[dev] [Marfuen] feat/framework-instance-requirements by github-actions[bot] · Pull Request #2370 · trycompai/comp

github-actions · 2026-03-25T18:43:27Z

This is an automated pull request to merge feat/framework-instance-requirements into dev.
It was created by the [Auto Pull Request] action.

…ents Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Create NestJS module for managing custom framework instance requirements scoped to the customer's organization. Includes full CRUD with org-level authorization via HybridAuthGuard + PermissionGuard. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… enabled Adds advancedModeEnabled prop through page -> Overview -> FrameworksOverview chain. When enabled, framework rows link to their detail page. Otherwise, they remain static. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…detail page Adds RequirementMapWithControl, InstanceRequirementWithMaps, TemplateRequirement, and FrameworkInstanceDetail types. Creates useFrameworkInstance SWR hook for client-side data fetching. Updates detail page to pass instance requirement data to new FrameworkRequirementsList component and adds generateMetadata. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove separate FrameworkRequirementsList - all requirements (template and custom) now appear in the same table without visual distinction. Add Requirement button and delete action for custom requirements.

Use design-system Sheet/Drawer, Field/FieldGroup/FieldLabel/FieldError, SheetBody/SheetFooter components instead of ui/* equivalents.

Update findRequirement API to look up both template and instance requirements, and query RequirementMap by either requirementId or frameworkInstanceRequirementId. Remove isCustom guard on row click.

…ls multi-select on create requirement sheet - Add CreateControlForRequirementSheet to requirement detail page - Update controls API to support frameworkInstanceRequirementId in mappings - Add controlIds field to create requirement API for linking controls - Add controls multi-select dropdown to CreateRequirementSheet

MultipleSelector caches defaultOptions on first render, so we need to wait for the SWR fetch to complete and use a key to force re-mount when controls data arrives.

…00px

Replace @trycompai/ui MultipleSelector with @trycompai/design-system Combobox, ComboboxChips, ComboboxChip, ComboboxContent, ComboboxList, ComboboxItem, ComboboxEmpty components.

Pass controls from the framework instance instead of fetching all org controls. Controls now come from frameworkInstanceWithControls.

- Add DS Combobox multi-selects for tasks and policies in CreateControlForRequirementSheet - Fetch available tasks/policies from controls options API - Switch all buttons and icons to @trycompai/design-system components

- Controls options API now returns both template and custom requirements - CreateControlSheet handles isInstanceRequirement flag to send correct mapping (requirementId vs frameworkInstanceRequirementId) - Updated useControls payload type to support both mapping types

…quirements - Include frameworkInstanceRequirement in controls API includes - Update RequirementsTable to read from either requirement or frameworkInstanceRequirement (whichever is present)

cursor · 2026-03-25T18:43:35Z

PR Summary

Medium Risk
Introduces a new persisted requirement type and API surface, plus a DB migration that relaxes RequirementMap.requirementId nullability and adds new uniqueness constraints; mistakes could break existing mappings or writes. UI now reads/writes both template and custom requirements, so regressions could affect control/requirement linking and navigation.

Overview
Adds custom requirements per framework instance by introducing FrameworkInstanceRequirement in Prisma (with migration), allowing RequirementMap to reference either a template requirement (requirementId) or a custom one (frameworkInstanceRequirementId).

Extends the API to CRUD these custom requirements via new v1/framework-instance-requirements endpoints (guarded by framework permissions), updates FrameworksService and ControlsService to return and accept custom requirements/mappings, and updates the app UI to list/create/delete custom requirements and create controls mapped to either requirement type (including updated navigation/search in requirements tables).

^{Written by Cursor Bugbot for commit 0884244. This will update automatically on new commits. Configure here.}

vercel · 2026-03-25T18:43:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Error		Mar 25, 2026 6:45pm
comp-framework-editor	Ready	Preview, Comment	Mar 25, 2026 6:45pm
portal	Ready	Preview, Comment	Mar 25, 2026 6:45pm

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-25T18:48:57Z

apps/api/src/controls/dto/create-control.dto.ts

+  @IsOptional()
  @IsString()
-  requirementId: string;
+  frameworkInstanceRequirementId?: string;


RequirementMapping allows creating orphaned maps without any requirement

High Severity

RequirementMappingDto makes both requirementId and frameworkInstanceRequirementId optional with no cross-field validation ensuring at least one is provided. The create method uses conditional spreads that silently skip both when neither is present, producing a RequirementMap row that references no requirement at all — an orphaned record that bypasses both @@unique constraints (since NULL ≠ NULL in PostgreSQL unique indexes).

