fix: resolved template discriminated union error

[akhilmhdh]

Context

This PR fixes the project template edit functionality broken due to previous rename we made for secret-events to secret-event-subscriptions . To fix this - we just filter out secrets-events from template before using it in UI. This is ok because secret-events was not used by anyone.

Screenshots

Steps to verify the change

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Read the contributing guide

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Summary

This PR attempts to fix the project template edit functionality broken by the secret-events to secret-event-subscriptions rename. The fix filters secret-events permissions in useGetProjectTemplateById.queryFn.

What works:

• Templates fetched directly via useGetProjectTemplateById will be filtered after the background refetch completes.

What doesn't work:

• When initialData: template is passed to useGetProjectTemplateById, React Query returns that unfiltered data immediately on first render, allowing the discriminated union error to briefly surface before the background refetch filters it.
• When editing the Infisical default template, useGetProjectTemplateById is disabled entirely, so the filter never applies. The raw unfiltered template is used directly.

Both issues stem from the fact that useListProjectTemplates is not filtering secret-events, so any code path that uses templates from that hook (including as initialData or when the query is disabled) will receive unfiltered data.

Recommendation: Apply the same secret-events filter in useListProjectTemplates to ensure consistent filtering across all code paths.

Confidence Score: 2/5

• High risk - The fix is incomplete and leaves two execution paths where the discriminated union error can still occur.
• The PR correctly identifies and fixes one path (useGetProjectTemplateById direct queries), but the underlying issue persists in two critical scenarios: (1) React Query's initialData returns unfiltered data on first render before the background refetch, and (2) the Infisical default template path disables the query entirely, bypassing the filter. Both can reproduce the original discriminated union error. The root cause — unfiltered useListProjectTemplates — is not addressed.
• frontend/src/hooks/api/projectTemplates/queries.tsx — needs filtering applied to useListProjectTemplates to ensure consistent filtering across all code paths and use cases.

Comments Outside Diff (2)

1. frontend/src/hooks/api/projectTemplates/queries.tsx, line 38-69 (link)

   Infisical default template bypasses filtering

   In EditProjectTemplateSection.tsx, when editing the Infisical default template (isInfisicalTemplate = true), useGetProjectTemplateById is disabled (enabled: false). The raw template prop from useListProjectTemplates is used directly without any filtering. If the default template contains secret-events permissions, they will never be filtered out and the discriminated union error will occur.

   Suggested fix: Apply filtering in useListProjectTemplates so that all templates from that hook are consistently filtered, regardless of whether useGetProjectTemplateById is enabled or disabled.

2. frontend/src/hooks/api/projectTemplates/queries.tsx, line 16-36 (link)

   Unfiltered templates from useListProjectTemplates bypass filtering on first render

   In EditProjectTemplateSection.tsx, the unfiltered template from useListProjectTemplates is passed as initialData to useGetProjectTemplateById. React Query returns initialData immediately with isPending = false, so the first render receives the raw template including any secret-events permissions. The filtered data only arrives after the background refetch completes.

   This allows the discriminated union error to briefly surface on first render, reproducing the original bug this PR aims to fix.

   Consider applying the same secret-events filter here that is applied in useGetProjectTemplateById.queryFn, so all templates are consistently filtered at the source.

_{Last reviewed commit: bd56807}

[scott-ray-wilson]

LGTM, verified I could now save with old subject presetn