PIT: address PR suggestions

backend/src/services/external-migration/external-migration-fns.ts

@@ -10,7 +10,7 @@ import { chunkArray } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
+import { CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectDALFactory } from "../project/project-dal";
@@ -627,7 +627,7 @@ export const importDataIntoInfisicalFn = async ({
             folderId: parentEnv.rootFolderId,
             changes: [
               {
-                type: "add",
+                type: CommitType.ADD,
                 folderVersionId: newFolderVersion.id
               }
             ]

backend/src/services/folder-checkpoint/folder-checkpoint-dal.ts

@@ -21,7 +21,8 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
   const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderCheckpoints | undefined> => {
     try {
       const doc = await (tx || db.replicaNode())<TFolderCheckpoints>(TableName.FolderCheckpoint)
-        .where({ folderCommitId })
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ folderCommitId }, TableName.FolderCheckpoint))
         .select(selectAllTableCols(TableName.FolderCheckpoint))
         .first();
       return doc;
@@ -87,20 +88,11 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
   };
 
   const findNearestCheckpoint = async (
-    folderCommitId: string,
+    folderCommitId: bigint,
+    folderId: string,
     tx?: Knex
-  ): Promise<(CheckpointWithCommitInfo & { commitId: number }) | undefined> => {
+  ): Promise<(CheckpointWithCommitInfo & { commitId: bigint }) | undefined> => {
     try {
-      // First, get the commit info to find the folder ID and commit sequence number
-      const commit = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ id: folderCommitId })
-        .select("commitId", "folderId")
-        .first();
-
-      if (!commit) {
-        return undefined;
-      }
-
       // Get the checkpoint with the highest commitId that's still less than or equal to our commit
       const nearestCheckpoint = await (tx || db.replicaNode())(TableName.FolderCheckpoint)
         .join<TFolderCommits>(
@@ -108,8 +100,8 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
           `${TableName.FolderCheckpoint}.folderCommitId`,
           `${TableName.FolderCommit}.id`
         )
-        .where(`${TableName.FolderCommit}.folderId`, "=", commit.folderId)
-        .where(`${TableName.FolderCommit}.commitId`, "<=", commit.commitId)
+        .where(`${TableName.FolderCommit}.folderId`, "=", folderId)
+        .where(`${TableName.FolderCommit}.commitId`, "<=", folderCommitId)
         .select(selectAllTableCols(TableName.FolderCheckpoint))
         .select(
           db.ref("actorMetadata").withSchema(TableName.FolderCommit),
@@ -121,7 +113,6 @@ export const folderCheckpointDALFactory = (db: TDbClient) => {
         )
         .orderBy(`${TableName.FolderCommit}.commitId`, "desc")
         .first();
-
       return nearestCheckpoint;
     } catch (error) {
       throw new DatabaseError({ error, name: "FindNearestCheckpoint" });

backend/src/services/folder-commit-changes/folder-commit-changes-dal.ts

@@ -5,11 +5,12 @@ import {
   TableName,
   TFolderCommitChanges,
   TFolderCommits,
+  TProjectEnvironments,
   TSecretFolderVersions,
   TSecretVersionsV2
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TFolderCommitChangesDALFactory = ReturnType<typeof folderCommitChangesDALFactory>;
 
@@ -41,10 +42,15 @@ type CommitChangeWithCommitInfo = TFolderCommitChanges & {
 export const folderCommitChangesDALFactory = (db: TDbClient) => {
   const folderCommitChangesOrm = ormify(db, TableName.FolderCommitChanges);
 
-  const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<CommitChangeWithCommitInfo[]> => {
+  const findByCommitId = async (
+    folderCommitId: string,
+    projectId: string,
+    tx?: Knex
+  ): Promise<CommitChangeWithCommitInfo[]> => {
     try {
       const docs = await (tx || db.replicaNode())<TFolderCommitChanges>(TableName.FolderCommitChanges)
-        .where({ folderCommitId })
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ folderCommitId }, TableName.FolderCommitChanges))
         .leftJoin<TFolderCommits>(
           TableName.FolderCommit,
           `${TableName.FolderCommitChanges}.folderCommitId`,
@@ -60,6 +66,16 @@ export const folderCommitChangesDALFactory = (db: TDbClient) => {
           `${TableName.FolderCommitChanges}.folderVersionId`,
           `${TableName.SecretFolderVersion}.id`
         )
+        .leftJoin<TProjectEnvironments>(
+          TableName.Environment,
+          `${TableName.FolderCommit}.envId`,
+          `${TableName.Environment}.id`
+        )
+        .where((qb) => {
+          if (projectId) {
+            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
+          }
+        })
         .select(selectAllTableCols(TableName.FolderCommitChanges))
         .select(
           db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderName"),
@@ -90,7 +106,8 @@ export const folderCommitChangesDALFactory = (db: TDbClient) => {
         TFolderCommitChanges &
           Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
       >(TableName.FolderCommitChanges)
-        .where({ secretVersionId })
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ secretVersionId }, TableName.FolderCommitChanges))
         .select(selectAllTableCols(TableName.FolderCommitChanges))
         .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
         .select(
@@ -112,7 +129,8 @@ export const folderCommitChangesDALFactory = (db: TDbClient) => {
         TFolderCommitChanges &
           Pick<TFolderCommits, "actorMetadata" | "actorType" | "message" | "createdAt" | "folderId">
       >(TableName.FolderCommitChanges)
-        .where({ folderVersionId })
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ folderVersionId }, TableName.FolderCommitChanges))
         .select(selectAllTableCols(TableName.FolderCommitChanges))
         .join(TableName.FolderCommit, `${TableName.FolderCommitChanges}.folderCommitId`, `${TableName.FolderCommit}.id`)
         .select(

backend/src/services/folder-commit/folder-commit-dal.ts

@@ -5,6 +5,7 @@ import {
   TableName,
   TFolderCommitChanges,
   TFolderCommits,
+  TProjectEnvironments,
   TSecretFolderVersions,
   TSecretVersionsV2
 } from "@app/db/schemas";
@@ -54,10 +55,20 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findLatestCommit = async (folderId: string, tx?: Knex): Promise<TFolderCommits | undefined> => {
+  const findLatestCommit = async (
+    folderId: string,
+    projectId?: string,
+    tx?: Knex
+  ): Promise<TFolderCommits | undefined> => {
     try {
       const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
         .where({ folderId })
+        .leftJoin(TableName.Environment, `${TableName.FolderCommit}.envId`, `${TableName.Environment}.id`)
+        .where((qb) => {
+          if (projectId) {
+            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
+          }
+        })
         .select(selectAllTableCols(TableName.FolderCommit))
         .orderBy("commitId", "desc")
         .first();
@@ -178,8 +189,8 @@ export const folderCommitDALFactory = (db: TDbClient) => {
 
   const findCommitsToRecreate = async (
     folderId: string,
-    targetCommitNumber: number,
-    checkpointCommitNumber: number,
+    targetCommitNumber: bigint,
+    checkpointCommitNumber: bigint,
     tx?: Knex
   ): Promise<
     (TFolderCommits & {
@@ -213,7 +224,7 @@ export const folderCommitDALFactory = (db: TDbClient) => {
 
