[comp] Production Deploy

apps/api/src/app.module.ts

@@ -25,6 +25,7 @@ import { ContextModule } from './context/context.module';
 import { TrustPortalModule } from './trust-portal/trust-portal.module';
 import { ControlTemplateModule } from './framework-editor/control-template/control-template.module';
 import { IsmsDocumentTemplateModule } from './framework-editor/isms-document-template/isms-document-template.module';
+import { FrameworkFamilyModule } from './framework-editor/framework-family/framework-family.module';
 import { FrameworkEditorFrameworkModule } from './framework-editor/framework/framework.module';
 import { PolicyTemplateModule } from './framework-editor/policy-template/policy-template.module';
 import { RequirementModule } from './framework-editor/requirement/requirement.module';
@@ -101,6 +102,7 @@ import { OffboardingChecklistModule } from './offboarding-checklist/offboarding-
     FrameworkEditorFrameworkModule,
     PolicyTemplateModule,
     RequirementModule,
+    FrameworkFamilyModule,
     TaskTemplateModule,
     FindingTemplateModule,
     FindingsModule,

apps/api/src/browserbase/browser-auth-profile-context.service.ts

@@ -0,0 +1,94 @@
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { db, type BrowserAuthProfile } from '@db';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserbaseOrgContextService } from './browserbase-org-context.service';
+import { PENDING_CONTEXT_ID } from './browserbase-org-context.service';
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+@Injectable()
+export class BrowserAuthProfileContextService {
+  private readonly logger = new Logger(BrowserAuthProfileContextService.name);
+
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly orgContexts: BrowserbaseOrgContextService = new BrowserbaseOrgContextService(
+      sessions,
+    ),
+  ) {}
+
+  async initialize(input: {
+    profileId: string;
+    organizationId: string;
+  }): Promise<BrowserAuthProfile> {
+    try {
+      const contextId = await this.resolveInitialContextId(
+        input.organizationId,
+      );
+      return await db.browserAuthProfile.update({
+        where: { id: input.profileId },
+        data: { contextId },
+      });
+    } catch (error) {
+      await this.deletePendingProfile(input.profileId);
+      throw error;
+    }
+  }
+
+  async ready(profile: BrowserAuthProfile): Promise<BrowserAuthProfile> {
+    if (profile.contextId !== PENDING_CONTEXT_ID) return profile;
+    return this.waitForProfileContext(profile.id);
+  }
+
+  private async resolveInitialContextId(
+    organizationId: string,
+  ): Promise<string> {
+    const legacy = await this.orgContexts.getOrgContext(organizationId);
+    if (legacy) return legacy.contextId;
+    return this.sessions.createBrowserbaseContext();
+  }
+
+  private async waitForProfileContext(
+    profileId: string,
+  ): Promise<BrowserAuthProfile> {
+    const maxWaitMs = 10_000;
+    const pollMs = 200;
+    const startedAt = Date.now();
+
+    while (Date.now() - startedAt < maxWaitMs) {
+      const current = await db.browserAuthProfile.findUnique({
+        where: { id: profileId },
+      });
+
+      if (current && current.contextId !== PENDING_CONTEXT_ID) {
+        return current;
+      }
+
+      if (!current) {
+        throw new NotFoundException('Browser auth profile not found');
+      }
+
+      await delay(pollMs);
+    }
+
+    this.logger.warn(
+      `Timed out waiting for Browser auth profile context ${profileId}`,
+    );
+    throw new Error(
+      'Browser profile initialization is taking too long. Please retry.',
+    );
+  }
+
+  private async deletePendingProfile(profileId: string): Promise<void> {
+    try {
+      await db.browserAuthProfile.deleteMany({
+        where: { id: profileId, contextId: PENDING_CONTEXT_ID },
+      });
+    } catch (error) {
+      this.logger.warn('Failed to clear pending browser auth profile', {
+        profileId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}

