[dev] [Marfuen] mariano/auto-publish-trust-portal by github-actions[bot] · Pull Request #2964 · trycompai/comp

github-actions · 2026-05-29T16:04:08Z

This is an automated pull request to merge mariano/auto-publish-trust-portal into dev.
It was created by the [Auto Pull Request] action.

- Shared client-injected ensureTrustForOrganization (@trycompai/db/trust): idempotent, never rewrites an existing friendlyUrl, never republishes a drafted portal, P2002-safe. - Eager creation in both org-creation server actions (non-fatal so creation never breaks). - Integration tests for the helper (create / idempotent / no-rewrite / draft-safe / collision).

vercel · 2026-05-29T16:04:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 29, 2026 4:48pm
comp-framework-editor	Ready	Preview, Comment	May 29, 2026 4:48pm
portal	Ready	Preview, Comment	May 29, 2026 4:48pm

cubic-dev-ai

3 issues found across 5 files

Confidence score: 2/5

There is a high-confidence runtime packaging risk in packages/db/package.json: export fields point to ./src/trust/ensure-friendly-url.ts while src/ is not shipped, which is likely to break consumers at runtime.
Both setup actions (apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts and apps/app/src/app/(app)/setup/actions/create-organization.ts) perform trust-portal mutations directly, bypassing the API RBAC/PermissionGuard boundary and creating a concrete authorization regression risk.
Given one severe runtime breakage risk (9/10) plus two medium-high security/authorization boundary issues (7/10), this is not yet a safe merge without fixes.
Pay close attention to packages/db/package.json, apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts, apps/app/src/app/(app)/setup/actions/create-organization.ts - fix package exports to compiled output and route trust mutations through guarded API paths.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts">

<violation number="1" location="apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts:101">
P1: This introduces direct trust-portal mutation in the app server action, bypassing API RBAC/PermissionGuard enforcement. Route this through an API endpoint/service guarded by permissions instead of calling DB trust helpers from `apps/app`.

(Based on your team's feedback about using RBAC permission checks through the API instead of app-side role gates.) [FEEDBACK_USED]</violation>
</file>

<file name="apps/app/src/app/(app)/setup/actions/create-organization.ts">

<violation number="1" location="apps/app/src/app/(app)/setup/actions/create-organization.ts:86">
P1: This new trust-portal mutation is performed directly in the app action (`ensureTrustForOrganization`) instead of via an API endpoint with RBAC guards, which bypasses the project’s authorization boundary.

(Based on your team's feedback about using RBAC permission checks instead of non-API authorization paths.) [FEEDBACK_USED]</violation>
</file>

<file name="packages/db/package.json">

<violation number="1" location="packages/db/package.json:35">
P0: Runtime export points to TypeScript source file instead of compiled JS output. The `import` and `default` fields reference `./src/trust/ensure-friendly-url.ts`, but `src/` is not included in the package's `files` array, and all other exports consistently use `./dist/*.js` for runtime resolution. This will break when the package is published to npm and when consumed by standard Node.js or bundler setups that cannot import `.ts` files from `node_modules`. Follow the established pattern: point `import` and `default` to the compiled `./dist/trust/ensure-friendly-url.js`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai · 2026-05-29T16:15:04Z

+        },
+        "./trust": {
+            "types": "./src/trust/ensure-friendly-url.ts",
+            "import": "./src/trust/ensure-friendly-url.ts",


P0: Runtime export points to TypeScript source file instead of compiled JS output. The import and default fields reference ./src/trust/ensure-friendly-url.ts, but src/ is not included in the package's files array, and all other exports consistently use ./dist/*.js for runtime resolution. This will break when the package is published to npm and when consumed by standard Node.js or bundler setups that cannot import .ts files from node_modules. Follow the established pattern: point import and default to the compiled ./dist/trust/ensure-friendly-url.js.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/package.json, line 35: <comment>Runtime export points to TypeScript source file instead of compiled JS output. The `import` and `default` fields reference `./src/trust/ensure-friendly-url.ts`, but `src/` is not included in the package's `files` array, and all other exports consistently use `./dist/*.js` for runtime resolution. This will break when the package is published to npm and when consumed by standard Node.js or bundler setups that cannot import `.ts` files from `node_modules`. Follow the established pattern: point `import` and `default` to the compiled `./dist/trust/ensure-friendly-url.js`.</comment> <file context> @@ -29,6 +29,11 @@ + }, + "./trust": { + "types": "./src/trust/ensure-friendly-url.ts", + "import": "./src/trust/ensure-friendly-url.ts", + "default": "./src/trust/ensure-friendly-url.ts" } </file context>

cubic-dev-ai · 2026-05-29T16:15:04Z


+        // Ensure the trust portal exists for the reused org too (non-fatal).
+        try {
+          await ensureTrustForOrganization({


