fix: Prevent intermittent “Missing project data key” errors under par…

[hemantmm]

closes: #4611

Description 📣

This PR resolves an issue where Infisical occasionally fails to read projectId from the request payload during high-volume parallel requests. The backend attempted to access payload fields before properly validating the request body, causing undefined access and unexpected 400 responses.

Key Changes:

• Added null and existence checks on the request payload before reading project-related fields.
• Improved BadRequest responses with clear messaging when expected keys are missing.
• Prevents transient undefined behaviour on concurrent/fast POST requests.

Type ✨

• Bug fix

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Overview

Greptile Summary

This PR attempts to fix intermittent "Missing project data key" errors under parallel POST requests by adding manual validation checks for projectId and environment fields. However, the fix doesn't address the actual root cause.

Key Issues:

• Redundant validation: The manual null checks (lines 417-429) are unnecessary because Zod schema validation already guarantees these required fields exist before the handler runs. If validation fails, Fastify returns 422 and the handler never executes.

• Fragile parameter mapping: The refactored service call uses incorrect parameter names (path instead of secretPath, secretKey instead of secretName), which are accidentally "fixed" by spreading ...req.body afterward. This makes the code confusing and brittle - it only works because of the spread order.

• Removed transformations: The schema changes removed important transformations from secretValue (trimming + preserving trailing newlines) and secretComment (trimming), which may cause behavior changes for existing clients.

• Root cause unaddressed: The actual error "Missing project data key" is thrown from the KMS service (kms-service.ts:806) when project.kmsSecretManagerEncryptedDataKey is missing during concurrent access. This is a race condition in KMS key initialization, not a request validation issue. The manual checks in the router won't prevent this error.

What actually happened: The intermittent failures under parallel requests are likely due to concurrent KMS data key creation attempts, where the lock/wait mechanism in $getProjectSecretManagerKmsDataKey may not properly handle all edge cases. The fix appears to work coincidentally, not because of the validation checks.

Confidence Score: 2/5

• This PR has significant issues with the implementation approach and may not actually fix the reported bug
• The score reflects multiple concerns: (1) redundant validation that adds no value, (2) fragile parameter mapping that works accidentally due to object spread order, (3) removed transformations that may break existing behavior, and (4) most critically, the fix doesn't address the actual root cause (KMS race condition) described in the error message. The manual validation checks for projectId and environment cannot prevent the "Missing project data key" error which originates from the KMS service during concurrent data key initialization.
• backend/src/server/routes/v4/secret-router.ts requires attention - the parameter mapping in the service call needs to be corrected, and the removed Zod transformations should be evaluated for impact on existing clients

Important Files Changed

File Analysis

Filename	Score	Overview
backend/src/server/routes/v4/secret-router.ts	2/5	Added redundant manual validation checks that don't address the root cause. The manual checks for projectId and environment (lines 417-429) are unnecessary since Zod schema already guarantees these required fields exist. The refactored service call uses object spread that accidentally "fixes" incorrect parameter names (secretKey/path vs secretName/secretPath), making the code fragile and confusing.

[greptile-apps]

_{1 file reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}