Fix tag and metadata insert/update logic on revert/rollback and fix tree checkpoint logic to exclude reserved folders

backend/src/ee/routes/v1/pit-router.ts

@@ -202,7 +202,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
       }),
       querystring: z.object({
         folderId: z.string().trim(),
-        envId: z.string().trim(),
+        environment: z.string().trim(),
         deepRollback: booleanSchema.default(false),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
         projectId: z.string().trim()
@@ -228,7 +228,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
         projectId: req.query.projectId,
         commitId: req.params.commitId,
         folderId: req.query.folderId,
-        envId: req.query.envId,
+        environment: req.query.environment,
         deepRollback: req.query.deepRollback,
         secretPath: req.query.secretPath
       });
@@ -243,7 +243,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
             folderId: req.query.folderId,
             deepRollback: req.query.deepRollback,
             diffsCount: result.length.toString(),
-            env: req.query.envId,
+            environment: req.query.environment,
             folderPath: req.query.secretPath
           }
         }
@@ -268,7 +268,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
         folderId: z.string().trim(),
         deepRollback: z.boolean().default(false),
         message: z.string().max(256).trim().optional(),
-        envId: z.string().trim(),
+        environment: z.string().trim(),
         projectId: z.string().trim()
       }),
       response: {
@@ -292,7 +292,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
         folderId: req.body.folderId,
         deepRollback: req.body.deepRollback,
         message: req.body.message,
-        envId: req.body.envId
+        environment: req.body.environment
       });
 
       await server.services.auditLog.createAuditLog({
@@ -302,7 +302,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
           type: EventType.PIT_ROLLBACK_COMMIT,
           metadata: {
             targetCommitId: req.params.commitId,
-            envId: req.body.envId,
+            environment: req.body.environment,
             folderId: req.body.folderId,
             deepRollback: req.body.deepRollback,
             message: req.body.message || "Rollback to previous commit",

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -2959,7 +2959,7 @@ interface PitRollbackCommitEvent {
     deepRollback: boolean;
     message: string;
     totalChanges: string;
-    envId: string;
+    environment: string;
   };
 }
 
@@ -2988,7 +2988,7 @@ interface PitCompareFolderStatesEvent {
     folderId: string;
     deepRollback: boolean;
     diffsCount: string;
-    env: string;
+    environment: string;
     folderPath: string;
   };
 }

backend/src/ee/services/pit/pit-service.ts

@@ -11,6 +11,7 @@ import {
   isFolderCommitChange,
   isSecretCommitChange
 } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
+import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
 import { TSecretServiceFactory } from "@app/services/secret/secret-service";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service";
@@ -23,6 +24,7 @@ type TPitServiceFactoryDep = {
   folderService: Pick<TSecretFolderServiceFactory, "getFolderById" | "getFolderVersions">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   folderDAL: Pick<TSecretFolderDALFactory, "findSecretPathByFolderIds">;
+  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
 };
 
 export type TPitServiceFactory = ReturnType<typeof pitServiceFactory>;
@@ -32,7 +34,8 @@ export const pitServiceFactory = ({
   secretService,
   folderService,
   permissionService,
-  folderDAL
+  folderDAL,
+  projectEnvDAL
 }: TPitServiceFactoryDep) => {
   const getCommitsCount = async ({
     actor,
@@ -183,7 +186,7 @@ export const pitServiceFactory = ({
     projectId,
     commitId,
     folderId,
-    envId,
+    environment,
     deepRollback,
     secretPath
   }: {
@@ -194,7 +197,7 @@ export const pitServiceFactory = ({
     projectId: string;
     commitId: string;
     folderId: string;
-    envId: string;
+    environment: string;
     deepRollback: boolean;
     secretPath: string;
   }) => {
@@ -216,6 +219,11 @@ export const pitServiceFactory = ({
       projectId
     });
 
+    const env = await projectEnvDAL.findOne({
+      projectId,
+      slug: environment
+    });
+
     if (!latestCommit) {
       throw new NotFoundError({ message: "Latest commit not found" });
     }
@@ -224,7 +232,7 @@ export const pitServiceFactory = ({
     if (deepRollback) {
       diffs = await folderCommitService.deepCompareFolder({
         targetCommitId: targetCommit.id,
-        envId,
+        envId: env.id,
         projectId
       });
     } else {
@@ -268,7 +276,7 @@ export const pitServiceFactory = ({
               actor,
               actorOrgId,
               actorAuthMethod,
-              envId,
+              env.id,
               projectId,
               diff.folderPath || ""
             );
@@ -295,7 +303,7 @@ export const pitServiceFactory = ({
     folderId,
     deepRollback,
     message,
-    envId
+    environment
   }: {
     actor: ActorType;
     actorId: string;
@@ -306,7 +314,7 @@ export const pitServiceFactory = ({
     folderId: string;
     deepRollback: boolean;
     message?: string;
-    envId: string;
+    environment: string;
   }) => {
     const { permission: userPermission } = await permissionService.getProjectPermission({
       actor,
@@ -346,16 +354,21 @@ export const pitServiceFactory = ({
       projectId
     });
 
-    if (!targetCommit || targetCommit.folderId !== folderId || targetCommit.envId !== envId) {
+    const env = await projectEnvDAL.findOne({
+      projectId,
+      slug: environment
+    });
+
+    if (!targetCommit || targetCommit.folderId !== folderId || targetCommit.envId !== env.id) {
       throw new NotFoundError({ message: "Target commit not found" });
     }
 
-    if (!latestCommit || latestCommit.envId !== envId) {
+    if (!latestCommit || latestCommit.envId !== env.id) {
       throw new NotFoundError({ message: "Latest commit not found" });
     }
 
     if (deepRollback) {
-      await folderCommitService.deepRollbackFolder(commitId, envId, actorId, actor, projectId, message);
+      await folderCommitService.deepRollbackFolder(commitId, env.id, actorId, actor, projectId, message);
       return { success: true };
     }
 
@@ -426,20 +439,6 @@ export const pitServiceFactory = ({
     projectId: string;
     commitId: string;
   }) => {
-    const { permission: userPermission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-
-    ForbiddenError.from(userPermission).throwUnlessCan(
-      ProjectPermissionCommitsActions.Read,
-      ProjectPermissionSub.Commits
-    );
-
     const commit = await folderCommitService.getCommitById({
       commitId,
       actor,

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -422,7 +422,7 @@ export const secretReplicationServiceFactory = ({
                     return {
                       op: operation,
                       requestId: approvalRequestDoc.id,
-                      metadata: doc.metadata,
+                      metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
                       secretMetadata: JSON.stringify(doc.secretMetadata),
                       key: doc.key,
                       encryptedValue: doc.encryptedValue,
@@ -454,7 +454,7 @@ export const secretReplicationServiceFactory = ({
                     inputSecrets: locallyCreatedSecrets.map((doc) => {
                       return {
                         type: doc.type,
-                        metadata: doc.metadata,
+                        metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
                         key: doc.key,
                         encryptedValue: doc.encryptedValue,
                         encryptedComment: doc.encryptedComment,
@@ -484,7 +484,7 @@ export const secretReplicationServiceFactory = ({
                         },
                         data: {
                           type: doc.type,
-                          metadata: doc.metadata,
+                          metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
                           key: doc.key,
                           encryptedValue: doc.encryptedValue as Buffer,
                           encryptedComment: doc.encryptedComment,