       // Get all changes for these commits in a single query
       const allChanges = await (tx || db.replicaNode())(TableName.FolderCommitChanges)
-        .whereIn("folderCommitId", commitIds)
+        .whereIn(`${TableName.FolderCommitChanges}.folderCommitId`, commitIds)
         .leftJoin<TSecretVersionsV2>(
           TableName.SecretVersionV2,
           `${TableName.FolderCommitChanges}.secretVersionId`,
@@ -291,7 +302,6 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     endCommitId,
     tx
   }: {
-    folderId?: string;
     envId?: string;
     startCommitId?: string;
     endCommitId?: string;
@@ -323,7 +333,6 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     startCommitId,
     tx
   }: {
-    folderId?: string;
     envId?: string;
     startCommitId?: string;
     tx?: Knex;
@@ -346,7 +355,11 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findPreviousCommitTo = async (folderId: string, commitId: string, tx?: Knex): Promise<TFolderCommits | undefined> => {
+  const findPreviousCommitTo = async (
+    folderId: string,
+    commitId: string,
+    tx?: Knex
+  ): Promise<TFolderCommits | undefined> => {
     try {
       const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
         .where({ folderId })
@@ -360,6 +373,30 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findById = async (id: string, tx?: Knex, projectId?: string): Promise<TFolderCommits> => {
+    try {
+      const doc = await (tx || db.replicaNode())(TableName.FolderCommit)
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ id }, TableName.FolderCommit))
+        .leftJoin<TProjectEnvironments>(
+          TableName.Environment,
+          `${TableName.FolderCommit}.envId`,
+          `${TableName.Environment}.id`
+        )
+        .where((qb) => {
+          if (projectId) {
+            void qb.where(`${TableName.Environment}.projectId`, "=", projectId);
+          }
+        })
+        .select(selectAllTableCols(TableName.FolderCommit))
+        .orderBy("commitId", "desc")
+        .first();
+      return doc;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "FindById" });
+    }
+  };
+
   return {
     ...restOfOrm,
     findByFolderId,
@@ -373,6 +410,7 @@ export const folderCommitDALFactory = (db: TDbClient) => {
     getEnvNumberOfCommitsSince,
     findLatestCommitByFolderIds,
     findAllFolderCommitsAfter,
-    findPreviousCommitTo
+    findPreviousCommitTo,
+    findById
   };
 };

backend/src/services/folder-commit/folder-commit-queue.ts

@@ -1,6 +1,7 @@
 import { Knex } from "knex";
 
 import { TSecretFolders } from "@app/db/schemas";
+import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
@@ -10,8 +11,16 @@ import { TFolderTreeCheckpointResourcesDALFactory } from "../folder-tree-checkpo
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TFolderCommitDALFactory } from "./folder-commit-dal";
 
+// Define types for job data
+type TCreateFolderTreeCheckpointDTO = {
+  envId: string;
+  failedToAcquireLockCount?: number;
+  folderCommitId?: string;
+};
+
 type TFolderCommitQueueServiceFactoryDep = {
   queueService: TQueueServiceFactory;
+  keyStore: Pick<TKeyStoreFactory, "acquireLock" | "getItem" | "deleteItem">;
   folderTreeCheckpointDAL: Pick<
     TFolderTreeCheckpointDALFactory,
     "create" | "findLatestByEnvId" | "findNearestCheckpoint"
@@ -31,6 +40,7 @@ export type TFolderCommitQueueServiceFactory = ReturnType<typeof folderCommitQue
 
 export const folderCommitQueueServiceFactory = ({
   queueService,
+  keyStore,
   folderTreeCheckpointDAL,
   folderTreeCheckpointResourcesDAL,
   folderCommitDAL,
@@ -38,48 +48,38 @@ export const folderCommitQueueServiceFactory = ({
 }: TFolderCommitQueueServiceFactoryDep) => {
   const appCfg = getConfig();
 
-  const scheduleTreeCheckpoint = async (envId: string) => {
-    await queueService.queue(
-      QueueName.FolderTreeCheckpoint,
-      QueueJobs.CreateFolderTreeCheckpoint,
-      { envId },
-      {
-        jobId: `${envId}`,
-        backoff: {
-          type: "exponential",
-          delay: 3000
-        },
-        removeOnFail: {
-          count: 3
-        },
-        removeOnComplete: true
-      }
-    );
+  // Helper function to calculate delay for requeuing
+  const getRequeueDelay = (failureCount?: number) => {
+    if (!failureCount) return 0;
+
+    const baseDelay = 5000;
+    const maxDelay = 30000;
+
+    const delay = Math.min(baseDelay * 2 ** failureCount, maxDelay);
+    const jitter = delay * (0.5 + Math.random() * 0.5);
+
+    return jitter;
   };
 
-  const schedulePeriodicTreeCheckpoint = async (envId: string, intervalMs: number) => {
-    await queueService.queue(
-      QueueName.FolderTreeCheckpoint,
-      QueueJobs.CreateFolderTreeCheckpoint,
-      { envId },
-      {
-        jobId: `periodic-${envId}`,
-        repeat: {
-          every: intervalMs
-        },
-        backoff: {
-          type: "exponential",
-          delay: 3000
-        },
-        removeOnFail: false,
-        removeOnComplete: false
-      }
-    );
-  };
+  const scheduleTreeCheckpoint = async (payload: TCreateFolderTreeCheckpointDTO) => {
+    const { envId, failedToAcquireLockCount = 0 } = payload;
 
-  const cancelScheduledTreeCheckpoint = async (envId: string) => {
-    await queueService.stopJobById(QueueName.FolderTreeCheckpoint, envId);
-    await queueService.stopRepeatableJobByJobId(QueueName.FolderTreeCheckpoint, `periodic-${envId}`);
+    // Create a unique jobId for each retry to prevent conflicts
+    const jobId =
+      failedToAcquireLockCount > 0 ? `${envId}-retry-${failedToAcquireLockCount}-${Date.now()}` : `${envId}`;
+
+    await queueService.queue(QueueName.FolderTreeCheckpoint, QueueJobs.CreateFolderTreeCheckpoint, payload, {
+      jobId,
+      delay: getRequeueDelay(failedToAcquireLockCount),
+      backoff: {
+        type: "exponential",
+        delay: 3000
+      },
+      removeOnFail: {
+        count: 3
+      },
+      removeOnComplete: true
+    });
   };
 
   // Sort folders by hierarchy (copied from the source code)
@@ -121,66 +121,152 @@ export const folderCommitQueueServiceFactory = ({
     return result;
   };
 
