  onValueChange={(val) => {
+                    onChange(val as PolicyType);
+                    resetField("secretPath");
+                  }}
                   className="w-full border border-mineshaft-500"
                 >
                   {Object.values(PolicyType).map((policyType) => {
@@ -465,6 +469,7 @@ const Form = ({
               <FormControl
                 tooltipText="Secret paths support glob patterns. For example, '/**' will match all paths."
                 label="Secret Path"
+                isRequired
                 isError={Boolean(error)}
                 errorText={error?.message}
                 className="flex-1"

frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx

@@ -15,6 +15,7 @@ import {
   TextArea
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
+import { useGetServerConfig } from "@app/hooks/api/admin";
 import {
   DynamicSecretAwsIamAuth,
   DynamicSecretProviders
@@ -61,6 +62,23 @@ const formSchema = z.object({
           })
         )
         .optional()
+    }),
+    z.object({
+      method: z.literal(DynamicSecretAwsIamAuth.IRSA),
+      region: z.string().trim().min(1),
+      awsPath: z.string().trim().optional(),
+      permissionBoundaryPolicyArn: z.string().trim().optional(),
+      policyDocument: z.string().trim().optional(),
+      userGroups: z.string().trim().optional(),
+      policyArns: z.string().trim().optional(),
+      tags: z
+        .array(
+          z.object({
+            key: z.string().trim().min(1).max(128),
+            value: z.string().trim().min(1).max(256)
+          })
+        )
+        .optional()
     })
   ]),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -106,6 +124,8 @@ export const AwsIamInputForm = ({
   projectSlug,
   isSingleEnvironmentMode
 }: Props) => {
+  const { data: serverConfig } = useGetServerConfig();
+
   const {
     control,
     formState: { isSubmitting },
@@ -123,7 +143,7 @@ export const AwsIamInputForm = ({
   });
 
   const createDynamicSecret = useCreateDynamicSecret();
-  const isAccessKeyMethod = watch("provider.method") === DynamicSecretAwsIamAuth.AccessKey;
+  const method = watch("provider.method");
 
   const handleCreateDynamicSecret = async ({
     name,
@@ -237,11 +257,14 @@ export const AwsIamInputForm = ({
                         Assume Role (Recommended)
                       </SelectItem>
                       <SelectItem value={DynamicSecretAwsIamAuth.AccessKey}>Access Key</SelectItem>
+                      {serverConfig?.kubernetesAutoFetchServiceAccountToken && (
+                        <SelectItem value={DynamicSecretAwsIamAuth.IRSA}>IRSA (EKS)</SelectItem>
+                      )}
                     </Select>
                   </FormControl>
                 )}
               />
-              {isAccessKeyMethod ? (
+              {method === DynamicSecretAwsIamAuth.AccessKey && (
                 <div className="flex items-center space-x-2">
                   <Controller
                     control={control}
@@ -274,7 +297,8 @@ export const AwsIamInputForm = ({
                     )}
                   />
                 </div>
-              ) : (
+              )}
+              {method === DynamicSecretAwsIamAuth.AssumeRole && (
                 <div className="flex items-center space-x-2">
                   <Controller
                     control={control}

frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsIamForm.tsx

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
 import { Button, FormControl, Input, Select, SelectItem, TextArea } from "@app/components/v2";
-import { useUpdateDynamicSecret } from "@app/hooks/api";
+import { useGetServerConfig, useUpdateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretAwsIamAuth, TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { slugSchema } from "@app/lib/schemas";
 
@@ -40,6 +40,18 @@ const formSchema = z.object({
       tags: z
         .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) }))
         .optional()
+    }),
+    z.object({
+      method: z.literal(DynamicSecretAwsIamAuth.IRSA),
+      region: z.string().trim().min(1),
+      awsPath: z.string().trim().optional(),
+      permissionBoundaryPolicyArn: z.string().trim().optional(),
+      policyDocument: z.string().trim().optional(),
+      userGroups: z.string().trim().optional(),
+      policyArns: z.string().trim().optional(),
+      tags: z
+        .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) }))
+        .optional()
     })
   ]),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -83,6 +95,8 @@ export const EditDynamicSecretAwsIamForm = ({
   secretPath,
   projectSlug
 }: Props) => {
+  const { data: serverConfig } = useGetServerConfig();
+
   const {
     control,
     watch,
@@ -100,7 +114,7 @@ export const EditDynamicSecretAwsIamForm = ({
       }
     }
   });
-  const isAccessKeyMethod = watch("inputs.method") === DynamicSecretAwsIamAuth.AccessKey;
+  const method = watch("inputs.method");
 
   const updateDynamicSecret = useUpdateDynamicSecret();
 
