From 99e8bdef58e6d03d673d76ebe17cb0650e3e0b22 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Fri, 25 Jul 2025 01:37:25 -0300
Subject: [PATCH] Minor fixes on policies multi env migration

---
 ...2152841_add-policies-environments-table.ts | 11 +++++----
 .../access-approval-policy-service.ts         | 23 +++++++++++--------
 .../secret-approval-policy-service.ts         | 23 +++++++++++--------
 3 files changed, 32 insertions(+), 25 deletions(-)

diff --git a/backend/src/db/migrations/20250722152841_add-policies-environments-table.ts b/backend/src/db/migrations/20250722152841_add-policies-environments-table.ts
index c8ee3d524..57ec13203 100644
--- a/backend/src/db/migrations/20250722152841_add-policies-environments-table.ts
+++ b/backend/src/db/migrations/20250722152841_add-policies-environments-table.ts
@@ -12,11 +12,13 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("policyId").notNullable();
       t.foreign("policyId").references("id").inTable(TableName.AccessApprovalPolicy).onDelete("CASCADE");
       t.uuid("envId").notNullable();
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.foreign("envId").references("id").inTable(TableName.Environment);
       t.timestamps(true, true, true);
       t.unique(["policyId", "envId"]);
     });
 
+    await createOnUpdateTrigger(knex, TableName.AccessApprovalPolicyEnvironment);
+
     const existingAccessApprovalPolicies = await knex(TableName.AccessApprovalPolicy)
       .select(selectAllTableCols(TableName.AccessApprovalPolicy))
       .whereNotNull(`${TableName.AccessApprovalPolicy}.envId`);
@@ -36,11 +38,13 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("policyId").notNullable();
       t.foreign("policyId").references("id").inTable(TableName.SecretApprovalPolicy).onDelete("CASCADE");
       t.uuid("envId").notNullable();
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
+      t.foreign("envId").references("id").inTable(TableName.Environment);
       t.timestamps(true, true, true);
       t.unique(["policyId", "envId"]);
     });
 
+    await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyEnvironment);
+
     const existingSecretApprovalPolicies = await knex(TableName.SecretApprovalPolicy)
       .select(selectAllTableCols(TableName.SecretApprovalPolicy))
       .whereNotNull(`${TableName.SecretApprovalPolicy}.envId`);
@@ -68,9 +72,6 @@ export async function up(knex: Knex): Promise<void> {
     // Add the new foreign key constraint with ON DELETE SET NULL
     t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("SET NULL");
   });
-
-  await createOnUpdateTrigger(knex, TableName.AccessApprovalPolicyEnvironment);
-  await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyEnvironment);
 }
 
 export async function down(knex: Knex): Promise<void> {
diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts
index d6187d418..0b3c4e128 100644
--- a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts
+++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts
@@ -354,16 +354,19 @@ export const accessApprovalPolicyServiceFactory = ({
       envs = await projectEnvDAL.find({ $in: { slug: environments }, projectId: accessApprovalPolicy.projectId });
     }
 
-    if (
-      await $policyExists({
-        envIds: envs.map((env) => env.id),
-        secretPath: secretPath || accessApprovalPolicy.secretPath,
-        policyId: accessApprovalPolicy.id
-      })
-    ) {
-      throw new BadRequestError({
-        message: `A policy for secret path '${secretPath}' already exists`
-      });
+    for (const env of envs) {
+      if (
+        // eslint-disable-next-line no-await-in-loop
+        await $policyExists({
+          envId: env.id,
+          secretPath: secretPath || accessApprovalPolicy.secretPath,
+          policyId: accessApprovalPolicy.id
+        })
+      ) {
+        throw new BadRequestError({
+          message: `A policy for secret path '${secretPath || accessApprovalPolicy.secretPath}' already exists in environment '${env.slug}'`
+        });
+      }
     }
 
     const { permission } = await permissionService.getProjectPermission({
diff --git a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
index 2bff6f440..96757dc22 100644
--- a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
+++ b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
@@ -315,16 +315,19 @@ export const secretApprovalPolicyServiceFactory = ({
     ) {
       envs = await projectEnvDAL.find({ $in: { slug: environments }, projectId: secretApprovalPolicy.projectId });
     }
-    if (
-      await $policyExists({
-        envIds: envs.map((env) => env.id),
-        secretPath: secretPath || secretApprovalPolicy.secretPath,
-        policyId: secretApprovalPolicy.id
-      })
-    ) {
-      throw new BadRequestError({
-        message: `A policy for secret path '${secretPath}' already exists`
-      });
+    for (const env of envs) {
+      if (
+        // eslint-disable-next-line no-await-in-loop
+        await $policyExists({
+          envId: env.id,
+          secretPath: secretPath || secretApprovalPolicy.secretPath,
+          policyId: secretApprovalPolicy.id
+        })
+      ) {
+        throw new BadRequestError({
+          message: `A policy for secret path '${secretPath || secretApprovalPolicy.secretPath}' already exists in environment '${env.slug}'`
+        });
+      }
     }
 
     const { permission } = await permissionService.getProjectPermission({