-  const createFolderTreeCheckpoint = async (envId: string, folderCommitId?: string, tx?: Knex) => {
-    logger.info("Folder tree checkpoint creation started:", envId);
+  const createFolderTreeCheckpoint = async (jobData: TCreateFolderTreeCheckpointDTO, tx?: Knex) => {
+    const { envId, folderCommitId, failedToAcquireLockCount = 0 } = jobData;
 
-    const latestTreeCheckpoint = await folderTreeCheckpointDAL.findLatestByEnvId(envId, tx);
+    logger.info(`Folder tree checkpoint creation started [envId=${envId}] [attempt=${failedToAcquireLockCount + 1}]`);
 
-    let latestCommit;
-    if (folderCommitId) {
-      latestCommit = await folderCommitDAL.findById(folderCommitId, tx);
-    } else {
-      latestCommit = await folderCommitDAL.findLatestEnvCommit(envId, tx);
-    }
-    if (!latestCommit) {
-      logger.info(`Latest commit ID not found for envId ${envId}`);
-      return;
-    }
-    const latestCommitId = latestCommit.id;
-
-    if (latestTreeCheckpoint) {
-      const commitsSinceLastCheckpoint = await folderCommitDAL.getEnvNumberOfCommitsSince(
-        envId,
-        latestTreeCheckpoint.folderCommitId,
-        tx
-      );
-      if (commitsSinceLastCheckpoint < Number(appCfg.PIT_TREE_CHECKPOINT_WINDOW)) {
-        logger.info(
-          `Commits since last checkpoint ${commitsSinceLastCheckpoint} is less than ${appCfg.PIT_TREE_CHECKPOINT_WINDOW}`
-        );
-        return;
+    // First, try to clear any stale locks before attempting to acquire
+    if (failedToAcquireLockCount > 1) {
+      try {
+        await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
+        logger.info(`Cleared potential stale lock for envId ${envId} before attempt ${failedToAcquireLockCount + 1}`);
+      } catch (error) {
+        // This is fine if it fails, we'll still try to acquire the lock
+        logger.info(`No stale lock found for envId ${envId}`);
       }
     }
 
-    const folders = await folderDAL.findByEnvId(envId, tx);
-    const sortedFolders = sortFoldersByHierarchy(folders);
-    const filteredFoldersIds = sortedFolders.filter((folder) => !folder.isReserved).map((folder) => folder.id);
+    let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
 
-    const folderCommits = await folderCommitDAL.findMultipleLatestCommits(filteredFoldersIds, tx);
-    const folderTreeCheckpoint = await folderTreeCheckpointDAL.create(
-      {
-        folderCommitId: latestCommitId
-      },
-      tx
-    );
+    try {
+      // Attempt to acquire the lock with a shorter timeout for first attempts
+      const timeout = failedToAcquireLockCount > 3 ? 60 * 1000 : 15 * 1000;
 
-    await folderTreeCheckpointResourcesDAL.insertMany(
-      folderCommits.map((folderCommit) => ({
-        folderTreeCheckpointId: folderTreeCheckpoint.id,
-        folderId: folderCommit.folderId,
-        folderCommitId: folderCommit.id
-      })),
-      tx
-    );
+      logger.info(`Attempting to acquire lock for envId=${envId} with timeout ${timeout}ms`);
 
-    logger.info("Folder tree checkpoint created successfully:", folderTreeCheckpoint.id);
+      lock = await keyStore.acquireLock([KeyStorePrefixes.FolderTreeCheckpoint(envId)], timeout);
+
+      logger.info(`Successfully acquired lock for envId=${envId}`);
+    } catch (e) {
+      logger.info(
+        `Failed to acquire lock for folder tree checkpoint [envId=${envId}] [attempt=${failedToAcquireLockCount + 1}]`
+      );
+
+      // Requeue with incremented failure count if under max attempts
+      if (failedToAcquireLockCount < 10) {
+        // Force a delay between retries
+        const nextRetryCount = failedToAcquireLockCount + 1;
+
+        logger.info(`Scheduling retry #${nextRetryCount} for folder tree checkpoint [envId=${envId}]`);
+
+        // Create a new job with incremented counter
+        await scheduleTreeCheckpoint({
+          envId,
+          folderCommitId,
+          failedToAcquireLockCount: nextRetryCount
+        });
+      } else {
+        // Max retries reached
+        logger.error(`Maximum lock acquisition attempts (10) reached for envId ${envId}. Giving up.`);
+        // Try to force-clear the lock for next time
+        try {
+          await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
+        } catch (clearError) {
+          logger.error(clearError, `Failed to clear lock after maximum retries for envId=${envId}`);
+        }
+      }
+      return;
+    }
+
+    if (!lock) {
+      logger.error(`Lock is undefined after acquisition for envId=${envId}. This should never happen.`);
+      return;
+    }
+
+    try {
+      logger.info(`Processing tree checkpoint data for envId=${envId}`);
+
+      const latestTreeCheckpoint = await folderTreeCheckpointDAL.findLatestByEnvId(envId, tx);
+
+      let latestCommit;
+      if (folderCommitId) {
+        latestCommit = await folderCommitDAL.findById(folderCommitId, tx);
+      } else {
+        latestCommit = await folderCommitDAL.findLatestEnvCommit(envId, tx);
+      }
+      if (!latestCommit) {
+        logger.info(`Latest commit ID not found for envId ${envId}`);
+        return;
+      }
+      const latestCommitId = latestCommit.id;
+
+      if (latestTreeCheckpoint) {
+        const commitsSinceLastCheckpoint = await folderCommitDAL.getEnvNumberOfCommitsSince(
+          envId,
+          latestTreeCheckpoint.folderCommitId,
+          tx
+        );
+        if (commitsSinceLastCheckpoint < Number(appCfg.PIT_TREE_CHECKPOINT_WINDOW)) {
+          logger.info(
+            `Commits since last checkpoint ${commitsSinceLastCheckpoint} is less than ${appCfg.PIT_TREE_CHECKPOINT_WINDOW}`
+          );
+          return;
+        }
+      }
+
+      const folders = await folderDAL.findByEnvId(envId, tx);
+      const sortedFolders = sortFoldersByHierarchy(folders);
+      const filteredFoldersIds = sortedFolders.filter((folder) => !folder.isReserved).map((folder) => folder.id);
+
+      const folderCommits = await folderCommitDAL.findMultipleLatestCommits(filteredFoldersIds, tx);
+      const folderTreeCheckpoint = await folderTreeCheckpointDAL.create(
+        {
+          folderCommitId: latestCommitId
+        },
+        tx
+      );
+
+      await folderTreeCheckpointResourcesDAL.insertMany(
+        folderCommits.map((folderCommit) => ({
+          folderTreeCheckpointId: folderTreeCheckpoint.id,
+          folderId: folderCommit.folderId,
+          folderCommitId: folderCommit.id
+        })),
+        tx
+      );
+
+      logger.info(`Folder tree checkpoint created successfully: ${folderTreeCheckpoint.id}`);
+    } catch (error) {
+      logger.error(error, `Error processing folder tree checkpoint [envId=${envId}]`);
+      throw error;
+    } finally {
+      // Always release the lock
+      try {
+        if (lock) {
+          await lock.release();
+          logger.info(`Released lock for folder tree checkpoint [envId=${envId}]`);
+        } else {
+          logger.error(`No lock to release for envId=${envId}. This should never happen.`);
+        }
+      } catch (releaseError) {
+        logger.error(releaseError, `Error releasing lock for folder tree checkpoint [envId=${envId}]`);
+        // Try to force delete the lock if release fails
+        try {
+          await keyStore.deleteItem(KeyStorePrefixes.FolderTreeCheckpoint(envId));
+          logger.info(`Force deleted lock after release failure for envId=${envId}`);
+        } catch (deleteError) {
+          logger.error(deleteError, `Failed to force delete lock after release failure for envId=${envId}`);
+        }
+      }
+    }
   };
 
