From a6c26f4a6cc84fa2014bc2ee48cbae7f03cf8369 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Fri, 19 Sep 2025 21:08:06 -0300
Subject: [PATCH] Fix env check blocking secrets with no matching reference

---
 .../secret-v2-bridge/secret-v2-bridge-fns.ts  | 30 ++++++++++++-------
 .../secret-v2-bridge-service.ts               | 17 +++++------
 2 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
index 7aee91273..8d0cac03a 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
@@ -597,19 +597,27 @@ export const expandSecretReferencesFactory = ({
       return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
     }
 
-    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) return { value: "", tags: [] };
-    const secrets = await secretDAL.findByFolderId({ folderId: folder.id });
+    try {
+      const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
+      if (!folder) return { value: "", tags: [] };
+      const secrets = await secretDAL.findByFolderId({ folderId: folder.id });
 
-    const decryptedSecret = secrets.reduce<Record<string, { value: string; tags: string[] }>>((prev, secret) => {
-      // eslint-disable-next-line no-param-reassign
-      prev[secret.key] = { value: decryptSecret(secret.encryptedValue) || "", tags: secret.tags?.map((el) => el.slug) };
-      return prev;
-    }, {});
+      const decryptedSecret = secrets.reduce<Record<string, { value: string; tags: string[] }>>((prev, secret) => {
+        // eslint-disable-next-line no-param-reassign
+        prev[secret.key] = {
+          value: decryptSecret(secret.encryptedValue) || "",
+          tags: secret.tags?.map((el) => el.slug)
+        };
+        return prev;
+      }, {});
 
-    secretCache[cacheKey] = decryptedSecret;
+      secretCache[cacheKey] = decryptedSecret;
 
-    return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
+      return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
+    } catch (error) {
+      secretCache[cacheKey] = {};
+      return { value: "", tags: [] };
+    }
   };
 
   const recursivelyExpandSecret = async (dto: {
@@ -664,6 +672,7 @@ export const expandSecretReferencesFactory = ({
               });
 
             const cacheKey = getCacheUniqueKey(environment, secretPath);
+            if (!secretCache[cacheKey]) secretCache[cacheKey] = {};
             secretCache[cacheKey][secretKey] = referredValue;
 
             referencedSecretValue = referredValue.value;
@@ -683,6 +692,7 @@ export const expandSecretReferencesFactory = ({
               });
 
             const cacheKey = getCacheUniqueKey(secretReferenceEnvironment, secretReferencePath);
+            if (!secretCache[cacheKey]) secretCache[cacheKey] = {};
             secretCache[cacheKey][secretReferenceKey] = referedValue;
 
             referencedSecretValue = referedValue.value;
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index 37a5dcd6f..de8f930ed 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -159,17 +159,14 @@ export const secretV2BridgeServiceFactory = ({
     const uniqueReferenceEnvironmentSlugs = Array.from(new Set(references.map((el) => el.environment)));
     const referencesEnvironments = await projectEnvDAL.findBySlugs(projectId, uniqueReferenceEnvironmentSlugs, tx);
 
-    if (referencesEnvironments.length !== uniqueReferenceEnvironmentSlugs.length)
-      throw new BadRequestError({
-        message: `Referenced environment not found. Missing ${diff(
-          uniqueReferenceEnvironmentSlugs,
-          referencesEnvironments.map((el) => el.slug)
-        ).join(",")}`
-      });
-
+    // Filter out references to non-existent environments
     const referencesEnvironmentGroupBySlug = groupBy(referencesEnvironments, (i) => i.slug);
+    const validEnvironmentReferences = references.filter((el) => referencesEnvironmentGroupBySlug[el.environment]);
+
+    if (validEnvironmentReferences.length === 0) return;
+
     const referredFolders = await folderDAL.findByManySecretPath(
-      references.map((el) => ({
+      validEnvironmentReferences.map((el) => ({
         secretPath: el.secretPath,
         envId: referencesEnvironmentGroupBySlug[el.environment][0].id
       })),
@@ -179,7 +176,7 @@ export const secretV2BridgeServiceFactory = ({
     const referencesFolderGroupByPath = groupBy(referredFolders.filter(Boolean), (i) => `${i?.envId}-${i?.path}`);
 
     // Find only references that have valid folders (don't throw for missing paths)
-    const validReferences = references.filter((el) => {
+    const validReferences = validEnvironmentReferences.filter((el) => {
       const folderId =
         referencesFolderGroupByPath[`${referencesEnvironmentGroupBySlug[el.environment][0].id}-${el.secretPath}`]?.[0]
           ?.id;