fix(api,app): unblock onboarding frameworks list for users without active org

[tofikwest]

Summary

Fresh signups hitting the first onboarding step ("Which compliance frameworks do you need?") have been seeing an empty screen with a disabled Continue button. Customer Daniel Cooke reported a 500 on https://api.trycomp.ai/v1/frameworks/available, and I reproduced it in incognito with a brand-new email.

Root cause

• 2026-04-17 (commit a81af3efb7) — The /v1/frameworks/available endpoint's signature was changed from findAvailable() to findAvailable(@OrganizationId() organizationId?: string) so custom frameworks could be scoped per-org.
• @OrganizationId() throws a plain Error when request.organizationId is falsy.
• @SkipOrgCheck() (already on this endpoint) correctly allows session-auth'd users with no active org through — HybridAuthGuard sets request.organizationId = '' in that case.
• Empty string is falsy → @OrganizationId() throws → NestJS converts the generic Error to HTTP 500.
• The ?: string in the signature shows the intent was optional, but the decorator didn't honor it — that contract isn't visible in the decorator's type signature.
• Audited every other @SkipOrgCheck() endpoint in the API; this was the only one combining it with @OrganizationId().

The failure was invisible for 4 days because FrameworkSelection.tsx silently swallowed HTTP errors in its SWR fetcher — a 500 looked identical to "no frameworks available."

Changes

• Add @OrganizationIdOptional() in apps/api/src/auth/auth-context.decorator.ts — returns string | undefined instead of throwing. Explicit, safe companion to @OrganizationId() for @SkipOrgCheck()-decorated endpoints.
• Harden @OrganizationId() to throw InternalServerErrorException (typed, surfaced by Nest's exception filter, logged by monitoring) instead of a plain Error (opaque 500). The message points to @OrganizationIdOptional() so the next misuse is immediately diagnosable.
• Swap the decorator on findAvailable. The service already handles undefined correctly.
• Regression tests in frameworks.controller.spec.ts — one asserting the endpoint returns data when organizationId is undefined (the fresh-signup case), and one asserting it passes the id through when present.
• Surface API errors in FrameworkSelection.tsx — fetcher now throws on non-OK responses; component renders a visible error + retry button. Prevents the next server-side failure from producing a silent blank screen.

Test plan

• Typecheck passes (no new errors introduced — verified locally by stashing changes and confirming same pre-existing errors on main before/after)
• apps/api unit tests pass (new findAvailable tests follow the exact pattern of the existing findAll tests)
• Sign up a fresh user in incognito → reach "Which compliance frameworks do you need?" step → framework options render
• Simulate a 500 on /v1/frameworks/available (e.g., by breaking the env var temporarily) → onboarding UI shows a visible error + retry button, not a blank screen
• Existing user on /setup still sees frameworks (no regression for the with-org path)

🤖 Generated with Claude Code

---

Summary by cubic

Fixes a 500 that blocked onboarding by making /v1/frameworks/available work when the user has no active org. The UI now shows a clear error with a retry instead of a blank screen.

• Bug Fixes
  • Added @OrganizationIdOptional() for @SkipOrgCheck() endpoints; returns string | undefined.
  • Updated @OrganizationId() to throw InternalServerErrorException with guidance to use the optional decorator when appropriate.
  • Switched findAvailable to use @OrganizationIdOptional().
  • FrameworkSelection.tsx: fetcher now throws on non-OK responses; renders error + retry UI.
  • Regression tests added for findAvailable with and without organizationId.

^{Written for commit 8fee034. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Building	Preview, Comment	Apr 21, 2026 4:55pm
comp-framework-editor	Building	Preview, Comment	Apr 21, 2026 4:55pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Apr 21, 2026 4:55pm

[cubic-dev-ai]

No issues found across 4 files

_{Auto-approved: Fixes critical onboarding 500 error. Adds a safe optional decorator for organization extraction and improves UI resilience. Well-tested and low risk.}

[claudfuen]

🎉 This PR is included in version 3.27.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