improvements: address feedback

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -398,8 +398,32 @@ export const secretSnapshotServiceFactory = ({
     if (shouldUseBridge) {
       const rollback = await snapshotDAL.transaction(async (tx) => {
         const rollbackSnaps = await snapshotDAL.findRecursivelySnapshotsV2Bridge(snapshot.id, tx);
-        // this will remove all secrets in current folder
-        const deletedTopLevelSecs = await secretV2BridgeDAL.delete({ folderId: snapshot.folderId }, tx);
+        const secretRotationIds = rollbackSnaps
+          .flatMap((snap) => snap.secretVersions)
+          .filter((el) => el.isRotatedSecret)
+          .map((el) => el.secretId);
+
+        // this will remove all secrets in current folder except rotated secrets which we ignore
+        const deletedTopLevelSecs = await secretV2BridgeDAL.delete(
+          {
+            $complex: {
+              operator: "and",
+              value: [
+                {
+                  operator: "eq",
+                  field: "folderId",
+                  value: snapshot.folderId
+                },
+                {
+                  operator: "notIn",
+                  field: "id",
+                  value: secretRotationIds
+                }
+              ]
+            }
+          },
+          tx
+        );
         const deletedTopLevelSecsGroupById = groupBy(deletedTopLevelSecs, (item) => item.id);
         // this will remove all secrets and folders on child
         // due to sql foreign key and link list connection removing the folders removes everything below too
@@ -424,28 +448,31 @@ export const secretSnapshotServiceFactory = ({
         );
         const secrets = await secretV2BridgeDAL.insertMany(
           rollbackSnaps.flatMap(({ secretVersions, folderId }) =>
-            secretVersions.map(
-              ({
-                latestSecretVersion,
-                version,
-                updatedAt,
-                createdAt,
-                secretId,
-                envId,
-                id,
-                tags,
-                // exclude the bottom fields from the secret - they are for versioning only.
-                userActorId,
-                identityActorId,
-                actorType,
-                ...el
-              }) => ({
-                ...el,
-                id: secretId,
-                version: deletedTopLevelSecsGroupById[secretId] ? latestSecretVersion + 1 : latestSecretVersion,
-                folderId
-              })
-            )
+            secretVersions
+              .filter((v) => !v.isRotatedSecret)
+              .map(
+                ({
+                  latestSecretVersion,
+                  version,
+                  updatedAt,
+                  createdAt,
+                  secretId,
+                  envId,
+                  id,
+                  tags,
+                  // exclude the bottom fields from the secret - they are for versioning only.
+                  userActorId,
+                  identityActorId,
+                  actorType,
+                  isRotatedSecret,
+                  ...el
+                }) => ({
+                  ...el,
+                  id: secretId,
+                  version: deletedTopLevelSecsGroupById[secretId] ? latestSecretVersion + 1 : latestSecretVersion,
+                  folderId
+                })
+              )
           ),
           tx
         );

backend/src/ee/services/secret-snapshot/snapshot-dal.ts

@@ -181,6 +181,11 @@ export const snapshotDALFactory = (db: TDbClient) => {
           `${TableName.SnapshotFolder}.folderVersionId`,
           `${TableName.SecretFolderVersion}.id`
         )
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`,
+          `${TableName.SecretVersionV2}.secretId`
+        )
         .select(selectAllTableCols(TableName.SecretVersionV2))
         .select(
           db.ref("id").withSchema(TableName.Snapshot).as("snapshotId"),
@@ -195,7 +200,8 @@ export const snapshotDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.SecretTag).as("tagId"),
           db.ref("id").withSchema(TableName.SecretVersionV2Tag).as("tagVersionId"),
           db.ref("color").withSchema(TableName.SecretTag).as("tagColor"),
-          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")
+          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"),
+          db.ref("rotationId").withSchema(TableName.SecretRotationV2SecretMapping)
         );
       return sqlNestRelationships({
         data,
@@ -221,7 +227,11 @@ export const snapshotDALFactory = (db: TDbClient) => {
           {
             key: "id",
             label: "secretVersions" as const,
-            mapper: (el) => SecretVersionsV2Schema.parse(el),
+            mapper: (el) => ({
+              ...SecretVersionsV2Schema.parse(el),
+              isRotatedSecret: Boolean(el.rotationId),
+              rotationId: el.rotationId
+            }),
             childrenMapper: [
               {
                 key: "tagVersionId",
@@ -476,6 +486,11 @@ export const snapshotDALFactory = (db: TDbClient) => {
           `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`,
           `${TableName.SecretTag}.id`
         )
+        .leftJoin(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretVersionV2}.secretId`,
+          `${TableName.SecretRotationV2SecretMapping}.secretId`
+        )
         .leftJoin<{ latestSecretVersion: number }>(
           (tx || db)(TableName.SecretVersionV2)
             .groupBy("secretId")
@@ -506,7 +521,8 @@ export const snapshotDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.SecretTag).as("tagId"),
           db.ref("id").withSchema(TableName.SecretVersionV2Tag).as("tagVersionId"),
           db.ref("color").withSchema(TableName.SecretTag).as("tagColor"),
-          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")
+          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"),
+          db.ref("rotationId").withSchema(TableName.SecretRotationV2SecretMapping)
         );
 
       const formated = sqlNestRelationships({
@@ -523,7 +539,8 @@ export const snapshotDALFactory = (db: TDbClient) => {
             label: "secretVersions" as const,
             mapper: (el) => ({
               ...SecretVersionsV2Schema.parse(el),
-              latestSecretVersion: el.latestSecretVersion as number
+              latestSecretVersion: el.latestSecretVersion as number,
+              isRotatedSecret: Boolean(el.rotationId)
             }),
             childrenMapper: [
               {