From 1ea0bc281472940f5c41b9de49c2779f539e5d76 Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Tue, 16 Sep 2025 01:05:07 -0400
Subject: [PATCH] feat(notifications): change policy bypass notification

---
 .../secret-approval-request-service.ts               | 12 ++++++++++++
 .../src/services/notification/notification-types.ts  |  3 ++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
index 7e052baa5..b19143b76 100644
--- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
+++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
@@ -29,6 +29,7 @@ import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
 import { TProjectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
 import { TNotificationServiceFactory } from "@app/services/notification/notification-service";
+import { NotificationType } from "@app/services/notification/notification-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
@@ -1038,6 +1039,17 @@ export const secretApprovalRequestServiceFactory = ({
         }
       });
 
+      await notificationService.createUserNotifications(
+        approverUsers.map((approver) => ({
+          userId: approver.id,
+          orgId: project.orgId,
+          type: NotificationType.SECRET_CHANGE_POLICY_BYPASSED,
+          title: "Secret Change Policy Bypassed",
+          body: `**${requestedByUser.firstName} ${requestedByUser.lastName}** (${requestedByUser.email}) has merged a secret to **${policy.secretPath}** in the **${env.name}** environment for project **${project.name}** without obtaining the required approval.`,
+          link: `/projects/secret-management/${project.id}/approval`
+        }))
+      );
+
       await smtpService.sendMail({
         recipients: approverUsers.filter((approver) => approver.email).map((approver) => approver.email!),
         subjectLine: "Infisical Secret Change Policy Bypassed",
diff --git a/backend/src/services/notification/notification-types.ts b/backend/src/services/notification/notification-types.ts
index f12f73792..d62fbb07c 100644
--- a/backend/src/services/notification/notification-types.ts
+++ b/backend/src/services/notification/notification-types.ts
@@ -2,7 +2,8 @@ export enum NotificationType {
   ACCESS_APPROVAL_REQUEST = "access-approval-request",
   ACCESS_APPROVAL_REQUEST_UPDATED = "access-approval-request-updated",
   ACCESS_POLICY_BYPASSED = "access-policy-bypassed",
-  SECRET_CHANGE_REQUEST = "secret-change-request"
+  SECRET_CHANGE_REQUEST = "secret-change-request",
+  SECRET_CHANGE_POLICY_BYPASSED = "secret-change-policy-bypassed"
 }
 
 export interface TCreateUserNotificationDTO {