[comp] Production Deploy by github-actions[bot] · Pull Request #2083 · trycompai/comp

github-actions · 2026-01-30T18:00:47Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

…2079) * feat(app): add 'Remove Device' menu on Employ Devices tab * feat(api): create delete endpoint to remove single host from fleet * feat(app): integrate delete endpoint to remove the host * fix(api): missing host ownership validation allows cross-organization deletion * fix(app): redundant null check after early return guard on handleRemoveDeviceClick * fix(api): duplicated host deletion logic not consolidated on fleet.service * fix(app): remove unnecessary accessorKey on actions column * fix(app): remove duplicated database query for current user member --------- Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>

vercel · 2026-01-30T18:00:52Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Feb 3, 2026 7:40pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		Feb 3, 2026 7:40pm

CLAassistant · 2026-01-30T18:00:54Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ tofikwest
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cursor · 2026-01-30T18:00:55Z

PR Summary

High Risk
Large changes to policy persistence/publishing/approval flows (including new version records, S3 PDF copying/deletion, and migration tasks) can impact existing policy data and downstream consumers. Additional new admin/device-management and cloud-scan workflow changes increase integration risk across API + app surfaces.

Overview
Introduces policy versioning end-to-end: new PolicyVersion DTOs/endpoints (list/create/edit/delete/publish/activate/submit-for-approval), policy creation now seeds version 1, publishing/approval flows now manipulate currentVersionId/pendingVersionId, and multiple callers (AI chat, trust portal PDF bundles, vector-store sync) now prefer currentVersion.content/pdfUrl with fallbacks.

Adds migration + cleanup for legacy policies (Trigger.dev tasks for org/all-org batch migration and app-side migration helpers) and new S3 helpers to copy/delete version PDFs; policy deletion now attempts to remove policy + version PDFs from S3 before cascade deletes.

Expands adjacent workflows: adds owner-only People API/UI support to remove a single FleetDM host, adds revisionNote handling for findings when moving into/out of needs_revision, wraps cloud-security findings writes in a DB transaction, updates cloud scan UX to wait for Trigger runs and revalidate without SWR polling, and adds isSubProcessor to vendor create/response.

^{Written by Cursor Bugbot for commit 0cfbce6. This will update automatically on new commits. Configure here.}

apps/app/src/app/(app)/[orgId]/people/page.tsx

* feat(api): add revision note handling for findings update * feat(app): update onStatusChange to support async handling in FindingItem --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingItem.tsx

cursor · 2026-01-31T02:39:48Z

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingItem.tsx

+    } finally {
+      setIsSubmitting(false);
+    }
+  };


Revision dialog closes on API failure, losing user input

Medium Severity

The handleRevisionSubmit and handleRevisionSkip functions expect onStatusChange to throw on API failure so the dialog remains open for retry. However, handleStatusChange (the implementation of onStatusChange) catches errors internally and shows a toast but doesn't re-throw. This causes await onStatusChange(...) to always resolve successfully, so the dialog closes and the user's typed revision note is cleared even when the API call fails. The user sees an error toast but loses their input.

Additional Locations (1)

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingsList.tsx#L102-L105

cursor · 2026-01-31T02:39:49Z

apps/api/src/findings/dto/update-finding.dto.ts

+  @IsString()
+  @IsOptional()
+  @MaxLength(2000)
+  revisionNote?: string | null;


Missing explicit type causes incorrect OpenAPI schema

Low Severity

The @ApiProperty decorator for revisionNote is missing an explicit type: String specification. Combined with nullable: true and TypeScript type string | null, this causes NestJS Swagger to generate "type": "object" in the OpenAPI spec instead of "type": "string". Add type: String to the decorator options.

* feat(api): add policy versioning with create, update, delete, and fetch operations * fix(api): update approver handling and current version assignment in policy changes * feat(api): enhance deleteById to clean up PDFs from S3 before deletion * feat(api): update policy version creation to handle S3 copy after transaction * feat(api): clear pending approval state when publishing or activating versions * feat(api): include organizationId check to prevent cross-org access in PDF URL retrieval * feat(api): sync draft content to prevent unpublished changes UI bug * feat(api): prevent activating a different version when another is pending approval * feat(api): add validation for deactivated members as approvers * feat(api): clear signatures when publishing or activating policy versions * feat(api): sync draft content to prevent false unpublished changes indicator * feat(api): use transaction for atomic policy updates and sync draft content --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/policies/[policyId]/components/PolicyPageTabs.tsx

cursor · 2026-02-01T05:33:33Z

apps/app/src/actions/policies/update-draft.ts

+  }
+
+  return processed;
+}


Duplicated processContent function and ContentNode interface

Medium Severity

The ContentNode interface and processContent function are duplicated in both update-draft.ts and update-version-content.ts. These are nearly identical implementations that sanitize TipTap editor content. Extract to a shared utility like apps/app/src/actions/policies/lib/content-utils.ts.

