[comp] Production Deploy #2083

github-actions · 2026-01-30T18:00:47Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

…2079) * feat(app): add 'Remove Device' menu on Employ Devices tab * feat(api): create delete endpoint to remove single host from fleet * feat(app): integrate delete endpoint to remove the host * fix(api): missing host ownership validation allows cross-organization deletion * fix(app): redundant null check after early return guard on handleRemoveDeviceClick * fix(api): duplicated host deletion logic not consolidated on fleet.service * fix(app): remove unnecessary accessorKey on actions column * fix(app): remove duplicated database query for current user member --------- Co-authored-by: chasprowebdev <chasgarciaprowebdev@gmail.com>

vercel · 2026-01-30T18:00:52Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Feb 1, 2026 11:04pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		Feb 1, 2026 11:04pm

CLAassistant · 2026-01-30T18:00:54Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ tofikwest
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cursor · 2026-01-30T18:00:55Z

PR Summary

High Risk
High risk because it adds new policy/version lifecycle APIs, modifies publish/approval behavior (including signature resets), and introduces bulk migrations plus S3 copy/delete paths that can affect persisted data and stored documents.

Overview
Policy versioning is added end-to-end. The API now supports listing/creating/updating/deleting policy versions, publishing versions, setting an active version, and submitting a version for approval, with policy reads and AI chat using currentVersion content when present.

Publishing/approval flows are updated to be version-aware. Draft edits are stored separately (draftContent), approvals can promote a pendingVersionId to currentVersionId, and policy PDF handling (upload/get/delete/download) is extended to target specific versions while preventing edits to active/pending versions.

Storage + data migration changes. Policy creation now creates version 1 transactionally; deleting a policy/version cleans up associated S3 PDFs (including version PDFs); Trigger tasks are added to bulk-migrate legacy policies without versions; trust portal PDF bundling and vector-store sync now prefer version content.

Other changes. Findings updates gain revisionNote that is set/cleared based on status, and People adds an owner-only endpoint/UI to remove a single FleetDM host (plus Fleet service helper).

^{Written by Cursor Bugbot for commit 3a37196. This will update automatically on new commits. Configure here.}

apps/app/src/app/(app)/[orgId]/people/page.tsx

* feat(api): add revision note handling for findings update * feat(app): update onStatusChange to support async handling in FindingItem --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingItem.tsx

cursor · 2026-01-31T02:39:48Z

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingItem.tsx

+    } finally {
+      setIsSubmitting(false);
+    }
+  };


Revision dialog closes on API failure, losing user input

Medium Severity

The handleRevisionSubmit and handleRevisionSkip functions expect onStatusChange to throw on API failure so the dialog remains open for retry. However, handleStatusChange (the implementation of onStatusChange) catches errors internally and shows a toast but doesn't re-throw. This causes await onStatusChange(...) to always resolve successfully, so the dialog closes and the user's typed revision note is cleared even when the API call fails. The user sees an error toast but loses their input.

Additional Locations (1)

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/FindingsList.tsx#L102-L105

cursor · 2026-01-31T02:39:49Z

apps/api/src/findings/dto/update-finding.dto.ts

+  @IsString()
+  @IsOptional()
+  @MaxLength(2000)
+  revisionNote?: string | null;


Missing explicit type causes incorrect OpenAPI schema

Low Severity

The @ApiProperty decorator for revisionNote is missing an explicit type: String specification. Combined with nullable: true and TypeScript type string | null, this causes NestJS Swagger to generate "type": "object" in the OpenAPI spec instead of "type": "string". Add type: String to the decorator options.

* feat(api): add policy versioning with create, update, delete, and fetch operations * fix(api): update approver handling and current version assignment in policy changes * feat(api): enhance deleteById to clean up PDFs from S3 before deletion * feat(api): update policy version creation to handle S3 copy after transaction * feat(api): clear pending approval state when publishing or activating versions * feat(api): include organizationId check to prevent cross-org access in PDF URL retrieval * feat(api): sync draft content to prevent unpublished changes UI bug * feat(api): prevent activating a different version when another is pending approval * feat(api): add validation for deactivated members as approvers * feat(api): clear signatures when publishing or activating policy versions * feat(api): sync draft content to prevent false unpublished changes indicator * feat(api): use transaction for atomic policy updates and sync draft content --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

cursor · 2026-02-01T05:33:33Z

apps/app/src/app/(app)/[orgId]/policies/[policyId]/components/PolicyPageTabs.tsx

+                  }
+                  return [];
+                })()
+              }


Editor loads published content instead of draft content

Medium Severity

The policyContent prop passed to PolicyContentManager loads from currentVersion.content or policy.content, but never from policy.draftContent. Meanwhile, hasDraftChanges correctly compares draftContent vs content to detect unpublished changes. This mismatch means when a user has draft changes (saved to draftContent), the editor will show the published version content instead of their draft. The "unpublished changes" indicator will appear, but the actual draft content won't be displayed or editable, potentially causing users to overwrite their draft work.

cursor · 2026-02-01T05:33:33Z

apps/app/src/actions/policies/update-draft.ts

+  }
+
+  return processed;
+}


Duplicated processContent function and ContentNode interface

Medium Severity

The ContentNode interface and processContent function are duplicated in both update-draft.ts and update-version-content.ts. These are nearly identical implementations that sanitize TipTap editor content. Extract to a shared utility like apps/app/src/actions/policies/lib/content-utils.ts.

cursor · 2026-02-01T05:33:33Z

apps/app/src/actions/policies/create-version.ts

+    console.error('Error copying policy PDF:', error);
+    return null;
+  }
+}


Duplicated S3 PDF copy helper function

Low Severity

The copyPolicyVersionPdf function duplicates the logic in AttachmentsService.copyPolicyVersionPdf (apps/api/src/attachments/attachments.service.ts lines 341-358). Consider extracting to a shared S3 utility module or creating a reusable pattern.

cursor · 2026-02-01T05:33:33Z

apps/app/src/actions/policies/delete-version.ts

+  } catch (error) {
+    console.error('Error deleting policy PDF:', error);
+  }
+}


Duplicated S3 PDF delete helper function

Low Severity

The deletePolicyVersionPdf function duplicates the logic in AttachmentsService.deletePolicyVersionPdf (apps/api/src/attachments/attachments.service.ts lines 363-374). Consider extracting to a shared S3 utility module.