@@ -214,11 +228,14 @@ export const EditDynamicSecretAwsIamForm = ({
                       Assume Role (Recommended)
                     </SelectItem>
                     <SelectItem value={DynamicSecretAwsIamAuth.AccessKey}>Access Key</SelectItem>
+                    {serverConfig?.kubernetesAutoFetchServiceAccountToken && (
+                      <SelectItem value={DynamicSecretAwsIamAuth.IRSA}>IRSA (EKS)</SelectItem>
+                    )}
                   </Select>
                 </FormControl>
               )}
             />
-            {isAccessKeyMethod ? (
+            {method === DynamicSecretAwsIamAuth.AccessKey && (
               <div className="flex items-center space-x-2">
                 <Controller
                   control={control}
@@ -251,7 +268,8 @@ export const EditDynamicSecretAwsIamForm = ({
                   )}
                 />
               </div>
-            ) : (
+            )}
+            {method === DynamicSecretAwsIamAuth.AssumeRole && (
               <div className="flex items-center space-x-2">
                 <Controller
                   control={control}

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretDropzone/SecretDropzone.tsx

@@ -9,7 +9,7 @@ import { twMerge } from "tailwind-merge";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 // TODO:(akhilmhdh) convert all the util functions like this into a lib folder grouped by functionality
-import { parseDotEnv, parseJson } from "@app/components/utilities/parseSecrets";
+import { parseDotEnv, parseJson, parseYaml } from "@app/components/utilities/parseSecrets";
 import { Button, Lottie, Modal, ModalContent } from "@app/components/v2";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp, useToggle } from "@app/hooks";
@@ -127,7 +127,7 @@ export const SecretDropzone = ({
     }
   };
 
-  const parseFile = (file?: File, isJson?: boolean) => {
+  const parseFile = (file?: File) => {
     const reader = new FileReader();
     if (!file) {
       createNotification({
@@ -140,10 +140,25 @@ export const SecretDropzone = ({
     setIsLoading.on();
     reader.onload = (event) => {
       if (!event?.target?.result) return;
-      // parse function's argument looks like to be ArrayBuffer
-      const env = isJson
-        ? parseJson(event.target.result as ArrayBuffer)
-        : parseDotEnv(event.target.result as ArrayBuffer);
+
+      let env: TParsedEnv;
+
+      const src = event.target.result as ArrayBuffer;
+
+      switch (file.type) {
+        case "application/json":
+          env = parseJson(src);
+          break;
+        case "text/yaml":
+        case "application/x-yaml":
+        case "application/yaml":
+          env = parseYaml(src);
+          break;
+
+        default:
+          env = parseDotEnv(src);
+          break;
+      }
       setIsLoading.off();
       handleParsedEnv(env);
     };
@@ -165,12 +180,12 @@ export const SecretDropzone = ({
 
     e.dataTransfer.dropEffect = "copy";
     setDragActive.off();
-    parseFile(e.dataTransfer.files[0], e.dataTransfer.files[0].type === "application/json");
+    parseFile(e.dataTransfer.files[0]);
   };
 
   const handleFileUpload = (e: ChangeEvent<HTMLInputElement>) => {
     e.preventDefault();
-    parseFile(e.target?.files?.[0], e.target?.files?.[0]?.type === "application/json");
+    parseFile(e.target?.files?.[0]);
   };
 
   const handleSaveSecrets = async () => {

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretImportListView/SecretImportItem.tsx

@@ -9,6 +9,7 @@ import {
   faInfoCircle,
   faKey,
   faRotate,
+  faSearch,
   faUpDown,
   faWarning,
   faXmark
@@ -140,6 +141,10 @@ export const SecretImportItem = ({
     }
   };
 
+  const filteredImportedSecrets = importedSecrets.filter((secret) =>
+    secret.key.toUpperCase().includes(searchTerm.toUpperCase())
+  );
+
   return (
     <>
       <div
@@ -305,21 +310,26 @@ export const SecretImportItem = ({
                       </td>
                     </tr>
                   )}
-                  {importedSecrets
-                    .filter((secret) => secret.key.toUpperCase().includes(searchTerm.toUpperCase()))
-                    .map(({ key, value }, index) => (
-                      <tr key={`${id}-${key}-${index + 1}`}>
-                        <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
-                          {key}
-                        </td>
-                        <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
-                          <SecretInput value={value} isReadOnly />
-                        </td>
-                        {/* <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
+                  {filteredImportedSecrets.length === 0 && importedSecrets?.length !== 0 && (
+                    <tr>
+                      <td colSpan={3}>
+                        <EmptyState title="No secrets match search" icon={faSearch} />
+                      </td>
+                    </tr>
+                  )}
+                  {filteredImportedSecrets.map(({ key, value }, index) => (
+                    <tr key={`${id}-${key}-${index + 1}`}>
+                      <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
+                        {key}
+                      </td>
+                      <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
+                        <SecretInput value={value} isReadOnly />
+                      </td>
+                      {/* <td className="h-10" style={{ padding: "0.25rem 1rem" }}>
                           <EnvFolderIcon env={overriden?.env} secretPath={overriden?.secretPath} />
                         </td> */}
-                      </tr>
-                    ))}
+                    </tr>
+                  ))}
                 </tbody>
               </table>
             </TableContainer>

