From b58da3f6740a27fe20eb4ee7befa2cf50283c1e0 Mon Sep 17 00:00:00 2001 From: Dotta Date: Wed, 1 Jul 2026 21:58:27 +0000 Subject: [PATCH] fix(secrets): ignore null user-secret patch values Co-Authored-By: Paperclip --- server/src/__tests__/secrets-service.test.ts | 29 ++++++++++++++++++++ server/src/services/secrets.ts | 2 +- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/server/src/__tests__/secrets-service.test.ts b/server/src/__tests__/secrets-service.test.ts index c2511c3e4d5..7216fa9eb55 100644 --- a/server/src/__tests__/secrets-service.test.ts +++ b/server/src/__tests__/secrets-service.test.ts @@ -598,6 +598,35 @@ describeEmbeddedPostgres("secretService", () => { expect(JSON.stringify(events)).not.toContain("user-one-secret"); }); + it("treats null user-secret value patches as non-rotation updates", async () => { + const companyId = await seedCompany(); + await seedCompanyMember(companyId, "user-1", "owner"); + const svc = secretService(db); + await svc.createUserSecretDefinition(companyId, { + key: "github_token", + name: "GitHub token", + provider: "local_encrypted", + }); + const secret = await svc.createCurrentUserSecretValue(companyId, "user-1", { + definitionKey: "github_token", + value: "user-one-secret", + }); + + const updated = await svc.updateCurrentUserSecretValue(companyId, "user-1", secret.id, { + value: null, + }); + + expect(updated.latestVersion).toBe(secret.latestVersion); + expect(updated.status).toBe(secret.status); + const versions = await db + .select() + .from(companySecretVersions) + .where(eq(companySecretVersions.secretId, secret.id)); + expect(versions).toHaveLength(1); + expect(versions[0]).toMatchObject({ version: secret.latestVersion, status: "current" }); + expect(versions[0]?.material).toBeTruthy(); + }); + it("reports missing adapter-config user secret refs before runtime resolution", async () => { const companyId = await seedCompany(); await seedCompanyMember(companyId, "user-1", "owner"); diff --git a/server/src/services/secrets.ts b/server/src/services/secrets.ts index c2875e8033b..deec792e733 100644 --- a/server/src/services/secrets.ts +++ b/server/src/services/secrets.ts @@ -2121,7 +2121,7 @@ export function secretService(db: Db) { ) => { const secret = await getUserSecretValueById(companyId, ownerUserId, secretId); if ( - patch.value !== undefined || + patch.value != null || patch.externalRef !== undefined || patch.providerVersionRef !== undefined || patch.providerConfigId !== undefined