Reject updates to deleted secrets

server/src/__tests__/secrets-service.test.ts

@@ -401,6 +401,29 @@ describeEmbeddedPostgres("secretService", () => {
     ).rejects.toThrow(/not found/i);
   });
 
+  it("rejects updates to already soft-deleted external reference secrets", async () => {
+    const companyId = await seedCompany();
+    const svc = secretService(db);
+    const awsVault = await svc.createProviderConfig(companyId, {
+      provider: "aws_secrets_manager",
+      displayName: "AWS production",
+      config: { region: "us-east-1", namespace: "prod-use1" },
+    });
+    const deleted = await svc.create(companyId, {
+      name: "Deleted patch target",
+      key: "deleted-patch-target",
+      provider: "aws_secrets_manager",
+      providerConfigId: awsVault.id,
+      managedMode: "external_reference",
+      externalRef: "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/deleted-patch-target",
+    });
+    await svc.update(deleted.id, { status: "deleted" });
+
+    await expect(svc.update(deleted.id, { status: "active" })).rejects.toThrow(
+      /not found/i,
+    );
+  });
+
   it("allows re-importing a remote secret after the prior external reference is soft-deleted", async () => {
     const companyId = await seedCompany();
     const svc = secretService(db);

server/src/routes/secrets.ts

@@ -386,6 +386,10 @@ export function secretRoutes(db: Db) {
       return;
     }
     assertCompanyAccess(req, existing.companyId);
+    if (existing.status === "deleted") {
+      res.status(404).json({ error: "Secret not found" });
+      return;
+    }
 
     const updated = await svc.update(id, {
       name: req.body.name,

server/src/services/secrets.ts

@@ -1685,6 +1685,7 @@ export function secretService(db: Db) {
     ) => {
       const secret = await getById(secretId);
       if (!secret) throw notFound("Secret not found");
+      if (secret.status === "deleted") throw notFound("Secret not found");
 
       if (patch.name && patch.name !== secret.name) {
         const duplicate = await getByName(secret.companyId, patch.name);