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/RailwaySyncDestinationSection.tsx

@@ -0,0 +1,17 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TRailwaySync } from "@app/hooks/api/secretSyncs/types/railway-sync";
+
+type Props = {
+  secretSync: TRailwaySync;
+};
+
+export const RailwaySyncDestinationSection = ({ secretSync }: Props) => {
+  const { destinationConfig } = secretSync;
+
+  return (
+    <>
+      <GenericFieldLabel label="Project">{destinationConfig.projectName}</GenericFieldLabel>
+      <GenericFieldLabel label="Environment">{destinationConfig.environmentName}</GenericFieldLabel>
+    </>
+  );
+};

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx

@@ -28,6 +28,7 @@ import { HCVaultSyncDestinationSection } from "./HCVaultSyncDestinationSection";
 import { HerokuSyncDestinationSection } from "./HerokuSyncDestinationSection";
 import { HumanitecSyncDestinationSection } from "./HumanitecSyncDestinationSection";
 import { OCIVaultSyncDestinationSection } from "./OCIVaultSyncDestinationSection";
+import { RailwaySyncDestinationSection } from "./RailwaySyncDestinationSection";
 import { RenderSyncDestinationSection } from "./RenderSyncDestinationSection";
 import { TeamCitySyncDestinationSection } from "./TeamCitySyncDestinationSection";
 import { TerraformCloudSyncDestinationSection } from "./TerraformCloudSyncDestinationSection";
@@ -118,6 +119,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
     case SecretSync.Zabbix:
       DestinationComponents = <ZabbixSyncDestinationSection secretSync={secretSync} />;
       break;
+    case SecretSync.Railway:
+      DestinationComponents = <RailwaySyncDestinationSection secretSync={secretSync} />;
+      break;
     default:
       throw new Error(`Unhandled Destination Section components: ${destination}`);
   }

frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx

@@ -61,6 +61,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
     case SecretSync.GitLab:
     case SecretSync.CloudflarePages:
     case SecretSync.Zabbix:
+    case SecretSync.Railway:
       AdditionalSyncOptionsComponent = null;
       break;
     default:

frontend/src/pages/secret-manager/integrations/BitbucketConfigurePage/BitbucketConfigurePage.tsx

@@ -20,9 +20,9 @@ import { useWorkspace } from "@app/context";
 import {
   useCreateIntegration,
   useGetIntegrationAuthApps,
-  useGetIntegrationAuthBitBucketWorkspaces
+  useGetIntegrationAuthBitbucketWorkspaces
 } from "@app/hooks/api";
-import { useGetIntegrationAuthBitBucketEnvironments } from "@app/hooks/api/integrationAuth/queries";
+import { useGetIntegrationAuthBitbucketEnvironments } from "@app/hooks/api/integrationAuth/queries";
 import { IntegrationsListPageTabs } from "@app/types/integrations";
 
 enum BitbucketScope {
@@ -89,8 +89,8 @@ export const BitbucketConfigurePage = () => {
     }
   });
 
-  const bitBucketWorkspace = watch("targetWorkspace");
-  const bitBucketRepo = watch("targetRepo");
+  const bitbucketWorkspace = watch("targetWorkspace");
+  const bitbucketRepo = watch("targetRepo");
 
   const integrationAuthId = useSearch({
     from: ROUTE_PATHS.SecretManager.Integratons.BitbucketConfigurePage.id,
@@ -99,21 +99,21 @@ export const BitbucketConfigurePage = () => {
   const { currentWorkspace } = useWorkspace();
 
   const { data: bitbucketWorkspaces, isPending: isBitbucketWorkspacesLoading } =
-    useGetIntegrationAuthBitBucketWorkspaces((integrationAuthId as string) ?? "");
+    useGetIntegrationAuthBitbucketWorkspaces((integrationAuthId as string) ?? "");
 
   const { data: bitbucketRepos, isPending: isBitbucketReposLoading } = useGetIntegrationAuthApps({
     integrationAuthId: (integrationAuthId as string) ?? "",
-    workspaceSlug: bitBucketWorkspace?.slug
+    workspaceSlug: bitbucketWorkspace?.slug
   });
 
