[dev] [carhartlewis] lewis/comp-background-checks

[github-actions]

This is an automated pull request to merge lewis/comp-background-checks into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Adds end-to-end employee background checks with request/invite, Stripe billing (payment method setup and one-off charging), webhook sync, and in‑app report viewing. Stores completed report snapshots and shows a verified tick; supports uploading third‑party reports and a shareable summary.

• Bug Fixes

  • Custom uploads: upload file before marking a check as completed.
  • Payments: create DB record before charging to avoid orphaned charges; reconcile duplicate requests via unique constraint; refund only on Identity API failures; verify checkout session status; accept $0 prices.
  • Webhooks: reconcile duplicate events; validate signatures/timestamps; streamline raw body parsing.
  • Resilience: 30s timeout for Identity API; handle numeric‑string epoch timestamps.
  • Validation/UI: trim and reject whitespace‑only employee names; add URL validation for billing redirects and allow localhost in dev; limit base64 fileData size to 100MB; verify org metadata on setup success; track SWR loading for custom attachments; include device task in totals while loading.
  • Logging: improve refund failure logs with structured context.

• Migration

  • Run Prisma migrations.
  • Set env vars: BACKGROUND_CHECK_API_BASE_URL, BACKGROUND_CHECK_API_KEY, BACKGROUND_CHECK_WEBHOOK_SECRET, BACKGROUND_WH_ENDPOINT, STRIPE_BACKGROUND_CHECK_PRICE_ID, NEXT_PUBLIC_APP_URL, optionally NODE_EXTRA_CA_CERTS.
  • Stripe: ensure an org customer exists, use the setup session endpoint to add a background‑check payment method, and register the webhook to /v1/background-checks/webhook with BACKGROUND_CHECK_WEBHOOK_SECRET.
  • Redeploy API and App.

^{Written for commit 6d56a2d. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Apr 29, 2026 11:30pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Apr 29, 2026 11:30pm
portal	Skipped		Apr 29, 2026 11:30pm

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	Apr 29, 2026, 7:15 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cubic-dev-ai]

13 issues found across 73 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/main.ts">

<violation number="1" location="apps/api/src/main.ts:103">
P2: Avoid copying the raw request buffer here; `Buffer.from(buf)` duplicates the payload and increases memory pressure for large requests.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx:15">
P3: This adds a duplicate `BackgroundCheckStatus` definition instead of reusing a shared source of truth, which increases status-drift risk across background-check flows.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckStatusView.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckStatusView.tsx:47">
P2: Defaulting `customAttachments` to `[]` hides loading/error states and can incorrectly show “Report is still syncing” for completed checks.</violation>
</file>

<file name="apps/api/src/background-checks/background-check-payment.service.spec.ts">

<violation number="1" location="apps/api/src/background-checks/background-check-payment.service.spec.ts:37">
P2: The test asserts only `HttpException` type and does not verify a 402 payment-required status, so it can pass on the wrong error path.</violation>
</file>

<file name="apps/api/src/background-checks/background-check-custom.service.ts">

<violation number="1" location="apps/api/src/background-checks/background-check-custom.service.ts:68">
P1: Don’t set the request to `completed` before the file upload succeeds; a failed upload leaves an incorrect completed/synced background-check record.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckReport.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/BackgroundCheckReport.tsx:235">
P2: Numeric-string epoch timestamps are parsed as invalid dates, causing audit events to lose their timestamp and sort/display incorrectly.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx:177">
P2: Include the device requirement in task totals while device status is loading; otherwise task progress can be overstated until the device check resolves.</violation>
</file>

<file name="apps/api/src/background-checks/background-check-identity.client.ts">

<violation number="1" location="apps/api/src/background-checks/background-check-identity.client.ts:93">
P2: Add a timeout to Identity API fetch calls so upstream stalls don’t block requests indefinitely.</violation>
</file>

<file name="apps/api/src/background-checks/background-checks.service.ts">

<violation number="1" location="apps/api/src/background-checks/background-checks.service.ts:141">
P1: The catch block refunds on any error in the try block, including local DB write failures after a successful identity creation.</violation>

<violation number="2" location="apps/api/src/background-checks/background-checks.service.ts:246">
P1: Duplicate-event short-circuit returns before state reconciliation, so retries can permanently skip updating the background check after a partial failure.</violation>
</file>

<file name="apps/api/src/background-checks/background-checks.controller.ts">

<violation number="1" location="apps/api/src/background-checks/background-checks.controller.ts:59">
P2: `employeeName` is trimmed after validation, which allows whitespace-only input to become an empty string and be processed as a valid request.</violation>
</file>

<file name="apps/api/src/background-checks/background-check-billing.service.ts">

<violation number="1" location="apps/api/src/background-checks/background-check-billing.service.ts:81">
P1: Verify `session.status === 'complete'` before processing the checkout session. Without this check, a user could manually submit an incomplete session (e.g., failed 3D Secure), bypassing successful payment method authentication.</violation>

<violation number="2" location="apps/api/src/background-checks/background-check-billing.service.ts:195">
P2: Checking `!price.unit_amount` will erroneously reject prices configured with a $0 amount because 0 is falsy. Use `price.unit_amount === null` instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

0 issues found across 14 files (changes from recent commits).

_{Requires human review: Major new feature involving Stripe billing, webhooks, database migrations, and complex third-party integrations requires human review.}

[cubic-dev-ai]

2 issues found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/attachments/upload-attachment.dto.ts">

<violation number="1" location="apps/api/src/attachments/upload-attachment.dto.ts:38">
P2: This max-length value is applied to base64 characters, which drops the effective binary upload limit to ~48MiB and conflicts with the service’s 100MB file-size policy.</violation>
</file>

<file name="apps/api/src/background-checks/dto/background-check-billing.dto.ts">

<violation number="1" location="apps/api/src/background-checks/dto/background-check-billing.dto.ts:5">
P2: Using `@IsUrl` with default options rejects `http://localhost` redirect URLs used in local/dev flows. Set URL options to allow localhost (e.g. `require_tld: false`) so valid app-origin redirects are not blocked.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/attachments/upload-attachment.dto.ts">

<violation number="1" location="apps/api/src/attachments/upload-attachment.dto.ts:38">
P2: The base64 max-length value is too low for the service’s 100MB file limit, so valid 96–100MB uploads will be rejected during DTO validation.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[claudfuen]

🎉 This PR is included in version 3.39.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