[dev] [tofikwest] feat/framework-control-link-isolation

[github-actions]

This is an automated pull request to merge feat/framework-control-link-isolation into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Scopes control-to-policy/task/document links by framework and framework instance to prevent cross-framework bleed. Adds scoped link models, framework-aware APIs, and editor support, including document-type linking on control templates.

• New Features

  • Added framework-scoped link tables and instance-scoped equivalents; backfilled from published manifests or legacy links.
  • Controls API supports frameworkInstanceId for fetch/link/unlink; editor link endpoints accept frameworkId for policies, tasks, and document types with enum validation and transactional linking.
  • Manifest builder and framework export now use per-framework links.
  • Versioning sync and rollback track scoped link changes and undo payloads.
  • App and editor UIs pass frameworkInstanceId/frameworkId and fetch scoped control details.

• Migration

  • Run new DB migrations to create link tables and backfill data.
  • Update clients to include frameworkInstanceId when fetching or linking control details in the org app, and frameworkId when linking (including document types) in the framework editor.
  • Regenerate API clients if they rely on openapi.json changes.

^{Written for commit a024822. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	May 13, 2026 4:15pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		May 13, 2026 4:15pm
portal	Skipped		May 13, 2026 4:15pm

[cubic-dev-ai]

6 issues found across 41 files

Confidence score: 2/5

• There are multiple high-confidence, user-impacting issues (severity 7/10) across core API paths, so merge risk is elevated despite being fixable.
• The most severe risk is non-atomic creation in apps/api/src/framework-editor/control-template/control-template.service.ts: a control template can be persisted before replaceDocumentTypeLinks fails, potentially leaving orphaned database records.
• Response-shape and data-correctness regressions are likely: apps/api/src/frameworks/frameworks.service.ts may leak raw relation arrays to clients, and apps/api/src/controls/controls.service.ts may include archived policies/tasks due to a missing archivedAt filter.
• Pay close attention to apps/api/src/framework-editor/control-template/control-template.service.ts, apps/api/src/frameworks/frameworks.service.ts, and apps/api/src/controls/controls.service.ts - they carry data integrity, API contract, and filtering correctness risks.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/framework-editor/control-template/control-template.service.ts">

<violation number="1" location="apps/api/src/framework-editor/control-template/control-template.service.ts:109">
P1: Non-atomic create: if `documentTypes` is provided but `frameworkId` is missing/invalid, the control template is already persisted before `replaceDocumentTypeLinks` throws. This leaves an orphaned record in the database.

Validate `frameworkId` before creating the control template, or wrap both operations in a transaction.</violation>
</file>

<file name="apps/api/src/framework-editor/task-template/task-template.service.ts">

<violation number="1" location="apps/api/src/framework-editor/task-template/task-template.service.ts:107">
P2: Prisma's `findUniqueOrThrow` throws a Prisma-specific error (not an HTTP exception), which will surface as a 500 to the client. Wrap these calls or use `findUnique` + explicit `NotFoundException` to return a proper 404, consistent with the `findById` pattern used for the task template.</violation>
</file>

<file name="apps/api/src/framework-editor/control-template/control-template.controller.ts">

<violation number="1" location="apps/api/src/framework-editor/control-template/control-template.controller.ts:127">
P2: Add `ParseEnumPipe` to validate `formType` at runtime, matching the pattern in `controls.controller.ts`.</violation>
</file>

<file name="apps/api/src/frameworks/frameworks.service.ts">

<violation number="1" location="apps/api/src/frameworks/frameworks.service.ts:188">
P1: Raw `frameworkPolicyLinks` and `frameworkDocumentLinks` arrays leak into the API response. The `...controlData` spread only strips `requirementsMapped`, so the new included relations pass through to consumers alongside the processed `policies` / `controlDocumentTypes` fields.

Strip them in the destructure to avoid exposing internal link-table structure.</violation>
</file>

<file name="apps/api/src/controls/controls.service.ts">

<violation number="1" location="apps/api/src/controls/controls.service.ts:212">
P1: Missing `archivedAt` filter on policies/tasks fetched through framework link tables. Unlike `findOne` which explicitly filters `{ archivedAt: null }`, this query will include archived policies and tasks in the response and progress calculation.</violation>
</file>

<file name="apps/api/src/frameworks/frameworks-source-loader.helper.ts">

<violation number="1" location="apps/api/src/frameworks/frameworks-source-loader.helper.ts:251">
P2: Framework policy/task/document links may be silently dropped if a control has links for a framework but no requirements from that framework in the filtered set. Consider also deriving `frameworkIds` from `frameworkPolicyLinks`, `frameworkTaskLinks`, and `frameworkDocumentLinks` to ensure no framework-specific links are lost.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[tofikwest]

@cubic-dev-ai review it

[cubic-dev-ai]

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 41 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

[claudfuen]

🎉 This PR is included in version 3.52.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