Additional Locations (1)

apps/api/src/controls/controls.service.ts#L217-L229

cursor · 2026-03-25T18:48:57Z

.../src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkRequirements.tsx

+                    >
+                      <TrashCan size={16} />
+                    </Button>
+                  )}


Delete button shown without checking delete permission

Medium Severity

The delete button for custom requirements is rendered based only on item.isCustom, without checking hasPermission('framework', 'delete'). The backend enforces @RequirePermission('framework', 'delete'), so users without that permission see a button that always fails. Other delete UIs in this codebase (e.g., FrameworkOverview) wrap delete actions with hasPermission checks.

mintlify · 2026-03-25T18:54:06Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	Mar 25, 2026, 6:54 PM

Marfuen and others added 25 commits March 24, 2026 16:56

feat: add FrameworkInstanceRequirement schema for custom org requirem…

2c4521f

…ents Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: remove redundant per-method ValidationPipe, rely on global pipe

5195747

feat: include instance requirements in framework detail response

6329294

feat: add custom requirements list and create sheet components

f34aa4d

test: add framework instance requirements service tests

dbd4b84

refactor: merge custom requirements into unified requirements table

29f9aff

Remove separate FrameworkRequirementsList - all requirements (template and custom) now appear in the same table without visual distinction. Add Requirement button and delete action for custom requirements.

refactor: restyle CreateRequirementSheet to match create risk pattern

310aef3

Use design-system Sheet/Drawer, Field/FieldGroup/FieldLabel/FieldError, SheetBody/SheetFooter components instead of ui/* equivalents.

fix: support clicking on custom requirements to view detail page

2bffd2d

Update findRequirement API to look up both template and instance requirements, and query RequirementMap by either requirementId or frameworkInstanceRequirementId. Remove isCustom guard on row click.

fix: render controls multi-select only after data loads

7de8bfa

MultipleSelector caches defaultOptions on first render, so we need to wait for the SWR fetch to complete and use a key to force re-mount when controls data arrives.

fix: cap controls dropdown height at 200px with scroll

fff750c

fix: remove unnecessary className, MultipleSelector already caps at 2…

75fe587

…00px

refactor: use DS Combobox with chips for controls multi-select

a6a43cb

Replace @trycompai/ui MultipleSelector with @trycompai/design-system Combobox, ComboboxChips, ComboboxChip, ComboboxContent, ComboboxList, ComboboxItem, ComboboxEmpty components.

fix: remove ComboboxEmpty that shows incorrectly with manual items

e026914

fix: show only framework controls in add requirement dropdown

f23f182

Pass controls from the framework instance instead of fetching all org controls. Controls now come from frameworkInstanceWithControls.

fix: sort controls alphabetically in add requirement dropdown

f12ee56

feat: add tasks and policies selectors to create control sheet

c5f394c

- Add DS Combobox multi-selects for tasks and policies in CreateControlForRequirementSheet - Fetch available tasks/policies from controls options API - Switch all buttons and icons to @trycompai/design-system components

fix: add Requirements breadcrumb level on requirement detail page

9f8503b

fix: set maxItems=4 on breadcrumbs to prevent collapsing

6b801bc

fix: handle nullable requirement in RequirementsTable for instance re…

a00f832

…quirements - Include frameworkInstanceRequirement in controls API includes - Update RequirementsTable to read from either requirement or frameworkInstanceRequirement (whichever is present)

chore: update migration

0884244

github-actions bot added the automated-pr label Mar 25, 2026

vercel bot deployed to Preview – comp-framework-editor March 25, 2026 18:44 View deployment

vercel bot had a problem deploying to Preview – app March 25, 2026 18:44 Failure

vercel bot deployed to Preview – portal March 25, 2026 18:45 View deployment

cursor bot reviewed Mar 25, 2026

View reviewed changes

mintlify bot deployed to staging - packages/docs March 25, 2026 18:54 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[dev] [Marfuen] feat/framework-instance-requirements#2370

[dev] [Marfuen] feat/framework-instance-requirements#2370
github-actions[bot] wants to merge 25 commits intomainfrom
feat/framework-instance-requirements

github-actions bot commented Mar 25, 2026

Uh oh!

cursor bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Mar 25, 2026

Uh oh!

cursor bot Mar 25, 2026

Uh oh!

mintlify bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

github-actions bot commented Mar 25, 2026

Uh oh!

cursor bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

vercel bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 25, 2026

Choose a reason for hiding this comment

RequirementMapping allows creating orphaned maps without any requirement

Uh oh!

cursor bot Mar 25, 2026

Choose a reason for hiding this comment

Delete button shown without checking delete permission

Uh oh!

mintlify bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor bot commented Mar 25, 2026 •

edited

Loading

vercel bot commented Mar 25, 2026 •

edited

Loading

mintlify bot commented Mar 25, 2026 •

edited

Loading