diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts index e14451498..8b13ce4d4 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts @@ -144,5 +144,28 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => { return softDeletedPolicy; }; - return { ...accessApprovalPolicyOrm, find, findById, softDeleteById }; + const findLastValidPolicy = async ({ envId, secretPath }: { envId: string; secretPath: string }, tx?: Knex) => { + try { + const result = await (tx || db.replicaNode())(TableName.AccessApprovalPolicy) + .where( + // eslint-disable-next-line @typescript-eslint/no-misused-promises + buildFindFilter( + { + envId, + secretPath + }, + TableName.AccessApprovalPolicy + ) + ) + .orderBy("deletedAt", "desc") + .orderByRaw(`"deletedAt" IS NULL`) + .first(); + + return result; + } catch (error) { + throw new DatabaseError({ error, name: "FindLastValidPolicy" }); + } + }; + + return { ...accessApprovalPolicyOrm, find, findById, softDeleteById, findLastValidPolicy }; }; diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts index 017356a5d..6d20369cf 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts @@ -57,7 +57,7 @@ type TSecretApprovalRequestServiceFactoryDep = { | "findOne" | "getCount" >; - accessApprovalPolicyDAL: Pick; + accessApprovalPolicyDAL: Pick; accessApprovalRequestReviewerDAL: Pick< TAccessApprovalRequestReviewerDALFactory, "create" | "find" | "findOne" | "transaction" @@ -132,7 +132,7 @@ export const accessApprovalRequestServiceFactory = ({ if (!environment) throw new NotFoundError({ message: `Environment with slug '${envSlug}' not found` }); - const policy = await accessApprovalPolicyDAL.findOne({ + const policy = await accessApprovalPolicyDAL.findLastValidPolicy({ envId: environment.id, secretPath }); diff --git a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx index a48c158f2..f7e7694f2 100644 --- a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx +++ b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/ApprovalPolicyList/components/AccessPolicyModal.tsx @@ -45,7 +45,7 @@ const formSchema = z environment: z.object({ slug: z.string(), name: z.string() }), name: z.string().optional(), secretPath: z.string().optional(), - approvals: z.number().min(1), + approvals: z.number().min(1).default(1), userApprovers: z .object({ type: z.literal(ApproverType.User), id: z.string() }) .array() @@ -55,7 +55,7 @@ const formSchema = z .array() .default([]), policyType: z.nativeEnum(PolicyType), - enforcementLevel: z.nativeEnum(EnforcementLevel), + enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard), allowedSelfApprovals: z.boolean().default(true) }) .superRefine((data, ctx) => {