cursor · 2026-02-01T05:33:33Z

apps/app/src/actions/policies/create-version.ts

+    console.error('Error copying policy PDF:', error);
+    return null;
+  }
+}


Duplicated S3 PDF copy helper function

Low Severity

The copyPolicyVersionPdf function duplicates the logic in AttachmentsService.copyPolicyVersionPdf (apps/api/src/attachments/attachments.service.ts lines 341-358). Consider extracting to a shared S3 utility module or creating a reusable pattern.

apps/app/src/actions/policies/delete-version.ts

* fix(trust-portal): improve error handling for custom domain updates * fix(trust-portal): enhance error handling for domain ownership checks --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/policies/[policyId]/editor/components/PolicyDetails.tsx

apps/app/src/actions/policies/delete-policy.ts

apps/app/src/actions/policies/migrate-policies-to-versioning.ts

cursor · 2026-02-01T23:13:14Z

apps/app/src/actions/policies/create-version.ts

+    console.error('Error copying policy PDF:', error);
+    return null;
+  }
+}


Duplicate S3 helper functions across packages

Low Severity

copyPolicyVersionPdf in create-version.ts and deletePolicyVersionPdf in delete-version.ts duplicate functionality that already exists in AttachmentsService (attachments.service.ts lines 341-374). Consider creating a shared S3 utility in the app package or calling the API endpoints.

apps/api/src/roles/roles.controller.ts

apps/api/src/roles/roles.service.ts

apps/api/src/auth/require-permission.decorator.ts

cursor · 2026-02-02T22:24:26Z

apps/api/src/policies/policies.service.ts

+      const content = policy.currentVersion?.content ?? policy.content;
+      const pdfUrl = policy.currentVersion?.pdfUrl ?? policy.pdfUrl;
+      return { content, pdfUrl };
+    };


Duplicated getEffectiveData helper in two services

Low Severity

The getEffectiveData helper function is identically defined in both policies.service.ts (lines 946-951) and trust-access.service.ts (lines 2005-2009). Both extract content and pdfUrl from a policy's currentVersion with fallback to policy-level values.

* feat(policies): enhance policy versioning and status handling * refactor(policies): simplify policy header layout and actions * refactor(policies): update publish action to handle empty content and add pdfUrl * refactor(policies): clear approval fields in publish action * refactor(policies): sync draft content with published version in publish action * refactor(policies): optimize initialVersionId change detection in PolicyDetails * refactor(policies): add draft badge to policy details for better status indication * refactor(policies): add lastPublishedAt to policy details and tabs for status display * refactor(policies): implement transaction in publish action to prevent orphaned versions * refactor(cloud-tests): update legacy integration filtering for cloud providers --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

* feat(vendor): add isSubProcessor field to vendor DTOs and forms * refactor(vendor): update isSubProcessor field layout and tooltip * feat(vendor): add onUpdate callback to SecondaryFields component --------- Co-authored-by: Lewis Carhart <lewis@trycomp.ai>

apps/api/src/policies/policies.service.ts

apps/app/src/actions/organization/lib/initialize-organization.ts

* feat(vendor): add isSubProcessor field to vendor DTOs and forms * refactor(vendor): update isSubProcessor field layout and tooltip * feat(vendor): add onUpdate callback to SecondaryFields component * feat(trust): move Trust Portal to dedicated sidebar navigation and settings --------- Co-authored-by: Lewis Carhart <lewis@trycomp.ai>

apps/app/src/actions/policies/update-draft.ts

* feat(settings): moved AddSecretDialog to settings header for secrets page to conform with UI pattern * feat(trust): ensure friendlyUrl defaults to organizationId and update status to published --------- Co-authored-by: Lewis Carhart <lewis@trycomp.ai>

