From eb1ae216a61140c44517b47da7b24ccf4ee21501 Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Mon, 6 Oct 2025 19:37:00 -0700
Subject: [PATCH] fix: correct gitlab check order for conflict

---
 .../src/services/secret-sync/secret-sync-maps.ts  | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/backend/src/services/secret-sync/secret-sync-maps.ts b/backend/src/services/secret-sync/secret-sync-maps.ts
index c0784a62d..1fbc66cca 100644
--- a/backend/src/services/secret-sync/secret-sync-maps.ts
+++ b/backend/src/services/secret-sync/secret-sync-maps.ts
@@ -171,6 +171,14 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
     const newTargetEnv = newConfig.targetEnvironment as string | undefined;
 
     const wildcardValues = ["*", ""];
+
+    if (
+      (newConfig.scope as string) === "group"
+        ? existingConfig.groupId !== newConfig.groupId
+        : existingConfig.projectId !== newConfig.projectId
+    )
+      return false;
+
     // If either has wildcard, it conflicts with any targetEnvironment
     if (
       !existingTargetEnv ||
@@ -181,12 +189,7 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
       return true;
     }
 
-    return (
-      existingTargetEnv === newTargetEnv &&
-      ((newConfig.scope as string) === "group"
-        ? existingConfig.groupId === newConfig.groupId
-        : existingConfig.projectId === newConfig.projectId)
-    );
+    return existingTargetEnv === newTargetEnv;
   },
   [SecretSync.CloudflarePages]: defaultDuplicateCheck,
   [SecretSync.CloudflareWorkers]: defaultDuplicateCheck,