[dev] [Marfuen] mariano/compliance-timeline-feature by github-actions[bot] · Pull Request #2488 · trycompai/comp

github-actions · 2026-04-08T21:04:46Z

This is an automated pull request to merge mariano/compliance-timeline-feature into dev.
It was created by the [Auto Pull Request] action.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… phase completion Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… lines each Extract lifecycle, phase editing, template management, and template resolution into separate files to comply with the max 300 lines per file rule. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…wagger cleanup - DTOs: activate-timeline, update-phase, create-template, create-phase-template, update-template, update-phase-template with class-validator decorators - Customer controller: GET /timelines, GET /timelines/:id, POST /timelines/:id/phases/:phaseId/ready with Slack webhook notification - Admin template controller: full CRUD for timeline templates and their phases - Admin org timelines controller: activate, pause, resume, phase CRUD, complete - TimelinesModule registered in AppModule with all services and controllers - Added @ApiExcludeController() to all 8 existing admin controllers Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ases on 100% tasks Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… findOne

Add a compliance timeline section above the existing dashboard grid, showing stacked timeline cards with phase bars, status badges, and date summaries. Also updates the Timeline hook types to match the actual API response (DRAFT/ACTIVE/PAUSED/COMPLETED statuses). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add a new admin page for managing timeline templates with CRUD operations. Includes a template list with phase bar previews and a sheet editor for creating/editing templates and their phases. Added sidebar navigation link. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add a Timeline tab to the admin organization detail view showing all timelines for an org. Includes status badges, phase tables, and action buttons for activating (with date picker), pausing, resuming, and editing individual phases via a sheet editor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…irst load

…sk completion data Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… date Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…summary

…GDPR

… phase bar

…ormat

…PLETED) in admin components

…line view

…aser Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…t phase bar

mintlify · 2026-04-08T21:06:05Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	Apr 8, 2026, 9:06 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

cursor · 2026-04-08T21:06:23Z

apps/api/src/timelines/timelines.service.ts

+            data: { status: 'IN_PROGRESS', completedAt: null, completedById: null },
+          });
+          needsRefetch = true;
+        }


Read endpoint mutates phase status causing data corruption

High Severity

The findAllForOrganization method (called by GET /timelines) performs database writes during a read operation. When a completed phase's metric drops below 100%, it reverts the phase to IN_PROGRESS but bypasses TimelinesLifecycleService.completePhase logic — it doesn't check if the timeline itself is COMPLETED, doesn't update the timeline status back from COMPLETED, and doesn't re-advance subsequent phases. This can leave a COMPLETED timeline with an IN_PROGRESS phase, creating an inconsistent state. Every time a customer lists their timelines, phases may flip-flop between completed and in-progress.

Additional Locations (1)

apps/api/src/timelines/timelines.service.ts#L78-L90

^{Reviewed by Cursor Bugbot for commit 31dbc40. Configure here.}

apps/api/src/frameworks/frameworks-timeline.helper.ts

…t for past cycles

…lip is attached

…, Text, Stack)

…exist

… not internal ID

…leting phases

…t overwrite them

…future dates

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

There are 4 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3aced7e. Configure here.}

cursor · 2026-04-10T15:54:44Z

apps/api/src/timelines/timelines.service.ts

+    }
+
+    return timelines;
+  }


Read endpoint performs writes causing side effects

Medium Severity

findAllForOrganization is called from a GET endpoint but performs database writes (backfilling timelines via ensureTimelinesExist, completing phases, reverting phases). This violates the principle that read operations are idempotent. Concurrent GET requests can race on phase status updates, and each call triggers getOverviewScores (an expensive multi-query operation) plus potential completePhase calls with Slack notifications — all on every list request.

^{Reviewed by Cursor Bugbot for commit 3aced7e. Configure here.}

cursor · 2026-04-10T15:54:44Z

apps/api/src/tasks/tasks.service.ts

+          organizationId,
+          timelinesService: this.timelinesService,
+        }).catch(() => {});
+      }


Auto-complete not triggered for not_relevant task status

Medium Severity

checkAutoCompletePhases in frameworks-timeline.helper.ts considers tasks with status done OR not_relevant as completed when evaluating whether all tasks are finished. However, the trigger in tasks.service.ts only calls checkAutoCompletePhases when status === TaskStatus.done, not when tasks are set to not_relevant. If the last remaining incomplete task is marked not_relevant, the auto-completion check never fires and the timeline phase stays IN_PROGRESS indefinitely.

Additional Locations (1)

apps/api/src/tasks/tasks.service.ts#L696-L702

^{Reviewed by Cursor Bugbot for commit 3aced7e. Configure here.}

cursor · 2026-04-10T15:54:44Z

apps/api/src/timelines/timelines-slack.helper.ts

+
+const logger = new Logger('TimelinesSlack');
+
+const WEBHOOK_URL = process.env.SLACK_CX_WEBHOOK_URL;


Slack webhook URL captured at module load time

Low Severity

WEBHOOK_URL is read from process.env.SLACK_CX_WEBHOOK_URL at module load time as a top-level constant. According to main.ts, .env files are loaded manually before NestJS starts, but if the module is imported before env loading completes (or the env var is set dynamically), the value will be permanently undefined and all Slack notifications will silently fail for the lifetime of the process.