   queueService.start(QueueName.FolderTreeCheckpoint, async (job) => {
     try {
       if (job.name === QueueJobs.CreateFolderTreeCheckpoint) {
-        const { envId } = job.data as { envId: string };
-        await createFolderTreeCheckpoint(envId);
+        const jobData = job.data as TCreateFolderTreeCheckpointDTO;
+        await createFolderTreeCheckpoint(jobData);
       }
     } catch (error) {
       logger.error(error, "Error creating folder tree checkpoint:");
@@ -189,9 +275,8 @@ export const folderCommitQueueServiceFactory = ({
   });
 
   return {
-    scheduleTreeCheckpoint,
-    schedulePeriodicTreeCheckpoint,
-    cancelScheduledTreeCheckpoint,
-    createFolderTreeCheckpoint
+    scheduleTreeCheckpoint: (envId: string) => scheduleTreeCheckpoint({ envId }),
+    createFolderTreeCheckpoint: (envId: string, folderCommitId?: string, tx?: Knex) =>
+      createFolderTreeCheckpoint({ envId, folderCommitId }, tx)
   };
 };

backend/src/services/folder-commit/folder-commit-service.test.ts

@@ -5,7 +5,12 @@ import { TSecretFolderVersions, TSecretVersionsV2 } from "@app/db/schemas";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { ActorType } from "../auth/auth-type";
-import { ChangeType, folderCommitServiceFactory, TFolderCommitServiceFactory } from "./folder-commit-service";
+import {
+  ChangeType,
+  CommitType,
+  folderCommitServiceFactory,
+  TFolderCommitServiceFactory
+} from "./folder-commit-service";
 
 // Mock config
 vi.mock("@app/lib/config/env", () => ({
@@ -204,7 +209,7 @@ describe("folderCommitServiceFactory", () => {
         folderId: folderData.id,
         changes: [
           {
-            type: "add",
+            type: CommitType.ADD,
             secretVersionId: "secret-version-1"
           }
         ]
@@ -264,7 +269,7 @@ describe("folderCommitServiceFactory", () => {
         folderId: folderData.id,
         changes: [
           {
-            type: "add",
+            type: CommitType.ADD,
             folderVersionId: "folder-version-1"
           }
         ]
@@ -331,7 +336,7 @@ describe("folderCommitServiceFactory", () => {
 
       const data = {
         folderCommitId: commitData.id,
-        changeType: "add",
+        changeType: CommitType.ADD,
         secretVersionId: "secret-version-1"
       };
 
@@ -348,7 +353,7 @@ describe("folderCommitServiceFactory", () => {
       // Arrange
       const data = {
         folderCommitId: "commit-id",
-        changeType: "add"
+        changeType: CommitType.ADD
       };
 
       // Act & Assert
@@ -361,7 +366,7 @@ describe("folderCommitServiceFactory", () => {
 
       const data = {
         folderCommitId: "non-existent-commit",
-        changeType: "add",
+        changeType: CommitType.ADD,
         secretVersionId: "secret-version-1"
       };
 

backend/src/services/folder-commit/folder-commit-service.ts

@@ -32,6 +32,11 @@ export enum ChangeType {
   CREATE = "create"
 }
 
+export enum CommitType {
+  ADD = "add",
+  DELETE = "delete"
+}
+
 enum ResourceType {
   SECRET = "secret",
   FOLDER = "folder"
@@ -68,11 +73,12 @@ export type ResourceChange = {
   versionId: string;
   oldVersionId?: string;
   changeType: ChangeType;
-  commitId: number;
+  commitId: bigint;
   createdAt?: Date;
   parentId?: string;
   secretKey?: string;
   secretVersion?: string;
+  secretId?: string;
   folderName?: string;
   folderVersion?: string;
   fromVersion?: string;
@@ -209,7 +215,7 @@ export const folderCommitServiceFactory = ({
     const latestCheckpoint = await folderCheckpointDAL.findLatestByFolderId(folderId, tx);
 
     if (!latestCommitId) {
-      const latestCommit = await folderCommitDAL.findLatestCommit(folderId, tx);
+      const latestCommit = await folderCommitDAL.findLatestCommit(folderId, undefined, tx);
       if (!latestCommit) {
         throw new BadRequestError({ message: "Latest commit ID not found" });
       }
@@ -264,7 +270,11 @@ export const folderCommitServiceFactory = ({
       throw new NotFoundError({ message: `Commit with ID ${folderCommitId} not found` });
     }
 
-    const nearestCheckpoint = await folderCheckpointDAL.findNearestCheckpoint(folderCommitId, tx);
+    const nearestCheckpoint = await folderCheckpointDAL.findNearestCheckpoint(
+      targetCommit.commitId,
+      targetCommit.folderId,
+      tx
+    );
     if (!nearestCheckpoint) {
       throw new NotFoundError({ message: `Nearest checkpoint not found for commit ${folderCommitId}` });
     }
@@ -288,7 +298,7 @@ export const folderCommitServiceFactory = ({
     checkpointResources.forEach((resource) => {
       if (resource.secretVersionId && resource.referencedSecretId) {
         folderState[`secret-${resource.referencedSecretId}`] = {
-          type: "secret",
+          type: ResourceType.SECRET,
           id: resource.referencedSecretId,
           versionId: resource.secretVersionId,
           secretKey: resource.secretKey,
@@ -296,7 +306,7 @@ export const folderCommitServiceFactory = ({
         };
       } else if (resource.folderVersionId && resource.referencedFolderId) {
         folderState[`folder-${resource.referencedFolderId}`] = {
-          type: "folder",
+          type: ResourceType.FOLDER,
           id: resource.referencedFolderId,
           versionId: resource.folderVersionId,
           folderName: resource.folderName,
@@ -323,7 +333,7 @@ export const folderCommitServiceFactory = ({
 
