[Bug] Secret references of imported environments do not resolve when a non-existing environment variable is referenced

[matzeeable]

Product

Secret Manager

Describe the bug

We are using envsubst on our client-side to replace some variables in Infisical values, which are not allowed to be placed in Infisical. When an environment imports a secret folder that uses a variable with a secret reference and an undeclared variable, the secret reference does not get resolved.

To Reproduce

1.) Create the following folder with these variables:

2.) Create another folder with these variables, secret references, and import from staging in development:

The following command works as expected for staging:

$ infisical export --path="/__testing__/test1" --env="staging"
MY_ANOTHER_SECRET='secret reference 1 between'
MY_FAILING_SECRET='1 ${NOT_DECLARED_IN_INFISICAL}'
MY_SECOND_SECRET='1'

The following command breaks the MY_FAILING_SECRET as it got imported with a secret reference and undeclared variable

infisical export --path="/__testing__/test1" --env="dev"
MY_ANOTHER_SECRET='secret reference 1 between'
MY_FAILING_SECRET='${staging.__testing__.test2.MY_AWESOME_SECRET} ${NOT_DECLARED_IN_INFISICAL}'
MY_SECOND_SECRET='1'

As you can see, the secret reference works for all other imported variables except the one with the undeclared variable NOT_DECLARED_IN_INFISICAL.

Expected behavior

infisical export --path="/__testing__/test1" --env="dev"
MY_ANOTHER_SECRET='secret reference 1 between'
MY_FAILING_SECRET='1 ${NOT_DECLARED_IN_INFISICAL}'
MY_SECOND_SECRET='1'

Screenshots

No response

Deployment Type

Self-hosted

Additional context

Happens also in Infisical Cloud and latest Infisical self-hosted

[linear]

ENG-5539