[dev] [tofikwest] tofik/fix-bugs

[github-actions]

This is an automated pull request to merge tofik/fix-bugs into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
app	Ready	Preview, Comment	Dec 23, 2025 11:14pm
portal	Ready	Preview, Comment	Dec 23, 2025 11:14pm

[cursor]

PR Summary

Adds a complete task item layer and vendor automation, plus auth/notification and UI updates.

• Task Management (API): New task-management module with CRUD, pagination/stats, activity log, and attachments (S3 path for task_item, size limit 60MB)
• RBAC & Auth: userRoles propagated, RequireRoles guard for endpoints, InternalTokenGuard for internal routes; HybridAuth now sets userRoles
• Notifications: Novu integration (NovuService, NOVU_API_KEY) and new email templates for task assignments/mentions and comment mentions; comments now notify mentioned users (email + Novu)
• Vendors Automation: Trigger.dev tasks to create "Risk Assessment" task items per vendor with optional Firecrawl research; batch backfill task and internal controller to trigger batches; vendor creation now triggers assessment task
• App (UI/Flows): Vendor/Risk pages now show task items with deep-linking; “Tasks” relabeled to “Evidence” in UI; onboarding switches active org and uses hard navigations; email preferences add taskMentions and taskAssignments (settings + unsubscribe)
• Infra/Build: Dockerfile includes packages/email; .env.example adds NOVU_API_KEY/INTERNAL_API_TOKEN; tsconfig path mappings for email package

^{Written by Cursor Bugbot for commit 9bcc9de. This will update automatically on new commits. Configure here.}

[graphite-app]

Graphite Automations

"Auto-assign PRs to Author" took an action on this PR • (12/23/25)

1 reviewer was added to this PR based on Mariano Fuentes's automation.

[cursor]

Task update notifies all mentions instead of new ones

When updating a task item's description, the code notifies ALL mentioned users every time, rather than only newly added mentions. This differs from comments.service.ts which correctly filters to only notify newlyMentionedUserIds by comparing previous and current mentions. The existingTaskItem with the original description is available in scope but unused. This will cause notification spam when users make minor edits (like fixing typos) to task descriptions that contain mentions.