           if (change.changeType.toLowerCase() === "add") {
             folderState[key] = {
-              type: "secret",
+              type: ResourceType.SECRET,
               id: change.referencedSecretId,
               versionId: change.secretVersionId,
               secretKey: change.secretKey,
@@ -337,7 +347,7 @@ export const folderCommitServiceFactory = ({
 
           if (change.changeType.toLowerCase() === "add") {
             folderState[key] = {
-              type: "folder",
+              type: ResourceType.FOLDER,
               id: change.referencedFolderId,
               versionId: change.folderVersionId,
               folderName: change.folderName,
@@ -902,12 +912,14 @@ export const folderCommitServiceFactory = ({
     const secretVersions = await secretVersionV2BridgeDAL.findByIdsWithLatestVersion(
       folderId,
       secretChanges.map((diff) => diff.id),
-      secretChanges.map((diff) => diff.versionId)
+      secretChanges.map((diff) => diff.versionId),
+      tx
     );
 
     const folderVersions = await folderVersionDAL.findByIdsWithLatestVersion(
       folderChanges.map((diff) => diff.id),
-      folderChanges.map((diff) => diff.versionId)
+      folderChanges.map((diff) => diff.versionId),
+      tx
     );
 
     // Process changes in parallel
@@ -1072,8 +1084,8 @@ export const folderCommitServiceFactory = ({
       actorOrgId,
       projectId
     });
-    const changes = await folderCommitChangesDAL.findByCommitId(commitId);
-    const commit = await folderCommitDAL.findById(commitId);
+    const changes = await folderCommitChangesDAL.findByCommitId(commitId, projectId);
+    const commit = await folderCommitDAL.findById(commitId, undefined, projectId);
     return { ...commit, changes };
   };
 
@@ -1244,8 +1256,6 @@ export const folderCommitServiceFactory = ({
   }: {
     targetCommitId: string;
     envId: string;
-    actorId: string;
-    actorType: ActorType;
     projectId: string;
     tx?: Knex;
   }) => {
@@ -1254,7 +1264,7 @@ export const folderCommitServiceFactory = ({
       throw new NotFoundError({ message: `No commit found for commit ID ${targetCommitId}` });
     }
 
-    const checkpoint = await folderTreeCheckpointDAL.findNearestCheckpoint(targetCommitId, envId, tx);
+    const checkpoint = await folderTreeCheckpointDAL.findNearestCheckpoint(targetCommit.commitId, envId, tx);
     if (!checkpoint) {
       throw new NotFoundError({ message: `No checkpoint found for commit ID ${targetCommitId}` });
     }
@@ -1267,7 +1277,7 @@ export const folderCommitServiceFactory = ({
     });
 
     // Group commits by folderId and keep only the latest
-    const folderGroups = new Map<string, { commitId: number; id: string }>();
+    const folderGroups = new Map<string, { commitId: bigint; id: string }>();
 
     if (folderCheckpointCommits && folderCheckpointCommits.length > 0) {
       for (const commit of folderCheckpointCommits) {
@@ -1358,7 +1368,7 @@ export const folderCommitServiceFactory = ({
         throw new NotFoundError({ message: `No commit found for commit ID ${targetCommitId}` });
       }
 
-      const checkpoint = await folderTreeCheckpointDAL.findNearestCheckpoint(targetCommitId, envId, tx);
+      const checkpoint = await folderTreeCheckpointDAL.findNearestCheckpoint(targetCommit.commitId, envId, tx);
       if (!checkpoint) {
         throw new NotFoundError({ message: `No checkpoint found for commit ID ${targetCommitId}` });
       }
@@ -1371,7 +1381,7 @@ export const folderCommitServiceFactory = ({
       });
 
       // Group commits by folderId and keep only the latest
-      const folderGroups = new Map<string, { commitId: number; id: string }>();
+      const folderGroups = new Map<string, { commitId: bigint; id: string }>();
 
       if (folderCheckpointCommits && folderCheckpointCommits.length > 0) {
         for (const commit of folderCheckpointCommits) {
@@ -1421,9 +1431,9 @@ export const folderCommitServiceFactory = ({
       const foldersToDelete = new Set<string>();
 
       // Process all DELETE operations to build a complete set of folders to be deleted
-      for (const [folderId, changes] of folderDiffs.entries()) {
+      for (const changes of folderDiffs.values()) {
         for (const change of changes) {
-          if (change.changeType === ChangeType.DELETE && change.type === "folder") {
+          if (change.changeType === ChangeType.DELETE && change.type === ResourceType.FOLDER) {
             foldersToDelete.add(change.id);
           }
         }
@@ -1483,7 +1493,7 @@ export const folderCommitServiceFactory = ({
       actorOrgId,
       projectId
     });
-    return folderCommitDAL.findLatestCommit(folderId);
+    return folderCommitDAL.findLatestCommit(folderId, projectId);
   };
 
   /**
@@ -1506,6 +1516,19 @@ export const folderCommitServiceFactory = ({
     projectId: string;
     message?: string;
   }) => {
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.SecretManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCommitsActions.PerformRollback,
+      ProjectPermissionSub.Commits
+    );
     // Check permissions first
     await checkProjectPermission({
       actor,
@@ -1516,7 +1539,7 @@ export const folderCommitServiceFactory = ({
     });
 
     // Get the commit to revert
-    const commitToRevert = await folderCommitDAL.findById(commitId);
+    const commitToRevert = await folderCommitDAL.findById(commitId, undefined, projectId);
     if (!commitToRevert) {
       throw new NotFoundError({ message: `Commit with ID ${commitId} not found` });
     }

