fix(secret-approval-request): skip soft-deleted projects in approval request DAL queries

[jaydeep-pipaliya]

What

Four queries in secret-approval-request-dal.ts join project_environments and filter Environment.deleteAfter but never filter Project.deleteAfter. Soft-deleting a project does not soft-delete its environments, so approval requests for projects sitting in the delete grace window were still returned by every find / list / pagination path.

The shared findQuery helper already joins TableName.Project but never enforces whereNull(Project.deleteAfter); the three other ad-hoc subqueries that build the same shape (in findById, the paginated find, and the SAR window query) also missed the Project join entirely.

Fix

Adds the Project join + whereNull(Project.deleteAfter) to every place that already filters Environment.deleteAfter. Mirrors the pattern in org-product-stats-dal.ts and the previously shipped webhook (#6970), integration (#6983), secret-rotation-v2 (#7002), dynamic-secret (#7065), snapshot (#7066), folder-commit (#7067), honey-token (#7088), and secret-import (#7089) fixes.

Not changed

deleteByProjectId — that path is the project-cleanup worker, which intentionally targets soft-deleted projects for cleanup.

Checklist

• I have read the contributing guide
• I have added tests (DAL-only change; same pattern as existing cross-project DALs)
• The change is limited to the affected code path

[greptile-apps]

Greptile Summary

This PR closes a data-visibility gap in the secret approval request DAL: soft-deleting a project does not cascade to its environments, so approval requests belonging to a project in the grace window were still returned by listing, pagination, count, and lookup queries. The fix adds an inner join on Project plus whereNull(Project.deleteAfter) to every affected code path, mirroring the same pattern applied across other DALs in recent PRs.

• findQuery (shared helper used by findById) already had the Project join; the PR adds the missing whereNull filter.
• findProjectRequestCount, findByProjectId, and findByProjectIdBridgeSecretV2 each lacked the Project join entirely; both the join and the whereNull filter are added.
• deleteByProjectId is intentionally left unchanged as it targets soft-deleted projects for cleanup.

Confidence Score: 5/5

Surgical, one-file change that adds the same two-line guard to four parallel query sites; no new logic, no schema changes, and the existing cleanup path is correctly left untouched.

All four affected query paths now consistently apply the project soft-delete filter. The new inner join on Project is many-to-one relative to Environment so it introduces no row duplication. OR conditions in the search helpers remain properly wrapped in callbacks. The deleteByProjectId path is intentionally excluded and the PR description explains why.

No files require special attention.

Important Files Changed

Filename	Overview
backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts	Adds Project join + whereNull(Project.deleteAfter) to all four query paths (findQuery helper, findProjectRequestCount, findByProjectId, findByProjectIdBridgeSecretV2) that previously filtered environments but not their parent projects during the soft-delete grace window.

_{Reviews (1): Last reviewed commit: "fix(secret-approval-request): skip soft-..." | Re-trigger Greptile}

[victorvhs017]

Thank you for your collaboration!