From 97c96acea5511291172785592456004e25daebc8 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 11 Jul 2025 00:59:28 +0400
Subject: [PATCH] Update secret-approval-policy-service.ts

---
 .../secret-approval-policy-service.ts               | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
index f3e59dced..80127c071 100644
--- a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
+++ b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
@@ -61,14 +61,13 @@ export const secretApprovalPolicyServiceFactory = ({
     policyId
   }: {
     envId: string;
-    secretPath?: string | null;
+    secretPath: string;
     policyId?: string;
   }) => {
     const policy = await secretApprovalPolicyDAL
       .findOne({
         envId,
-        // For environment-wide policies, we store the path as an empty string, even though the column is nullable; for that reason we check for an empty string.
-        ...(secretPath ? { secretPath } : { secretPath: "" }),
+        secretPath,
         deletedAt: null
       })
       .catch(() => null);
@@ -288,7 +287,13 @@ export const secretApprovalPolicyServiceFactory = ({
       });
     }
 
-    if (await $policyExists({ envId: secretApprovalPolicy.envId, secretPath, policyId: secretApprovalPolicy.id })) {
+    if (
+      await $policyExists({
+        envId: secretApprovalPolicy.envId,
+        secretPath: secretPath || secretApprovalPolicy.secretPath,
+        policyId: secretApprovalPolicy.id
+      })
+    ) {
       throw new BadRequestError({
         message: `A policy for secret path '${secretPath}' already exists in environment '${secretApprovalPolicy.environment.slug}'`
       });