backend/src/services/folder-commit/folder-commit-types.ts

@@ -0,0 +1,84 @@
+import { z } from "zod";
+
+const secretVersionSchema = z.object({
+  secretKey: z.string(),
+  secretComment: z.string().optional().nullable(),
+  skipMultilineEncoding: z.boolean().optional().nullable(),
+  secretReminderRepeatDays: z.number().optional().nullable(),
+  secretReminderNote: z.string().optional().nullable(),
+  metadata: z.unknown().optional().nullable(),
+  tags: z.array(z.string()).optional().nullable(),
+  secretReminderRecipients: z.array(z.any()).optional().nullable(),
+  secretValue: z.string().optional().nullable()
+});
+
+const folderVersionSchema = z.object({
+  name: z.string()
+});
+
+const baseChangeSchema = z.object({
+  id: z.string(),
+  folderCommitId: z.string(),
+  changeType: z.string(),
+  isUpdate: z.boolean().optional(),
+  createdAt: z.union([z.string(), z.date()]),
+  updatedAt: z.union([z.string(), z.date()]),
+  actorMetadata: z
+    .union([
+      z.object({
+        id: z.string().optional(),
+        name: z.string().optional()
+      }),
+      z.unknown()
+    ])
+    .optional(),
+  actorType: z.string().optional(),
+  message: z.string().optional().nullable(),
+  folderId: z.string().optional()
+});
+
+const secretChangeSchema = baseChangeSchema.extend({
+  objectType: z.literal("secret"),
+  secretVersionId: z.string(),
+  folderVersionId: z.null(),
+  folderName: z.null(),
+  folderChangeId: z.null(),
+  secretKey: z.string(),
+  secretVersion: z.union([z.string(), z.number()]),
+  secretId: z.string(),
+  versions: z.array(secretVersionSchema).optional()
+});
+
+const folderChangeSchema = baseChangeSchema.extend({
+  objectType: z.literal("folder"),
+  secretVersionId: z.null(),
+  folderVersionId: z.string(),
+  folderName: z.string(),
+  folderChangeId: z.string(),
+  folderVersion: z.union([z.string(), z.number()]),
+  secretKey: z.null(),
+  secretId: z.null(),
+  versions: z.array(folderVersionSchema).optional()
+});
+
+const commitChangeSchema = z.discriminatedUnion("objectType", [secretChangeSchema, folderChangeSchema]);
+
+const commitSchema = z.object({
+  id: z.string(),
+  commitId: z.string(),
+  actorMetadata: z.object({
+    id: z.string(),
+    name: z.string()
+  }),
+  actorType: z.string(),
+  message: z.string().nullable(),
+  folderId: z.string(),
+  envId: z.string(),
+  createdAt: z.union([z.string(), z.date()]),
+  updatedAt: z.union([z.string(), z.date()]),
+  changes: z.array(commitChangeSchema)
+});
+
+export const commitChangesResponseSchema = z.object({
+  changes: commitSchema
+});

backend/src/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal.ts

@@ -8,7 +8,7 @@ import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
 export type TFolderTreeCheckpointResourcesDALFactory = ReturnType<typeof folderTreeCheckpointResourcesDALFactory>;
 
 type TFolderTreeCheckpointResourcesWithCommitId = TFolderTreeCheckpointResources & {
-  commitId: number;
+  commitId: bigint;
 };
 
 export const folderTreeCheckpointResourcesDALFactory = (db: TDbClient) => {

backend/src/services/folder-tree-checkpoint/folder-tree-checkpoint-dal.ts

@@ -3,12 +3,12 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TFolderCommits, TFolderTreeCheckpoints } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TFolderTreeCheckpointDALFactory = ReturnType<typeof folderTreeCheckpointDALFactory>;
 
 type TreeCheckpointWithCommitInfo = TFolderTreeCheckpoints & {
-  commitId: number;
+  commitId: bigint;
 };
 
 export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
@@ -17,7 +17,8 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
   const findByCommitId = async (folderCommitId: string, tx?: Knex): Promise<TFolderTreeCheckpoints | undefined> => {
     try {
       const doc = await (tx || db.replicaNode())<TFolderTreeCheckpoints>(TableName.FolderTreeCheckpoint)
-        .where({ folderCommitId })
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter({ folderCommitId }, TableName.FolderTreeCheckpoint))
         .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
         .first();
       return doc;
@@ -27,27 +28,20 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
   };
 
   const findNearestCheckpoint = async (
-    folderCommitId: string,
+    folderCommitId: bigint,
     envId: string,
     tx?: Knex
   ): Promise<TreeCheckpointWithCommitInfo | undefined> => {
     try {
-      const targetCommit = await (tx || db.replicaNode())(TableName.FolderCommit)
-        .where({ id: folderCommitId })
-        .select("id", "commitId", "folderId", "envId")
-        .first();
-
-      if (!targetCommit) {
-        return undefined;
-      }
-
       const nearestCheckpoint = await (tx || db.replicaNode())(TableName.FolderTreeCheckpoint)
-        .leftJoin<TFolderCommits>(
+        .join<TFolderCommits>(
           TableName.FolderCommit,
           `${TableName.FolderTreeCheckpoint}.folderCommitId`,
           `${TableName.FolderCommit}.id`
         )
-        .where(`${TableName.FolderCommit}.envId`, "=", targetCommit.envId)
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(`${TableName.FolderCommit}.envId`, "=", envId)
+        .where(`${TableName.FolderCommit}.commitId`, "<=", folderCommitId)
         .select(selectAllTableCols(TableName.FolderTreeCheckpoint))
         .select(db.ref("commitId").withSchema(TableName.FolderCommit))
         .orderBy(`${TableName.FolderCommit}.commitId`, "desc")
@@ -67,12 +61,12 @@ export const folderTreeCheckpointDALFactory = (db: TDbClient) => {
           `${TableName.FolderTreeCheckpoint}.folderCommitId`,
           `${TableName.FolderCommit}.id`
         )
-        .where(`${TableName.FolderCommit}.envId`, envId)
+        .where(`${TableName.FolderCommit}.envId`, "=", envId)
         .orderBy(`${TableName.FolderTreeCheckpoint}.createdAt`, "desc")
         .first();
       return doc;
     } catch (error) {
-      throw new DatabaseError({ error, name: "FindLatestByFolderId" });
+      throw new DatabaseError({ error, name: "FindLatestByEnvId" });
     }
   };
 

backend/src/services/secret-folder/secret-folder-service.ts

@@ -10,7 +10,7 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
 import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 
-import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
+import { CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
@@ -134,7 +134,7 @@ export const secretFolderServiceFactory = ({
               message: "Folder created",
               folderId: parentFolderId,
               changes: folderVersions.map((fv) => ({
-                type: "add",
+                type: CommitType.ADD,
                 folderVersionId: fv.id
               }))
             },
@@ -168,7 +168,7 @@ export const secretFolderServiceFactory = ({
           folderId: parentFolderId,
           changes: [
             {
-              type: "add",
+              type: CommitType.ADD,
               folderVersionId: folderVersion.id
             }
           ]
@@ -285,7 +285,7 @@ export const secretFolderServiceFactory = ({
               folderId: parentFolder.id,
               changes: [
                 {
-                  type: "add",
+                  type: CommitType.ADD,
                   isUpdate: true,
                   folderVersionId: folderVersion.id
                 }
@@ -401,7 +401,7 @@ export const secretFolderServiceFactory = ({
           folderId: parentFolder.id,
           changes: [
             {
-              type: "add",
+              type: CommitType.ADD,
               isUpdate: true,
               folderVersionId: folderVersion.id
             }
@@ -463,7 +463,7 @@ export const secretFolderServiceFactory = ({
 
       if (!doc) throw new NotFoundError({ message: `Failed to delete folder with ID '${idOrName}', not found` });
 
-      const folderVersions = await folderVersionDAL.findLatestFolderVersions([doc.id]);
+      const folderVersions = await folderVersionDAL.findLatestFolderVersions([doc.id], tx);
 
       await folderCommitService.createCommit(
         {
@@ -477,7 +477,7 @@ export const secretFolderServiceFactory = ({
           folderId: parentFolder.id,
           changes: [
             {
-              type: "delete",
+              type: CommitType.DELETE,
               folderVersionId: folderVersions[doc.id].id
             }
           ]

backend/src/services/secret-folder/secret-folder-version-dal.ts

@@ -97,67 +97,78 @@ export const secretFolderVersionDALFactory = (db: TDbClient) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning secret folder versions completed`);
   };
 
