fix(soa): apply the fully-remote physical-control rule consistently#3397
Conversation
A fully remote organization's physical-security (7.x) controls are Not Applicable. That rule is enforced at generation and the field is edit-locked, but the on-screen SoA and the PDF export did not apply it when no answer was persisted yet — a freshly created SoA could show those controls as Applicable/N/A and disagree between screen and export. Apply the rule identically in resolveSoaDisplay (screen) and in the export, so a fully remote org always sees Not Applicable for physical-security controls everywhere, even before auto-fill has persisted it. Adds tests for both paths.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Confidence score: 5/5
- Safe to merge after the addressed issues were fixed.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
For a fully remote org's edit-locked physical-security (7.x) controls, use the remote rationale unconditionally on both screen and export, rather than falling back to a persisted justification that could be stale (e.g. written before the org went remote) and contradict the Not Applicable status. Tests assert the stale persisted text is overridden on both paths.
|
Fixed in e01fc74 — both paths now use the remote rationale unconditionally for forced-remote 7.x controls. One clarification on the framing: the persisted Tests updated on both paths to assert a stale persisted justification is overridden by the remote rationale (API SoA: 62 passing; app SoA: 13 passing). |
## [3.101.1](v3.101.0...v3.101.1) (2026-07-13) ### Bug Fixes * **soa:** apply the fully-remote physical-control rule consistently ([#3397](#3397)) ([1bde95b](1bde95b))
|
🎉 This PR is included in version 3.101.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
Summary
Follow-up to #3395, addressing the automated review on the merged SoA change.
A fully remote organization's physical-security (7.x) controls are Not Applicable. That rule is enforced at generation time (auto-fill persists
isApplicable = false) and the field is edit-locked — but the on-screen SoA and the PDF export did not apply it when no answer was persisted yet. On a freshly created SoA, those controls could render as Applicable/N/A and disagree between screen and export.This applies the rule identically in both places:
resolveSoaDisplay(screen) forces Not Applicable for fully-remote 7.x controls.exportDocumentapplies the same rule (viacheckIfFullyRemote+isPhysicalSecurityControl).So a fully remote org always sees Not Applicable for physical-security controls everywhere, even before auto-fill has persisted it — screen and PDF stay in agreement.
Changes
soa-display.ts: enforced fully-remote 7.x rule restored (applied consistently, not a display-only override).SOATableRow/SOAMobileRow: passisFullyRemote/isControl7through.soa.service.tsexportDocument: apply the same rule so the PDF matches the screen.On the reviewer's other note (legacy applicability shows N/A)
Documents generated before #3395 don't have a per-answer applicability value, so they show N/A until re-generated. This is intentional: the legacy value isn't reliably recoverable from stored data, so surfacing N/A (and regenerating via Auto-fill) is correct rather than backfilling an unreliable value. This is a one-time data-remediation step handled outside this PR — not a code change.
Testing
apps/api:npx jest src/soa— 62 passing (incl. a new export test asserting fully-remote 7.x is forced Not Applicable).apps/app:npx vitest run .../statement-of-applicability— 13 passing (incl. the fully-remote display case).Summary by cubic
Apply the fully-remote physical-security rule consistently across the SoA UI and PDF: for fully-remote orgs, all 7.x controls are forced to Not Applicable and always show the standard remote justification. Fixes screen/export mismatches on new SoAs and prevents stale or cross-org text in those justifications (partially addresses Linear CS-731).
resolveSoaDisplay;SOATableRow/SOAMobileRownow passisFullyRemoteandisControl7.SOAService.exportDocument, usedcheckIfFullyRemote+isPhysicalSecurityControl; when forced, setisApplicable = falseand used the standard remote rationale for bothanswerandjustification, overriding any persisted text.Written for commit e01fc74. Summary will update on new commits.