fix(router): remove complexity mode env var support

Author: AdrienPoupa

docs-website/router/configuration.mdx

@@ -2050,7 +2050,7 @@ The configuration for the security. The security is used to configure the securi
 | SECURITY_BLOCK_PERSISTED_OPERATIONS_CONDITION     | block_persisted_operations.condition     | <Icon icon="square" /> | The [expression](/router/configuration/template-expressions) to evaluate if the operation should be blocked.                       |               |
 |                                                   | complexity_calculation_cache             | <Icon icon="square" /> | Complexity Cache configuration                                                                                                     |               |
 |                                                   | complexity_limits                        | <Icon icon="square" /> | Complexity limits configuration                                                                                                    |               |
-| SECURITY_COMPLEXITY_MODE                          | complexity_limits.mode                   | <Icon icon="square" /> | `measure` calculates complexity without rejecting; `enforce` rejects operations exceeding limits.                                  | enforce       |
+|                                                   | complexity_limits.mode                   | <Icon icon="square" /> | `measure` calculates complexity without rejecting; `enforce` rejects operations exceeding limits.                                  | enforce       |
 |                                                   | parser_limits.approximate_depth_limit    | <Icon icon="square" /> | The approximate cumulative depth limit of a query, including fragments. Set to 0 to disable.                                       | 200           |
 |                                                   | parser_limits.total_fields_limit         | <Icon icon="square" /> | The total number of fields the parser will allow. Set to 0 to disable.                                                             | 3500          |
 | SECURITY_OPERATION_NAME_LENGTH_LIMIT              | operation_name_length_limit              | <Icon icon="square" /> | The maximum allowed length for the operation name. Set to 0 to disable.                                                            | 512           |
@@ -2156,7 +2156,7 @@ The `mode` field controls enforcement versus measurement:
 
 | Environment Variable     | YAML                        | Required               | Description                                                                                                                                                                            | Default Value |
 | ------------------------ | --------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
-| SECURITY_COMPLEXITY_MODE | mode                        | <Icon icon="square" /> | `measure` calculates complexity without rejecting; `enforce` rejects operations exceeding limits.                                                                                      | enforce       |
+|                          | mode                        | <Icon icon="square" /> | `measure` calculates complexity without rejecting; `enforce` rejects operations exceeding limits.                                                                                      | enforce       |
 |                          | enabled                     | <Icon icon="square" /> | Enable the specific limit. If the value is true (default: false), and a valid limit value is set, the limit will be applied.                                                           | false         |
 |                          | limit                       | <Icon icon="square" /> | The limit amount for query. If the limit is 0, this limit is not applied.                                                                                                              | 0             |
 |                          | ignore_persisted_operations | <Icon icon="square" /> | Disable the limit for persisted operations. Since persisted operations are stored intentionally, users may want to disable the limit to consciously allow nested persisted operations. | false         |

router/pkg/config/config.go

@@ -509,7 +509,7 @@ type ComplexityLimits struct {
 	// Mode controls complexity limits behavior:
 	// - "measure": calculates complexity without rejecting operations (for monitoring)
 	// - "enforce": calculates complexity and rejects operations exceeding limits
-	Mode ComplexityLimitsMode `yaml:"mode,omitempty" envDefault:"enforce" env:"SECURITY_COMPLEXITY_MODE"`
+	Mode ComplexityLimitsMode `yaml:"mode,omitempty"`
 
 	Depth            *ComplexityLimit `yaml:"depth"`
 	TotalFields      *ComplexityLimit `yaml:"total_fields"`

router/pkg/config/config_test.go

@@ -1764,22 +1764,6 @@ security:
 		require.Equal(t, ComplexityLimitsModeMeasure, cfg.Config.SecurityConfiguration.ComplexityLimits.Mode)
 	})
 
-	t.Run("mode env var requires YAML expansion", func(t *testing.T) {
-		t.Setenv("SECURITY_COMPLEXITY_MODE", "measure")
-
-		f := createTempFileFromFixture(t, `
-version: "1"
-
-security:
-  complexity_limits:
-    depth:
-      enabled: true
-      limit: 5
-`)
-		cfg, err := LoadConfig([]string{f})
-		require.NoError(t, err)
-		require.Equal(t, ComplexityLimitsModeUnset, cfg.Config.SecurityConfiguration.ComplexityLimits.Mode)
-	})
 }
 
 func TestCostControlConfig(t *testing.T) {