+  // Get latest versions by folderIds
+  const getLatestFolderVersions = async (folderIds: string[], tx?: Knex): Promise<Array<TSecretFolderVersions>> => {
+    if (!folderIds.length) return [];
+
+    const knexInstance = tx || db.replicaNode();
+    return knexInstance(TableName.SecretFolderVersion)
+      .whereIn(`${TableName.SecretFolderVersion}.folderId`, folderIds)
+      .join(
+        knexInstance(TableName.SecretFolderVersion)
+          .groupBy("folderId")
+          .max("version")
+          .select("folderId")
+          .as("latestVersion"),
+        (bd) => {
+          bd.on(`${TableName.SecretFolderVersion}.folderId`, "latestVersion.folderId").andOn(
+            `${TableName.SecretFolderVersion}.version`,
+            "latestVersion.max"
+          );
+        }
+      );
+  };
+
+  // Get specific versions and update with max version
+  const getSpecificFolderVersionsWithLatest = async (
+    versionIds: string[],
+    tx?: Knex
+  ): Promise<Array<TSecretFolderVersions>> => {
+    if (!versionIds.length) return [];
+
+    const knexInstance = tx || db.replicaNode();
+
+    // Get specific versions
+    const specificVersions = await knexInstance(TableName.SecretFolderVersion).whereIn("id", versionIds);
+
+    // Get folderIds from these versions
+    const specificFolderIds = [...new Set(specificVersions.map((v) => v.folderId).filter(Boolean))];
+
+    if (!specificFolderIds.length) return specificVersions;
+
+    // Get max versions for these folderIds
+    const maxVersionsQuery = await knexInstance(TableName.SecretFolderVersion)
+      .whereIn("folderId", specificFolderIds)
+      .groupBy("folderId")
+      .select("folderId")
+      .max("version", { as: "maxVersion" });
+
+    // Create lookup map for max versions
+    const maxVersionMap = maxVersionsQuery.reduce<Record<string, number>>((acc, item) => {
+      acc[item.folderId] = item.maxVersion;
+      return acc;
+    }, {});
+
+    // Replace version with max version
+    return specificVersions.map((version) => ({
+      ...version,
+      version: maxVersionMap[version.folderId] || version.version
+    }));
+  };
+
   const findByIdsWithLatestVersion = async (folderIds: string[], versionIds?: string[], tx?: Knex) => {
     try {
       if (!folderIds.length && (!versionIds || !versionIds.length)) return {};
 
-      const knexInstance = tx || db.replicaNode();
-      let allDocs: Array<TSecretFolderVersions & { max?: number }> = [];
+      const [latestVersions, specificVersionsWithLatest] = await Promise.all([
+        folderIds.length ? getLatestFolderVersions(folderIds, tx) : [],
+        versionIds?.length ? getSpecificFolderVersionsWithLatest(versionIds, tx) : []
+      ]);
 
-      // Process latest versions for folderIds
-      if (folderIds.length) {
-        const latestVersions: Array<TSecretFolderVersions & { max: number }> = await knexInstance(
-          TableName.SecretFolderVersion
-        )
-          .whereIn(`${TableName.SecretFolderVersion}.folderId`, folderIds)
-          .join(
-            knexInstance(TableName.SecretFolderVersion)
-              .groupBy("folderId")
-              .max("version")
-              .select("folderId")
-              .as("latestVersion"),
-            (bd) => {
-              bd.on(`${TableName.SecretFolderVersion}.folderId`, "latestVersion.folderId").andOn(
-                `${TableName.SecretFolderVersion}.version`,
-                "latestVersion.max"
-              );
-            }
-          );
+      const allDocs = [...latestVersions, ...specificVersionsWithLatest];
 
-        allDocs = [...allDocs, ...latestVersions];
-      }
-
-      // Process specific versions by versionIds
-      if (versionIds && versionIds.length) {
-        // Get the specific versions
-        const specificVersions = await knexInstance(TableName.SecretFolderVersion).whereIn("id", versionIds);
-
-        // Get the folderIds from these versions
-        const specificFolderIds = [...new Set(specificVersions.map((v) => v.folderId).filter(Boolean))];
-
-        // Get max versions for these folderIds
-        const maxVersionsQuery = (await knexInstance(TableName.SecretFolderVersion)
-          .whereIn("folderId", specificFolderIds)
-          .groupBy("folderId")
-          .select("folderId")
-          .max("version as max")) as Array<{ folderId: string; max: number }>;
-
-        // Create a lookup map for max versions
-        const maxVersionMap = maxVersionsQuery.reduce<Record<string, number>>((acc, item) => {
-          acc[item.folderId] = item.max;
-          return acc;
-        }, {});
-
-        // Add max version to each specific version
-        const specificVersionsWithMax = specificVersions.map((version) => ({
-          ...version,
-          max: maxVersionMap[version.folderId]
-        }));
-
-        allDocs = [...allDocs, ...specificVersionsWithMax];
-      }
-
-      return allDocs.reduce<Record<string, TSecretFolderVersions & { max?: number }>>(
+      // Convert array to record with folderId as key
+      return allDocs.reduce<Record<string, TSecretFolderVersions>>(
         (prev, curr) => ({ ...prev, [curr.folderId || ""]: curr }),
         {}
       );

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -8,6 +8,7 @@ import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 
 import { ActorType } from "../auth/auth-type";
+import { CommitType } from "../folder-commit/folder-commit-service";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
@@ -135,7 +136,7 @@ export const fnSecretBulkInsert = async ({
   const commitChanges = secretVersions
     .filter(({ type }) => type === SecretType.Shared)
     .map((sv) => ({
-      type: "add",
+      type: CommitType.ADD,
       secretVersionId: sv.id
     }));
 
@@ -289,7 +290,7 @@ export const fnSecretBulkUpdate = async ({
   const commitChanges = secretVersions
     .filter(({ type }) => type === SecretType.Shared)
     .map((sv) => ({
-      type: "add",
+      type: CommitType.ADD,
       isUpdate: true,
       secretVersionId: sv.id
     }));
@@ -421,7 +422,7 @@ export const fnSecretBulkDelete = async ({
   const commitChanges = deletedSecrets
     .filter(({ type }) => type === SecretType.Shared)
     .map(({ id }) => ({
-      type: "delete",
+      type: CommitType.DELETE,
       secretVersionId: secretVersions[id].id
     }));
   if (commitChanges.length > 0) {