^{Reviewed by Cursor Bugbot for commit 3aced7e. Configure here.}

Marfuen and others added 30 commits April 7, 2026 15:30

feat(db): add timeline models and enums for compliance timeline feature

5fb026e

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(api): add default timeline template definitions as code constants

30b1845

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(api): add timeline date recalculation helper with tests

dfd5a79

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(api): add timelines service with CRUD, activation, pause/resume,…

d97509d

… phase completion Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(api): auto-create timeline on framework add and auto-complete ph…

03f1859

…ases on 100% tasks Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(app): add SWR hooks for timelines and admin timeline management

c16b176

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat(app): add reusable TimelinePhaseBar component

703ffe6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: add generated prisma to gitignore and add completedBy include to…

36cab56

… findOne

feat(app): add expanded timeline view to framework detail page

a5e2511

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(api): auto-create timelines for existing framework instances on f…

ec851da

…irst load

fix(api): fix type error in date helper tests

cd7ba20

feat(api): smart timeline backfill using trust status, scores, and ta…

343768b

…sk completion data Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(app): use design system tokens, remove outer card, add next cycle…

12ea2a7

… date Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(app): improve phase bar with progress indicator and add timeline …

e7694dc

…summary

fix(api): use 'Attestation' instead of 'Certification' for HIPAA and …

e9f9459

…GDPR

feat: separate SOC 2 Type 1 and Type 2 timelines, add date markers to…

c5c9ff8

… phase bar

fix: replace em dashes with hyphens in template names

c8ea360

fix(api): wrap admin timeline endpoints in { data, count } response f…

2843d84

…ormat

fix(app): use correct timeline status values (DRAFT/ACTIVE/PAUSED/COM…

da8d20a

…PLETED) in admin components

fix(app): fix missing closing brace in TimelineCard

649c211

fix(app): replace table layout with stacked phase cards in admin time…

c91d69b

…line view

feat(app): add tabs to Overview page with Timeline tab and compact te…

6e4fc58

…aser Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(app): simplify timeline teaser to clean single-line banner withou…

32301c1

…t phase bar

fix(app): remove timeline teaser from Overview tab

3e9bf2b

fix(app): remove redundant header and summary from Timeline tab

2fa6761

vercel bot had a problem deploying to Preview – app April 8, 2026 21:05 Failure

vercel bot deployed to Preview – portal April 8, 2026 21:06 View deployment

cursor bot reviewed Apr 8, 2026

View reviewed changes

mintlify bot deployed to staging - packages/docs April 8, 2026 21:06 View deployment

Marfuen added 18 commits April 9, 2026 09:26

feat: add Start Next Cycle action for completed timelines (admin only)

a93ee64

fix(app): use render prop on AlertDialogTrigger to avoid nested buttons

bb23b9f

fix(app): destructure onStartNextCycle from TimelineActions props

6ea12a5

feat(app): group timeline cycles by framework with stacked card effec…

40b7708

…t for past cycles

fix(app): fix stacked card effect to show behind the main card

55c3e54

fix(app): stacked card effect as thin strips peeking below main card

3256d0a

fix(app): simple lip button below card for showing previous cycles

0b92fda

fix(app): remove bottom border radius from card when previous cycles …

6a1f392

…lip is attached

fix(app): subtle muted background on previous cycles lip

dbbbb99

fix(app): reduce lip padding and font size for sleeker look

3f4fd05

refactor(app): migrate TimelineOverview to DS components (Card, Badge…

b94fae2

…, Text, Stack)

fix(app): improve timeline card padding, title size, and spacing

a78c433

fix(app): remove bg from previous cycles lip, only show on hover

025d2c6

fix(app): remove lip, show cycle badge (Year 2) when multiple cycles …

b88f6ac

…exist

fix(app): show Year badge on all timelines, computed from cycle count…

89075be

… not internal ID

fix(api): always use now() for completedAt and endDate when auto-comp…

f340da8

…leting phases

fix(api): pin phase dates on early completion so recalculation doesn'…

47f38af

…t overwrite them

fix(api): use min(endDate, now) for completedAt in backfill to avoid …

278c36d

…future dates

vercel bot temporarily deployed to Preview – portal April 10, 2026 15:52 Inactive

chore: update OpenAPI spec with timeline endpoints

3aced7e

vercel bot temporarily deployed to Preview – portal April 10, 2026 15:52 Inactive

vercel bot temporarily deployed to Preview – app April 10, 2026 15:52 Inactive

vercel bot deployed to Preview – comp-framework-editor April 10, 2026 15:53 View deployment

mintlify bot deployed to staging - packages/docs April 10, 2026 15:53 View deployment

cursor bot reviewed Apr 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[dev] [Marfuen] mariano/compliance-timeline-feature#2488

[dev] [Marfuen] mariano/compliance-timeline-feature#2488
github-actions[bot] wants to merge 110 commits intomainfrom
mariano/compliance-timeline-feature

github-actions bot commented Apr 8, 2026

Uh oh!

mintlify bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

cursor bot Apr 8, 2026

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Apr 10, 2026

Uh oh!

cursor bot Apr 10, 2026

Uh oh!

cursor bot Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant


		const logger = new Logger('TimelinesSlack');

		const WEBHOOK_URL = process.env.SLACK_CX_WEBHOOK_URL;

Conversation

github-actions bot commented Apr 8, 2026

Uh oh!

mintlify bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Apr 8, 2026

Choose a reason for hiding this comment

Read endpoint mutates phase status causing data corruption

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Apr 10, 2026

Choose a reason for hiding this comment

Read endpoint performs writes causing side effects

Uh oh!

cursor bot Apr 10, 2026

Choose a reason for hiding this comment

Auto-complete not triggered for not_relevant task status

Uh oh!

cursor bot Apr 10, 2026

Choose a reason for hiding this comment

Slack webhook URL captured at module load time

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mintlify bot commented Apr 8, 2026 •

edited

Loading