From cc749d5513c4b9b20cfa2d04ad8e701a3707bdb9 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 4 Nov 2025 12:33:05 -0800
Subject: [PATCH] Add feature flag to gate the feature

---
 backend/src/ee/routes/v1/index.ts | 8 ++++++--
 backend/src/lib/config/env.ts     | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts
index a22cd4583..2228c43bd 100644
--- a/backend/src/ee/routes/v1/index.ts
+++ b/backend/src/ee/routes/v1/index.ts
@@ -1,11 +1,11 @@
 import { registerProjectTemplateRouter } from "@app/ee/routes/v1/project-template-router";
 
+import { getConfig } from "@app/lib/config/env";
 import { registerAccessApprovalPolicyRouter } from "./access-approval-policy-router";
 import { registerAccessApprovalRequestRouter } from "./access-approval-request-router";
 import { registerAssumePrivilegeRouter } from "./assume-privilege-router";
 import { AUDIT_LOG_STREAM_REGISTER_ROUTER_MAP, registerAuditLogStreamRouter } from "./audit-log-stream-routers";
 import { registerCaCrlRouter } from "./certificate-authority-crl-router";
-import { registerPkiAcmeRouter } from "./pki-acme-router";
 import { registerDeprecatedProjectRoleRouter } from "./deprecated-project-role-router";
 import { registerDeprecatedProjectRouter } from "./deprecated-project-router";
 import { registerDeprecatedSecretApprovalPolicyRouter } from "./deprecated-secret-approval-policy-router";
@@ -31,6 +31,7 @@ import { PAM_RESOURCE_REGISTER_ROUTER_MAP } from "./pam-resource-routers";
 import { registerPamResourceRouter } from "./pam-resource-routers/pam-resource-router";
 import { registerPamSessionRouter } from "./pam-session-router";
 import { registerPITRouter } from "./pit-router";
+import { registerPkiAcmeRouter } from "./pki-acme-router";
 import { registerProjectRoleRouter } from "./project-role-router";
 import { registerProjectRouter } from "./project-router";
 import { registerRateLimitRouter } from "./rate-limit-router";
@@ -108,7 +109,10 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   await server.register(
     async (pkiRouter) => {
       await pkiRouter.register(registerCaCrlRouter, { prefix: "/crl" });
-      await pkiRouter.register(registerPkiAcmeRouter, { prefix: "/acme" });
+      // Notice: current this feature is still in development and is not yet ready for production.
+      if (getConfig().ACME_FEATURE_ENABLED === true) {
+        await pkiRouter.register(registerPkiAcmeRouter, { prefix: "/acme" });
+      }
     },
     { prefix: "/pki" }
   );
diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 6f0502184..94ce79e94 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -106,6 +106,10 @@ const envSchema = z
     HTTPS_ENABLED: zodStrBool,
     ROTATION_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
     DAILY_RESOURCE_CLEAN_UP_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
+    // Note: The ACME feature is still in development and is not yet ready for production.
+    //       This is the feature flag to enable/disable the ACME feature.
+    //       It's not intended to be used by users outside of the development team yet.
+    ACME_FEATURE_ENABLED: zodStrBool.default("false").optional(),
     ACME_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
     ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES: zpStr(
       z