apps/api/src/browserbase/browser-auth-profile.service.spec.ts

@@ -0,0 +1,191 @@
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+
+jest.mock('@db', () => ({
+  db: {
+    browserAuthProfile: {
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      findUniqueOrThrow: jest.fn(),
+      findFirst: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    browserbaseContext: {
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      updateMany: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+  },
+}));
+
+import { db } from '@db';
+
+describe('BrowserAuthProfileService', () => {
+  let sessions: BrowserbaseSessionService;
+  let service: BrowserAuthProfileService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    sessions = new BrowserbaseSessionService();
+    jest
+      .spyOn(sessions, 'createBrowserbaseContext')
+      .mockResolvedValue('ctx_new');
+    service = new BrowserAuthProfileService(sessions);
+  });
+
+  it('normalizes hostname and login identity when creating a profile', async () => {
+    (db.browserAuthProfile.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserAuthProfile.create as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: 'svc@example.com',
+      contextId: '__PENDING__',
+    });
+    (db.browserAuthProfile.update as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: 'svc@example.com',
+      contextId: 'ctx_new',
+    });
+
+    await service.getOrCreateProfileFromUrl({
+      organizationId: 'org_1',
+      url: 'https://GitHub.com/acme/repo',
+      loginIdentity: ' SVC@EXAMPLE.COM ',
+    });
+
+    expect(db.browserAuthProfile.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        organizationId: 'org_1',
+        hostname: 'github.com',
+        loginIdentity: 'svc@example.com',
+        contextId: '__PENDING__',
+      }),
+    });
+    expect(db.browserAuthProfile.update).toHaveBeenCalledWith({
+      where: { id: 'bap_1' },
+      data: { contextId: 'ctx_new' },
+    });
+  });
+
+  it('does not create an orphan context when another request creates the profile', async () => {
+    (db.browserAuthProfile.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserAuthProfile.create as jest.Mock).mockRejectedValue({
+      code: 'P2002',
+    });
+    (db.browserAuthProfile.findUniqueOrThrow as jest.Mock).mockResolvedValue({
+      id: 'bap_existing',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: '',
+      contextId: 'ctx_existing',
+    });
+
+    const result = await service.getOrCreateProfileFromUrl({
+      organizationId: 'org_1',
+      url: 'https://github.com/acme/repo',
+    });
+
+    expect(result.profile.id).toBe('bap_existing');
+    expect(sessions.createBrowserbaseContext).not.toHaveBeenCalled();
+  });
+
+  it('prioritizes a verified profile for the target hostname', async () => {
+    (db.browserAuthProfile.findMany as jest.Mock).mockResolvedValue([
+      { id: 'bap_old', status: 'needs_reauth', hostname: 'github.com' },
+      { id: 'bap_verified', status: 'verified', hostname: 'github.com' },
+    ]);
+
+    const profile = await service.resolveProfileForTarget({
+      organizationId: 'org_1',
+      targetUrl: 'https://github.com/acme/repo',
+    });
+
+    expect(profile.id).toBe('bap_verified');
+    expect(db.browserAuthProfile.findMany).toHaveBeenCalledWith({
+      where: { organizationId: 'org_1', hostname: 'github.com' },
+      orderBy: { updatedAt: 'desc' },
+    });
+  });
+
+  it('rejects profile verification for a different hostname', async () => {
+    jest
+      .spyOn(sessions, 'checkLoginStatus')
+      .mockResolvedValue({ isLoggedIn: true });
+    (db.browserAuthProfile.findFirst as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      lastVerifiedAt: null,
+    });
+
+    await expect(
+      service.verifyProfileSession({
+        organizationId: 'org_1',
+        profileId: 'bap_1',
+        sessionId: 'sess_1',
+        url: 'https://gitlab.com/acme/repo',
+      }),
+    ).rejects.toThrow('Verification URL must match');
+    expect(sessions.checkLoginStatus).not.toHaveBeenCalled();
+  });
+
+  it('rejects profile verification when the session uses another context', async () => {
+    jest.spyOn(sessions, 'getSessionContextId').mockResolvedValue('ctx_other');
+    jest
+      .spyOn(sessions, 'checkLoginStatus')
+      .mockResolvedValue({ isLoggedIn: true });
+    (db.browserAuthProfile.findFirst as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      contextId: 'ctx_profile',
+      lastVerifiedAt: null,
+    });
+
+    await expect(
+      service.verifyProfileSession({
+        organizationId: 'org_1',
+        profileId: 'bap_1',
+        sessionId: 'sess_wrong',
+        url: 'https://github.com/acme/repo',
+      }),
+    ).rejects.toThrow('does not belong to this auth profile');
+    expect(sessions.checkLoginStatus).not.toHaveBeenCalled();
+    expect(db.browserAuthProfile.update).not.toHaveBeenCalled();
+  });
+
+  it('treats a pending legacy org context as unavailable', async () => {
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: '__PENDING__',
+    });
+
+    await expect(service.getOrgContext('org_1')).resolves.toBeNull();
+  });
+
+  it('clears pending org context when Browserbase context creation fails', async () => {
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserbaseContext.create as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: '__PENDING__',
+    });
+    jest
+      .spyOn(sessions, 'createBrowserbaseContext')
+      .mockRejectedValue(new Error('Browserbase unavailable'));
+
+    await expect(service.getOrCreateOrgContext('org_1')).rejects.toThrow(
+      'Browserbase unavailable',
+    );
+    expect(db.browserbaseContext.deleteMany).toHaveBeenCalledWith({
+      where: { organizationId: 'org_1', contextId: '__PENDING__' },
+    });
+  });
+});