* fix(trust-portal): improve error handling for custom domain updates * fix(trust-portal): enhance error handling for domain ownership checks --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

apps/app/src/app/(app)/[orgId]/policies/[policyId]/editor/components/PolicyDetails.tsx

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-01T23:13:14Z

apps/app/src/actions/policies/delete-policy.ts

+        );
+      }
+
+      // Delete the policy (versions are cascade deleted)


S3 deletion before database update causes inconsistent state on failure

Medium Severity

S3 PDF files are deleted before the database operation (delete or transaction). If the database operation fails after S3 deletion succeeds, the policy versions will reference non-existent S3 files, causing broken PDF links for users. The S3 cleanup should occur after the database operation succeeds to maintain data consistency. This affects policy deletion and policy regeneration flows.

Additional Locations (2)

apps/app/src/trigger/tasks/onboarding/update-policies-helpers.ts#L527-L592

apps/api/src/policies/policies.service.ts#L316-L343

cursor · 2026-02-01T23:13:14Z

apps/app/src/actions/policies/migrate-policies-to-versioning.ts

+  });
+
+  return version.id;
+}


Unused exported function ensurePolicyHasVersion

Low Severity

The ensurePolicyHasVersion utility function is exported but never imported or used anywhere in the codebase. The comment states it "Can be called from other server actions or components when needed" but no callers exist.

cursor · 2026-02-01T23:13:14Z

apps/app/src/actions/policies/create-version.ts

+    console.error('Error copying policy PDF:', error);
+    return null;
+  }
+}


Duplicate S3 helper functions across packages

Low Severity

copyPolicyVersionPdf in create-version.ts and deletePolicyVersionPdf in delete-version.ts duplicate functionality that already exists in AttachmentsService (attachments.service.ts lines 341-374). Consider creating a shared S3 utility in the app package or calling the API endpoints.

github-actions bot and others added 2 commits January 30, 2026 17:03

chore: merge release v1.81.0 back to main [skip ci]

7eb584f

github-actions bot added prod-deploy automated-pr labels Jan 30, 2026

vercel bot deployed to staging – app January 30, 2026 18:02 View deployment

cursor bot reviewed Jan 30, 2026

View reviewed changes

apps/app/src/app/(app)/[orgId]/people/page.tsx Show resolved Hide resolved

[dev] [tofikwest] tofik/finding-improvements (#2084)

8d29d88

* feat(api): add revision note handling for findings update * feat(app): update onStatusChange to support async handling in FindingItem --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

mintlify bot deployed to staging - packages/docs January 31, 2026 02:27 View deployment

vercel bot deployed to staging – app January 31, 2026 02:29 View deployment

vercel bot deployed to staging – portal January 31, 2026 02:29 View deployment

cursor bot reviewed Jan 31, 2026

View reviewed changes

mintlify bot deployed to staging - packages/docs February 1, 2026 05:24 View deployment

vercel bot deployed to staging – app February 1, 2026 05:26 View deployment

vercel bot deployed to staging – portal February 1, 2026 05:26 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

[dev] [tofikwest] tofik/handle-specific-error-vercel (#2086)

54b71ee

* fix(trust-portal): improve error handling for custom domain updates * fix(trust-portal): enhance error handling for domain ownership checks --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal February 1, 2026 20:29 Inactive

vercel bot deployed to staging – app February 1, 2026 20:31 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

apps/app/src/app/(app)/[orgId]/policies/[policyId]/editor/components/PolicyDetails.tsx Show resolved Hide resolved

fix: make S2 onboarding phone optional (#2088)

3a37196

vercel bot temporarily deployed to staging – portal February 1, 2026 23:02 Inactive

vercel bot deployed to staging – app February 1, 2026 23:04 View deployment

cursor bot reviewed Feb 1, 2026

View reviewed changes

[comp] Production Deploy #2083

Are you sure you want to change the base?

[comp] Production Deploy #2083

Uh oh!

Conversation

github-actions bot commented Jan 30, 2026

Uh oh!

vercel bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

cursor bot Jan 31, 2026

Choose a reason for hiding this comment

Revision dialog closes on API failure, losing user input

Uh oh!

cursor bot Jan 31, 2026

Choose a reason for hiding this comment

Missing explicit type causes incorrect OpenAPI schema

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Editor loads published content instead of draft content

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicated processContent function and ContentNode interface

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicated S3 PDF copy helper function

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicated S3 PDF delete helper function

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

S3 deletion before database update causes inconsistent state on failure

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Unused exported function ensurePolicyHasVersion

Uh oh!

cursor bot Feb 1, 2026

Choose a reason for hiding this comment

Duplicate S3 helper functions across packages

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Jan 30, 2026 •

edited

Loading

CLAassistant commented Jan 30, 2026 •

edited

Loading

cursor bot commented Jan 30, 2026 •

edited

Loading

Duplicated `processContent` function and `ContentNode` interface

Unused exported function `ensurePolicyHasVersion`