From d468c668f2be93c261b50c67212f68abcf007ed8 Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Tue, 28 Oct 2025 05:32:24 -0400
Subject: [PATCH] move catch outside of the TX

---
 .../pam-account/pam-account-service.ts        | 80 +++++++++----------
 1 file changed, 37 insertions(+), 43 deletions(-)

diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts
index 7898f3820..00b84943f 100644
--- a/backend/src/ee/services/pam-account/pam-account-service.ts
+++ b/backend/src/ee/services/pam-account/pam-account-service.ts
@@ -578,10 +578,10 @@ export const pamAccountServiceFactory = ({
     for (let i = 0; i < accounts.length; i += ROTATION_CONCURRENCY_LIMIT) {
       const batch = accounts.slice(i, i + ROTATION_CONCURRENCY_LIMIT);
 
-      const rotationPromises = batch.map(async (account) =>
-        pamAccountDAL.transaction(async (tx) => {
-          let logResourceType = "unknown";
-          try {
+      const rotationPromises = batch.map(async (account) => {
+        let logResourceType = "unknown";
+        try {
+          await pamAccountDAL.transaction(async (tx) => {
             const resource = await pamResourceDAL.findById(account.resourceId, tx);
             if (!resource || !resource.encryptedRotationAccountCredentials) return;
             logResourceType = resource.resourceType;
@@ -645,51 +645,45 @@ export const pamAccountServiceFactory = ({
                 }
               }
             });
-          } catch (error) {
-            logger.error(error, `Failed to rotate credentials for account [accountId=${account.id}]`);
+          });
+        } catch (error) {
+          logger.error(error, `Failed to rotate credentials for account [accountId=${account.id}]`);
 
-            const errorMessage = error instanceof Error ? error.message : "An unknown error occurred";
+          const errorMessage = error instanceof Error ? error.message : "An unknown error occurred";
 
-            const { encryptor } = await kmsService.createCipherPairWithDataKey({
-              type: KmsDataKey.SecretManager,
-              projectId: account.projectId
-            });
+          const { encryptor } = await kmsService.createCipherPairWithDataKey({
+            type: KmsDataKey.SecretManager,
+            projectId: account.projectId
+          });
 
-            const { cipherTextBlob: encryptedMessage } = encryptor({
-              plainText: Buffer.from(errorMessage)
-            });
+          const { cipherTextBlob: encryptedMessage } = encryptor({
+            plainText: Buffer.from(errorMessage)
+          });
 
-            await pamAccountDAL.updateById(
-              account.id,
-              {
-                rotationStatus: "failed",
-                encryptedLastRotationMessage: encryptedMessage
-              },
-              tx
-            );
+          await pamAccountDAL.updateById(account.id, {
+            rotationStatus: "failed",
+            encryptedLastRotationMessage: encryptedMessage
+          });
 
-            await auditLogService.createAuditLog({
-              projectId: account.projectId,
-              actor: {
-                type: ActorType.PLATFORM,
-                metadata: {}
-              },
-              event: {
-                type: EventType.PAM_ACCOUNT_CREDENTIAL_ROTATION_FAILED,
-                metadata: {
-                  accountId: account.id,
-                  accountName: account.name,
-                  resourceId: account.resourceId,
-                  resourceType: logResourceType,
-                  errorMessage
-                }
+          await auditLogService.createAuditLog({
+            projectId: account.projectId,
+            actor: {
+              type: ActorType.PLATFORM,
+              metadata: {}
+            },
+            event: {
+              type: EventType.PAM_ACCOUNT_CREDENTIAL_ROTATION_FAILED,
+              metadata: {
+                accountId: account.id,
+                accountName: account.name,
+                resourceId: account.resourceId,
+                resourceType: logResourceType,
+                errorMessage
               }
-            });
-
-            throw error;
-          }
-        })
-      );
+            }
+          });
+        }
+      });
 
       // eslint-disable-next-line no-await-in-loop
       await Promise.all(rotationPromises);