…page to conform with UI pattern (#2098) Co-authored-by: Lewis Carhart <lewis@trycomp.ai>

apps/api/src/trust-portal/trust-access.service.ts

#2100) * feat(cloud-tests): enhance legacy integration filtering and add support for multiple connections * refactor(cloud-tests): improve filtering logic for recent scan results * refactor(cloud-tests): enhance filtering logic for legacy results * refactor(policies): simplify policy header layout and remove PageHeader component

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-03T17:32:44Z

apps/api/src/policies/policies.service.ts

+        status: PolicyStatus.needs_review,
+        approverId: dto.approverId,
+      },
+    });


API missing check for existing pending version

Medium Severity

The API's submitForApproval method doesn't check if another version is already pending approval before overwriting pendingVersionId. The corresponding app action at submit-version-for-approval.ts lines 42-45 has this validation: if (policy.pendingVersionId && policy.pendingVersionId !== versionId). Without this check in the API, an approver could be reviewing one version while it silently changes to a different version, leading to incorrect approvals.

apps/api/src/trust-portal/trust-access.service.ts

…creation (#2101) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/cloud-tests/actions/run-platform-scan.ts

+    const response = await fetch(`${apiUrl}/v1/cloud-security/scan/${connectionId}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'x-organization-id': orgId,
+      },
+    });


In general, to fix this kind of issue you should validate and constrain any user-controlled values before incorporating them into an outbound request URL. The hostname and protocol should never be derived from user input, and any user-provided path components should be validated against an allow-list of expected patterns and rejected if they do not match.

For this specific case, the best fix with minimal behavioral change is to enforce that connectionId conforms to the expected IntegrationConnection ID format before using it in the URL, and to reject the request if it does not. The JSDoc comment states that the parameter is an "icn_..." ID, so we can validate it against a strict regular expression (for example, ^icn_[A-Za-z0-9]+$). If the value fails validation, we return an error response instead of calling fetch. This keeps existing functionality for legitimate IDs while preventing arbitrary strings from flowing into the URL. The change is localized to runPlatformScan in apps/app/src/app/(app)/[orgId]/cloud-tests/actions/run-platform-scan.ts and does not require new imports; we just add a small validation block near the top of the function, after the existing session/org checks and before constructing or using apiUrl.

Concretely:

Inside runPlatformScan, after verifying orgId (just after line 32 and before the try block), add a validation step for connectionId using a regular expression for allowed IDs.

If connectionId fails validation, immediately return a structured error object (success: false, error: 'Invalid connection ID') without performing the outbound fetch.

No change is needed to the fetch call itself or any imports.

claudfuen · 2026-02-03T20:38:13Z

🎉 This PR is included in version 1.82.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions bot and others added 2 commits January 30, 2026 17:03

chore: merge release v1.81.0 back to main [skip ci]

7eb584f

github-actions bot added prod-deploy automated-pr labels Jan 30, 2026

vercel bot deployed to staging – app January 30, 2026 18:02 View deployment

cursor bot reviewed Jan 30, 2026

View reviewed changes

apps/app/src/app/(app)/[orgId]/people/page.tsx Show resolved Hide resolved

[dev] [tofikwest] tofik/finding-improvements (#2084)

8d29d88

* feat(api): add revision note handling for findings update * feat(app): update onStatusChange to support async handling in FindingItem --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

mintlify bot deployed to staging - packages/docs January 31, 2026 02:27 View deployment

vercel bot deployed to staging – app January 31, 2026 02:29 View deployment

vercel bot deployed to staging – portal January 31, 2026 02:29 View deployment

cursor bot reviewed Jan 31, 2026

View reviewed changes

mintlify bot deployed to staging - packages/docs February 1, 2026 05:24 View deployment

vercel bot deployed to staging – app February 1, 2026 05:26 View deployment

vercel bot deployed to staging – portal February 1, 2026 05:26 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

[dev] [tofikwest] tofik/handle-specific-error-vercel (#2086)

54b71ee

* fix(trust-portal): improve error handling for custom domain updates * fix(trust-portal): enhance error handling for domain ownership checks --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal February 1, 2026 20:29 Inactive

vercel bot deployed to staging – app February 1, 2026 20:31 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

apps/app/src/app/(app)/[orgId]/policies/[policyId]/editor/components/PolicyDetails.tsx Show resolved Hide resolved

fix: make S2 onboarding phone optional (#2088)

