Method rotateSecret

backend/src/secrets/secrets.repository.ts:256–319

(
    secretId: string,
    versionData: Omit<NewSecretVersion, 'secretId' | 'version' | 'createdAt' | 'isActive'>,
    options: SecretQueryOptions = {},
  )

  }

  async rotateSecret(
    secretId: string,
    versionData: Omit<NewSecretVersion, 'secretId' | 'version' | 'createdAt' | 'isActive'>,
    options: SecretQueryOptions = {},
  ): Promise<SecretSummary> {
    return this.db.transaction(async (tx) => {
      const orgId = options.organizationId ?? DEFAULT_ORGANIZATION_ID;
      const [secret] = await tx
        .select()
        .from(secrets)
        .where(and(eq(secrets.id, secretId), eq(secrets.organizationId, orgId)))
        .limit(1);

      if (!secret) {
        throw new NotFoundException(`Secret ${secretId} not found`);
      }

      const [{ maxVersion }] = await tx
        .select({ maxVersion: sql<number>`COALESCE(max(${secretVersions.version}), 0)` })
        .from(secretVersions)
        .where(
          and(eq(secretVersions.secretId, secretId), eq(secretVersions.organizationId, orgId)),
        );

      const newVersionNumber = (maxVersion ?? 0) + 1;

      await tx
        .update(secretVersions)
        .set({ isActive: false })
        .where(
          and(eq(secretVersions.secretId, secretId), eq(secretVersions.organizationId, orgId)),
        );

      const [insertedVersion] = await tx
        .insert(secretVersions)
        .values({
          ...versionData,
          secretId,
          version: newVersionNumber,
          isActive: true,
          organizationId: versionData.organizationId ?? orgId,
        })
        .returning();

      const [updatedSecret] = await tx
        .update(secrets)
        .set({ updatedAt: sql`now()` })
        .where(eq(secrets.id, secretId))
        .returning();

      return this.mapSummary({
        id: updatedSecret.id,
        name: updatedSecret.name,
        description: updatedSecret.description,
        tags: updatedSecret.tags,
        createdAt: updatedSecret.createdAt,
        updatedAt: updatedSecret.updatedAt,
        versionId: insertedVersion.id,