P1: This introduces direct trust-portal mutation in the app server action, bypassing API RBAC/PermissionGuard enforcement. Route this through an API endpoint/service guarded by permissions instead of calling DB trust helpers from apps/app.

(Based on your team's feedback about using RBAC permission checks through the API instead of app-side role gates.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts, line 101: <comment>This introduces direct trust-portal mutation in the app server action, bypassing API RBAC/PermissionGuard enforcement. Route this through an API endpoint/service guarded by permissions instead of calling DB trust helpers from `apps/app`. (Based on your team's feedback about using RBAC permission checks through the API instead of app-side role gates.) </comment> <file context> @@ -95,6 +96,17 @@ export const createOrganizationMinimal = authActionClientWithoutOrg + // Ensure the trust portal exists for the reused org too (non-fatal). + try { + await ensureTrustForOrganization({ + db, + organizationId: existingOrg.id, </file context>

cubic-dev-ai · 2026-05-29T16:15:04Z

+      // Auto-publish the trust portal so trust.inc/{slug} is live immediately,
+      // even while empty. Non-fatal: onboarding + job triggers must still run.
+      try {
+        await ensureTrustForOrganization({


P1: This new trust-portal mutation is performed directly in the app action (ensureTrustForOrganization) instead of via an API endpoint with RBAC guards, which bypasses the project’s authorization boundary.

(Based on your team's feedback about using RBAC permission checks instead of non-API authorization paths.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/setup/actions/create-organization.ts, line 86: <comment>This new trust-portal mutation is performed directly in the app action (`ensureTrustForOrganization`) instead of via an API endpoint with RBAC guards, which bypasses the project’s authorization boundary. (Based on your team's feedback about using RBAC permission checks instead of non-API authorization paths.) </comment> <file context> @@ -79,6 +80,18 @@ export const createOrganization = authActionClientWithoutOrg + // Auto-publish the trust portal so trust.inc/{slug} is live immediately, + // even while empty. Non-fatal: onboarding + job triggers must still run. + try { + await ensureTrustForOrganization({ + db, + organizationId: orgId, </file context>

Addresses cubic review on #2964: - Drop the @trycompai/db/trust helper + package export (P0: ran from .ts source). - Org-creation actions now warm GET /v1/trust-portal/settings after setActiveOrganization, which lazily creates a published Trust row (slug) through HybridAuthGuard + trust:read — no direct app-side db mutation (P1).

Marfuen · 2026-05-29T16:18:32Z

@cubic-dev-ai please re-review this

cubic-dev-ai · 2026-05-29T16:18:41Z

@cubic-dev-ai please re-review this

@Marfuen I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

2 issues found across 2 files

Confidence score: 3/5

There is a concrete error-handling gap in apps/app/src/app/(app)/setup/actions/create-organization.ts: serverApi.get returns { error, status } instead of throwing, so non-2xx trust-portal publish failures can slip past the try/catch without being logged or handled.
A similar pattern in apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts means failed publish attempts are also not surfaced, which increases regression risk in setup flows if downstream steps assume success.
Score is 3 because these are medium-severity, high-confidence findings with user-impact potential, but they appear targeted and should be straightforward to fix by checking returned error states explicitly.
Pay close attention to apps/app/src/app/(app)/setup/actions/create-organization.ts and apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts - trust-portal publish failures are not currently detected via the existing try/catch logic.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts">

<violation number="1" location="apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts:101">
P1: This introduces direct trust-portal mutation in the app server action, bypassing API RBAC/PermissionGuard enforcement. Route this through an API endpoint/service guarded by permissions instead of calling DB trust helpers from `apps/app`.