3a37196

vercel bot temporarily deployed to staging – portal February 1, 2026 23:02 Inactive

vercel bot deployed to staging – app February 1, 2026 23:04 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

vercel bot deployed to staging – app February 2, 2026 17:42 View deployment

mintlify bot deployed to staging - packages/docs February 2, 2026 22:19 View deployment

vercel bot had a problem deploying to staging – app February 2, 2026 22:19 Failure

vercel bot deployed to staging – portal February 2, 2026 22:20 View deployment

cursor bot reviewed Feb 2, 2026

View reviewed changes

Marfuen force-pushed the main branch from eaf197e to 3a37196 Compare February 2, 2026 22:27

github-actions bot and others added 2 commits February 3, 2026 10:14

mintlify bot deployed to staging - packages/docs February 3, 2026 15:26 View deployment

cursor bot reviewed Feb 3, 2026

View reviewed changes

apps/api/src/policies/policies.service.ts Show resolved Hide resolved

apps/api/src/policies/policies.service.ts Show resolved Hide resolved

apps/app/src/actions/organization/lib/initialize-organization.ts Show resolved Hide resolved

cursor bot reviewed Feb 3, 2026

View reviewed changes

apps/app/src/actions/policies/update-draft.ts Show resolved Hide resolved

vercel bot temporarily deployed to staging – portal February 3, 2026 16:08 Inactive

vercel bot deployed to staging – app February 3, 2026 16:14 View deployment

github-actions bot and others added 2 commits February 3, 2026 12:06

feat(settings): moved AddSecretDialog to settings header for secrets …

ee568f6

…page to conform with UI pattern (#2098) Co-authored-by: Lewis Carhart <lewis@trycomp.ai>

vercel bot temporarily deployed to staging – portal February 3, 2026 17:09 Inactive

vercel bot temporarily deployed to staging – app February 3, 2026 17:09 Inactive

cursor bot reviewed Feb 3, 2026

View reviewed changes

apps/api/src/trust-portal/trust-access.service.ts Show resolved Hide resolved

vercel bot temporarily deployed to staging – portal February 3, 2026 17:20 Inactive

vercel bot deployed to staging – app February 3, 2026 17:22 View deployment

cursor bot reviewed Feb 3, 2026

View reviewed changes

feat(cloud-security): implement transaction for scan run and results …

0cfbce6

…creation (#2101) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal February 3, 2026 19:38 Inactive

vercel bot deployed to staging – app February 3, 2026 19:40 View deployment

github-advanced-security bot found potential problems Feb 3, 2026

View reviewed changes

tofikwest merged commit 7268e9d into release Feb 3, 2026
12 of 14 checks passed

claudfuen added the released label Feb 3, 2026

@@ -31,6 +31,15 @@
                 };
               }
+              // Validate the IntegrationConnection ID format before using it in the request URL
+              const isValidConnectionId = /^icn_[A-Za-z0-9]+$/.test(connectionId);
+              if (!isValidConnectionId) {
+                return {
+                  success: false,
+                  error: 'Invalid connection ID',
+                };
+              }
               try {
                 // Call the cloud security scan API
                 const apiUrl = process.env.NEXT_PUBLIC_API_URL || process.env.API_URL;

Conversation

github-actions bot commented Jan 30, 2026

Uh oh!

vercel bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

cursor bot Jan 31, 2026

Choose a reason for hiding this comment

Revision dialog closes on API failure, losing user input

Uh oh!

cursor bot Jan 31, 2026

Choose a reason for hiding this comment

Missing explicit type causes incorrect OpenAPI schema

Uh oh!

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicated processContent function and ContentNode interface

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicated S3 PDF copy helper function

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicate S3 helper functions across packages

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot Feb 2, 2026

Choose a reason for hiding this comment

Duplicated getEffectiveData helper in two services

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 3, 2026

Choose a reason for hiding this comment

API missing check for existing pending version

Uh oh!

Uh oh!

Check failure

Uh oh!

Uh oh!

Copilot Autofix

Uh oh!

claudfuen commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel bot commented Jan 30, 2026 •

edited

Loading

CLAassistant commented Jan 30, 2026 •

edited

Loading

cursor bot commented Jan 30, 2026 •

edited

Loading

Duplicated `processContent` function and `ContentNode` interface

Duplicated `getEffectiveData` helper in two services