   const { data: bitbucketEnvironments, isPending: isBitbucketEnvironmentsLoading } =
-    useGetIntegrationAuthBitBucketEnvironments(
+    useGetIntegrationAuthBitbucketEnvironments(
       {
         integrationAuthId: (integrationAuthId as string) ?? "",
-        workspaceSlug: bitBucketWorkspace?.slug ?? "",
-        repoSlug: bitBucketRepo?.appId ?? ""
+        workspaceSlug: bitbucketWorkspace?.slug ?? "",
+        repoSlug: bitbucketRepo?.appId ?? ""
       },
-      { enabled: Boolean(bitBucketWorkspace?.slug && bitBucketRepo?.appId) }
+      { enabled: Boolean(bitbucketWorkspace?.slug && bitbucketRepo?.appId) }
     );
 
   const onSubmit = async ({
@@ -167,8 +167,8 @@ export const BitbucketConfigurePage = () => {
 
   useEffect(() => {
     if (
-      bitBucketWorkspace ||
-      bitBucketRepo ||
+      bitbucketWorkspace ||
+      bitbucketRepo ||
       !bitbucketRepos ||
       !bitbucketWorkspaces ||
       !currentWorkspace
@@ -325,7 +325,7 @@ export const BitbucketConfigurePage = () => {
                       ? "Select an environment..."
                       : "No environments found..."
                   }
-                  isLoading={isBitbucketEnvironmentsLoading && Boolean(bitBucketRepo)}
+                  isLoading={isBitbucketEnvironmentsLoading && Boolean(bitbucketRepo)}
                   isDisabled={!bitbucketEnvironments?.length || isBitbucketEnvironmentsLoading}
                 />
               </FormControl>

frontend/src/pages/secret-scanning/SecretScanningDataSourceByIdPage/components/DataSourceConfigDisplay/BitbucketDataSourceConfigDisplay.tsx

@@ -0,0 +1,21 @@
+import { GenericFieldLabel } from "@app/components/v2";
+import { TBitbucketDataSource } from "@app/hooks/api/secretScanningV2/types/bitbucket-data-source";
+
+type Props = {
+  dataSource: TBitbucketDataSource;
+};
+
+export const BitbucketDataSourceConfigDisplay = ({ dataSource }: Props) => {
+  const {
+    config: { includeRepos, workspaceSlug }
+  } = dataSource;
+
+  return (
+    <>
+      <GenericFieldLabel label="Workspace Slug">{workspaceSlug}</GenericFieldLabel>
+      <GenericFieldLabel label="Scan Repositories">
+        {includeRepos.includes("*") ? "All" : includeRepos.join(", ")}
+      </GenericFieldLabel>
+    </>
+  );
+};

frontend/src/pages/secret-scanning/SecretScanningDataSourceByIdPage/components/DataSourceConfigDisplay/DataSourceConfigDisplay.tsx

@@ -3,6 +3,7 @@ import {
   TSecretScanningDataSource
 } from "@app/hooks/api/secretScanningV2";
 
+import { BitbucketDataSourceConfigDisplay } from "./BitbucketDataSourceConfigDisplay";
 import { GitHubDataSourceConfigDisplay } from "./GitHubDataSourceConfigDisplay";
 
 type Props = {
@@ -13,6 +14,8 @@ export const DataSourceConfigDisplay = ({ dataSource }: Props) => {
   switch (dataSource.type) {
     case SecretScanningDataSource.GitHub:
       return <GitHubDataSourceConfigDisplay dataSource={dataSource} />;
+    case SecretScanningDataSource.Bitbucket:
+      return <BitbucketDataSourceConfigDisplay dataSource={dataSource} />;
     default:
       throw new Error(
         `Unhandled dataSource type ${(dataSource as TSecretScanningDataSource).type}`

frontend/src/pages/secret-scanning/SecretScanningDataSourceByIdPage/components/SecretScanningResourceTable.tsx

@@ -112,10 +112,12 @@ export const SecretScanningResourcesTable = ({ dataSource }: Props) => {
           const isActive = includeRepos.includes("*") || includeRepos.includes(name);
 
           if (filters.status.length === 1) {
-            if (filters.status.includes(ResourceStatus.Active)) {
-              return isActive;
+            if (filters.status.includes(ResourceStatus.Active) && !isActive) {
+              return false;
+            }
+            if (filters.status.includes(ResourceStatus.Inactive) && isActive) {
+              return false;
             }
-            return !isActive;
           }
 
           const searchValue = search.trim().toLowerCase();

frontend/src/pages/secret-scanning/SecretScanningDataSourcesPage/components/SecretScanningDataSourcesTable.tsx

@@ -294,7 +294,7 @@ export const SecretScanningDataSourcesTable = ({ dataSources }: Props) => {
         <Table>
           <THead>
             <Tr>
-              <Th className="w-60">Platform</Th>
+              <Th className="min-w-36">Platform</Th>
               <Th className="w-1/3">
                 <div className="flex items-center">
                   Name