From e70c880612db27544be6d37500b3e3d4894233a8 Mon Sep 17 00:00:00 2001
From: Artur Spatari <artur.spatari@ebs-integrator.com>
Date: Thu, 10 Sep 2026 10:32:09 +0300
Subject: [PATCH] test(vault): lock the precedence between two imports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review flagged that multi-import collisions were untested. The order the code
implements is the documented one — Infisical: "If two imports carry a secret
with the same name, the value from the bottom-most import wins" — and the
response lists imports in that order, so sequential assignment matches it.

Added a case with two imports defining the same key. Reversing the merge order
in the client fails it, so the test pins the behaviour rather than restating
the implementation.

vault.test.ts: 58 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/dokploy/__test__/env/vault.test.ts | 27 +++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/apps/dokploy/__test__/env/vault.test.ts b/apps/dokploy/__test__/env/vault.test.ts
index eff5634ef..b1381cd05 100644
--- a/apps/dokploy/__test__/env/vault.test.ts
+++ b/apps/dokploy/__test__/env/vault.test.ts
@@ -496,6 +496,33 @@ describe("infisical client", () => {
 		expect(new URL(listUrl).searchParams.get("include_imports")).toBe("true");
 	});
 
+	it("lets the later import win when two define the same key", async () => {
+		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
+			jsonResponse({
+				secrets: [],
+				imports: [
+					{
+						secretPath: "/base",
+						secrets: [{ secretKey: "DB_URL", secretValue: "postgres://base" }],
+					},
+					{
+						secretPath: "/override",
+						secrets: [
+							{ secretKey: "DB_URL", secretValue: "postgres://override" },
+						],
+					},
+				],
+			}),
+		);
+
+		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
+
+		// Infisical documents this order: "If two imports carry a secret with the
+		// same name, the value from the bottom-most import wins." The response
+		// lists imports in that order, so assigning them in sequence matches it.
+		expect(result).toEqual({ DB_URL: "postgres://override" });
+	});
+
 	it("lets a folder's own secret win over an imported one of the same name", async () => {
 		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
 			jsonResponse({