requested changes

backend/src/services/app-connection/app-connection-service.ts

@@ -28,6 +28,7 @@ import { githubConnectionService } from "@app/services/app-connection/github/git
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TAppConnectionDALFactory } from "./app-connection-dal";
+import { ValidateAzureAppConfigurationConnectionCredentialsSchema } from "./azure-app-configuration";
 import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
 import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
 import { gcpConnectionService } from "./gcp/gcp-connection-service";
@@ -45,7 +46,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
   [AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
   [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
-  [AppConnection.AzureAppConfiguration]: ValidateAzureKeyVaultConnectionCredentialsSchema
+  [AppConnection.AzureAppConfiguration]: ValidateAzureAppConfigurationConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-schemas.ts

@@ -63,7 +63,6 @@ export const SanitizedAzureAppConfigurationConnectionSchema = z.discriminatedUni
   BaseAzureAppConfigurationConnectionSchema.extend({
     method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
     credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema.pick({
-      resource: true,
       tenantId: true
     })
   })

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-schemas.ts

@@ -63,7 +63,6 @@ export const SanitizedAzureKeyVaultConnectionSchema = z.discriminatedUnion("meth
   BaseAzureKeyVaultConnectionSchema.extend({
     method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
     credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema.pick({
-      resource: true,
       tenantId: true
     })
   })

backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-fns.ts

@@ -19,6 +19,7 @@ type TAzureAppConfigurationSecretSyncFactoryDeps = {
 interface AzureAppConfigKeyValue {
   key: string;
   value: string;
+  label?: string;
 }
 
 export const azureAppConfigurationSecretSyncFactory = ({
@@ -78,7 +79,9 @@ export const azureAppConfigurationSecretSyncFactory = ({
       secretSync.destinationConfig.label ? `&label=${secretSync.destinationConfig.label}` : "&label=%00"
     }`;
 
-    const azureAppConfigSecrets = Object.fromEntries(
+    const azureAppConfigValuesUrlAllSecrets = `/kv?api-version=2023-11-01`;
+
+    const azureAppConfigSecretsLabeled = Object.fromEntries(
       (
         await $getCompleteAzureAppConfigValues(
           accessToken,
@@ -88,9 +91,25 @@ export const azureAppConfigurationSecretSyncFactory = ({
       ).map((entry) => [entry.key, entry.value])
     );
 
+    const azureAppConfigSecrets = Object.fromEntries(
+      (
+        await $getCompleteAzureAppConfigValues(
+          accessToken,
+          secretSync.destinationConfig.configurationUrl,
+          azureAppConfigValuesUrlAllSecrets
+        )
+      ).map((entry) => [
+        entry.key,
+        {
+          value: entry.value,
+          label: entry.label
+        }
+      ])
+    );
+
     // add the secrets to azure app config, that are in infisical
     for await (const key of Object.keys(secretMap)) {
-      if (!(key in azureAppConfigSecrets) || secretMap[key]?.value !== azureAppConfigSecrets[key]) {
+      if (!(key in azureAppConfigSecretsLabeled) || secretMap[key]?.value !== azureAppConfigSecretsLabeled[key]) {
         await request.put(
           `${secretSync.destinationConfig.configurationUrl}/kv/${key}?api-version=2023-11-01`,
           {
@@ -117,14 +136,14 @@ export const azureAppConfigurationSecretSyncFactory = ({
       }
     }
 
-    // delete the secrets that are in azure app config, but not in infisical
     for await (const key of Object.keys(azureAppConfigSecrets)) {
-      if (!(key in secretMap) || secretMap[key] === null) {
+      const azureSecret = azureAppConfigSecrets[key];
+      if (!(key in secretMap) || secretMap[key] === null || azureSecret.label !== secretSync.destinationConfig.label) {
         await $deleteAzureSecret(
           accessToken,
           secretSync.destinationConfig.configurationUrl,
           key,
-          secretSync.destinationConfig.label
+          azureSecret.label // use the secret's actual label for deletion
         );
       }
     }

backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts

@@ -7,6 +7,7 @@ import { getAzureConnectionAccessToken } from "@app/services/app-connection/azur
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
+import { SecretSyncError } from "../secret-sync-errors";
 import { GetAzureKeyVaultSecret, TAzureKeyVaultSyncWithCredentials } from "./azure-key-vault-sync-types";
 
 type TAzureKeyVaultSecretSyncFactoryDeps = {
@@ -127,6 +128,7 @@ export const azureKeyVaultSecretSyncFactory = ({
 
     const setSecretAzureKeyVault = async ({ key, value }: { key: string; value: string }) => {
       let isSecretSet = false;
+      let syncError: Error | null = null;
       let maxTries = 6;
       if (disabledAzureKeyVaultSecretKeys.includes(key)) return;
 
@@ -147,6 +149,7 @@ export const azureKeyVaultSecretSyncFactory = ({
 
           isSecretSet = true;
         } catch (err) {
+          syncError = err as Error;
           if (err instanceof AxiosError) {
             // eslint-disable-next-line
             if (err.response?.data?.error?.innererror?.code === "ObjectIsDeletedButRecoverable") {
@@ -174,7 +177,10 @@ export const azureKeyVaultSecretSyncFactory = ({
       }
 
       if (!isSecretSet) {
-        throw new Error(`Failed to set secret ${key}`);
+        throw new SecretSyncError({
+          error: syncError,
+          secretKey: key
+        });
       }
     };