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -16,7 +16,7 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
-  ProjectPermissionActions,
+  ProjectPermissionCommitsActions,
   ProjectPermissionSecretActions,
   ProjectPermissionSet,
   ProjectPermissionSub
@@ -2173,7 +2173,7 @@ export const secretV2BridgeServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,
       projectId: folder.projectId
@@ -2889,7 +2889,7 @@ export const secretV2BridgeServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,
       projectId: folder.projectId

backend/src/services/secret-v2-bridge/secret-version-dal.ts

@@ -272,6 +272,79 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     }
   };
 
+  // Function to fetch latest versions by secretIds
+  const getLatestVersionsBySecretIds = async (
+    folderId: string,
+    secretIds: string[],
+    tx?: Knex
+  ): Promise<Array<TSecretVersionsV2>> => {
+    if (!secretIds.length) return [];
+
+    const knexInstance = tx || db.replicaNode();
+    return knexInstance(TableName.SecretVersionV2)
+      .where("folderId", folderId)
+      .whereIn(`${TableName.SecretVersionV2}.secretId`, secretIds)
+      .join(
+        knexInstance(TableName.SecretVersionV2)
+          .groupBy("secretId")
+          .max("version")
+          .select("secretId")
+          .as("latestVersion"),
+        (bd) => {
+          bd.on(`${TableName.SecretVersionV2}.secretId`, "latestVersion.secretId").andOn(
+            `${TableName.SecretVersionV2}.version`,
+            "latestVersion.max"
+          );
+        }
+      );
+  };
+
+  // Function to fetch specific versions by versionIds
+  const getSpecificVersionsWithLatestInfo = async (
+    folderId: string,
+    versionIds: string[],
+    tx?: Knex
+  ): Promise<Array<TSecretVersionsV2>> => {
+    if (!versionIds.length) return [];
+
+    const knexInstance = tx || db.replicaNode();
+
+    // Get the specific versions
+    const specificVersions = await knexInstance(TableName.SecretVersionV2)
+      .where("folderId", folderId)
+      .whereIn("id", versionIds);
+
+    // Get the secretIds from these versions
+    const specificSecretIds = [...new Set(specificVersions.map((v) => v.secretId).filter(Boolean))];
+
+    if (!specificSecretIds.length) return specificVersions;
+
+    // Get max versions for these secretIds
+    const maxVersionsQuery = await knexInstance(TableName.SecretVersionV2)
+      .whereIn("secretId", specificSecretIds)
+      .groupBy("secretId")
+      .select("secretId")
+      .max("version as maxVersion");
+
+    // Create a lookup map for max versions
+    const maxVersionMap = maxVersionsQuery.reduce(
+      (acc, item) => {
+        acc[item.secretId] = item.maxVersion;
+        return acc;
+      },
+      {} as Record<string, number>
+    );
+
+    // Update the version field with maxVersion when needed
+    return specificVersions.map((version) => {
+      // Replace version with maxVersion
+      return {
+        ...version,
+        version: maxVersionMap[version.secretId] || version.version
+      };
+    });
+  };
+
   const findByIdsWithLatestVersion = async (
     folderId: string,
     secretIds: string[],
@@ -281,67 +354,15 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     try {
       if (!secretIds.length && (!versionIds || !versionIds.length)) return {};
 
-      const knexInstance = tx || db.replicaNode();
-      let allDocs: Array<TSecretVersionsV2 & { max?: number }> = [];
+      const [latestVersions, specificVersionsWithLatest] = await Promise.all([
+        secretIds.length ? getLatestVersionsBySecretIds(folderId, secretIds, tx) : [],
+        versionIds?.length ? getSpecificVersionsWithLatestInfo(folderId, versionIds, tx) : []
+      ]);
 
-      // Process latest versions for secretIds
-      if (secretIds.length) {
-        const latestVersions: Array<TSecretVersionsV2 & { max: number }> = await knexInstance(TableName.SecretVersionV2)
-          .where("folderId", folderId)
-          .whereIn(`${TableName.SecretVersionV2}.secretId`, secretIds)
-          .join(
-            knexInstance(TableName.SecretVersionV2)
-              .groupBy("secretId")
-              .max("version")
-              .select("secretId")
-              .as("latestVersion"),
-            (bd) => {
-              bd.on(`${TableName.SecretVersionV2}.secretId`, "latestVersion.secretId").andOn(
-                `${TableName.SecretVersionV2}.version`,
-                "latestVersion.max"
-              );
-            }
-          );
+      const allDocs = [...latestVersions, ...specificVersionsWithLatest];
 
-        allDocs = [...allDocs, ...latestVersions];
-      }
-
-      // Process specific versions by versionIds
-      if (versionIds && versionIds.length) {
-        // Get the specific versions
-        const specificVersions = await knexInstance(TableName.SecretVersionV2)
-          .where("folderId", folderId)
-          .whereIn("id", versionIds);
-
-        // Get the secretIds from these versions
-        const specificSecretIds = [...new Set(specificVersions.map((v) => v.secretId).filter(Boolean))];
-
-        // Get max versions for these secretIds
-        const maxVersionsQuery = (await knexInstance(TableName.SecretVersionV2)
-          .whereIn("secretId", specificSecretIds)
-          .groupBy("secretId")
-          .select("secretId")
-          .max("version as max")) as Array<{ secretId: string; max: number }>;
-
-        // Create a lookup map for max versions
-        const maxVersionMap = maxVersionsQuery.reduce(
-          (acc, item) => {
-            acc[item.secretId] = item.max;
-            return acc;
-          },
-          {} as Record<string, number>
-        );
-
-        // Add max version to each specific version
-        const specificVersionsWithMax = specificVersions.map((version) => ({
-          ...version,
-          max: maxVersionMap[version.secretId]
-        }));
-
-        allDocs = [...allDocs, ...specificVersionsWithMax];
-      }
-
-      return allDocs.reduce<Record<string, TSecretVersionsV2 & { max?: number }>>(
+      // Convert array to record with secretId as key
+      return allDocs.reduce<Record<string, TSecretVersionsV2>>(
         (prev, curr) => ({ ...prev, [curr.secretId || ""]: curr }),
         {}
       );

backend/src/services/secret/secret-service.ts

@@ -2533,21 +2533,15 @@ export const secretServiceFactory = ({
     secretVersions: string[];
     folderId: string;
   }) => {
-    const secretVersionV2 = await secretV2BridgeService
-      .getSecretVersionsByIds({
-        actorId,
-        actor,
-        actorOrgId,
-        actorAuthMethod,
-        secretId,
-        folderId,
-        secretVersionNumbers: secretVersions
-      })
-      .catch((err) => {
-        if ((err as Error).message === "BadRequest: Failed to find secret") {
-          return null;
-        }
-      });
+    const secretVersionV2 = await secretV2BridgeService.getSecretVersionsByIds({
+      actorId,
+      actor,
+      actorOrgId,
+      actorAuthMethod,
+      secretId,
+      folderId,
+      secretVersionNumbers: secretVersions
+    });
     return secretVersionV2;
   };