(Based on your team's feedback about using RBAC permission checks through the API instead of app-side role gates.) [FEEDBACK_USED]</violation>
</file>

<file name="apps/app/src/app/(app)/setup/actions/create-organization.ts">

<violation number="1" location="apps/app/src/app/(app)/setup/actions/create-organization.ts:86">
P1: This new trust-portal mutation is performed directly in the app action (`ensureTrustForOrganization`) instead of via an API endpoint with RBAC guards, which bypasses the project’s authorization boundary.

(Based on your team's feedback about using RBAC permission checks instead of non-API authorization paths.) [FEEDBACK_USED]</violation>
</file>

<file name="packages/db/package.json">

<violation number="1" location="packages/db/package.json:35">
P0: Runtime export points to TypeScript source file instead of compiled JS output. The `import` and `default` fields reference `./src/trust/ensure-friendly-url.ts`, but `src/` is not included in the package's `files` array, and all other exports consistently use `./dist/*.js` for runtime resolution. This will break when the package is published to npm and when consumed by standard Node.js or bundler setups that cannot import `.ts` files from `node_modules`. Follow the established pattern: point `import` and `default` to the compiled `./dist/trust/ensure-friendly-url.js`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

… field Addresses cubic: serverApi.get returns { error } instead of throwing, so the try/catch swallowed non-2xx failures. Check response.error explicitly (non-fatal).

Marfuen · 2026-05-29T16:35:03Z

@cubic-dev-ai please re-review this

cubic-dev-ai · 2026-05-29T16:35:13Z

@cubic-dev-ai please re-review this

@Marfuen I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

claudfuen · 2026-05-29T18:51:10Z

🎉 This PR is included in version 3.66.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions Bot added the automated-pr label May 29, 2026

vercel Bot deployed to Preview – comp-framework-editor May 29, 2026 16:05 View deployment

vercel Bot deployed to Preview – portal May 29, 2026 16:06 View deployment

vercel Bot deployed to Preview – app May 29, 2026 16:07 View deployment

cubic-dev-ai Bot reviewed May 29, 2026

View reviewed changes

vercel Bot deployed to Preview – comp-framework-editor May 29, 2026 16:19 View deployment

vercel Bot deployed to Preview – app May 29, 2026 16:21 View deployment

vercel Bot deployed to Preview – portal May 29, 2026 16:21 View deployment

cubic-dev-ai Bot reviewed May 29, 2026

View reviewed changes

Comment thread apps/app/src/app/(app)/setup/actions/create-organization-minimal.ts Outdated

Comment thread apps/app/src/app/(app)/setup/actions/create-organization.ts Outdated

fix(trust): surface trust-portal publish failures via serverApi error…

8fc9d79

… field Addresses cubic: serverApi.get returns { error } instead of throwing, so the try/catch swallowed non-2xx failures. Check response.error explicitly (non-fatal).

vercel Bot temporarily deployed to Preview – portal May 29, 2026 16:35 Inactive

cubic-dev-ai Bot reviewed May 29, 2026

View reviewed changes

vercel Bot deployed to Preview – comp-framework-editor May 29, 2026 16:36 View deployment

vercel Bot deployed to Preview – app May 29, 2026 16:38 View deployment

Merge branch 'main' into mariano/auto-publish-trust-portal

07e074c

Marfuen merged commit e55fbfd into main May 29, 2026
8 of 11 checks passed

Marfuen deleted the mariano/auto-publish-trust-portal branch May 29, 2026 16:47

vercel Bot deployed to Preview – portal May 29, 2026 16:47 View deployment

vercel Bot deployed to Preview – app May 29, 2026 16:47 View deployment

vercel Bot deployed to Preview – comp-framework-editor May 29, 2026 16:48 View deployment

claudfuen added the released label May 29, 2026

Conversation

github-actions Bot commented May 29, 2026

Uh oh!

vercel Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Marfuen commented May 29, 2026

Uh oh!

cubic-dev-ai Bot commented May 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Marfuen commented May 29, 2026

Uh oh!

cubic-dev-ai Bot commented May 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claudfuen commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented May 29, 2026 •

edited

Loading

cubic-dev-ai Bot May 29, 2026 •

edited

Loading

cubic-dev-ai Bot May 29, 2026 •

edited

Loading

cubic-dev-ai Bot May 29, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading