fix(policies): delete detached PDF objects when regenerating a draft#3474
Merged
Conversation
Regenerating an uploaded draft cleared its PDF references but left the objects in S3, orphaning one per regeneration. The detached keys (policy + current version, deduplicated) are now removed best-effort after the database update commits; failures are logged with their keys instead of failing the regeneration.
tofikwest
changed the title
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Confidence score: 5/5
- Safe to merge after the addressed issues were fixed.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
…PP_AWS config The cleanup client now mirrors the other trigger tasks' APP_AWS_* configuration (region, credentials, optional endpoint) instead of the default chain, and the detached keys are captured inside the transaction after a SELECT ... FOR UPDATE on the policy row — a concurrently uploaded PDF can no longer slip past the cleanup as an untracked orphan.
claudfuen
pushed a commit
that referenced
this pull request
Jul 22, 2026
# [3.106.0](v3.105.0...v3.106.0) (2026-07-22) ### Bug Fixes * **auth:** attribute API-key mutations to the key's creator, not the org owner ([#3472](#3472)) ([206ed96](206ed96)), closes [hi#risk](https://github.com/hi/issues/risk) * **deps:** bump adm-zip 0.5.18 -> 0.6.0 in apps/api (Dependabot [#88](https://github.com/trycompai/comp/issues/88)/[#89](https://github.com/trycompai/comp/issues/89)) ([#3462](#3462)) ([300f2a1](300f2a1)), closes [#3451](#3451) * **deps:** override tar to ^7.5.19 to clear node-tar Dependabot alerts ([#94](https://github.com/trycompai/comp/issues/94)-[#104](https://github.com/trycompai/comp/issues/104)) ([#3466](#3466)) ([8ab5709](8ab5709)) * **deps:** patch engine.io ([#93](#93)) and body-parser ([#92](#92)) Dependabot alerts ([#3464](#3464)) ([94c33b1](94c33b1)) * **isms:** harden internal-audit validation and edge cases from deploy review ([#3473](#3473)) ([c6c7379](c6c7379)) * **policies:** create draft version on policy regenerate instead of overwriting published ([#3471](#3471)) ([ff31dbd](ff31dbd)) * **policies:** delete detached PDF objects when regenerating a draft ([#3474](#3474)) ([ecd1bd0](ecd1bd0)) * **policies:** rename CreateVersionDto to avoid swagger collision with automations ([#3469](#3469)) ([2d5290a](2d5290a)) ### Features * **isms:** internal audit programme, plan and report — clause 9.2 (CS-724) ([#3468](#3468)) ([42e5ebd](42e5ebd)), closes [hi#impact](https://github.com/hi/issues/impact)
Contributor
|
🎉 This PR is included in version 3.106.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the last open finding on the production deploy PR (#3463): regenerating an uploaded draft policy (#3471's draft path) cleared its
pdfUrlreferences but never deleted the objects from S3, orphaning one document per regeneration.What changed
update-policy-helpers.tsnow captures the keys it is about to detach (policy-level + current-versionpdfUrl, deduplicated) and deletes them from S3 after the database transaction commits — a failed delete can never roll back the content update.APP_AWS_BUCKET_NAMEisn't configured, cleanup is skipped with a warning.@aws-sdk/client-s3import, the same pattern as the other tested Trigger.dev tasks (evidence export).Verification
src/trigger/policiesjest tests green — 5 new: deletes detached keys after commit, deduplicates a shared key, S3 failure doesn't fail the regeneration, missing bucket skips with a warning, editor-mode drafts never touch S3.Closes the
update-policy-helpers.tsthread on #3463.Summary by cubic
Deletes detached uploaded PDF files from S3 when regenerating a draft policy to prevent orphaned objects. Captures keys under a row lock and uses
APP_AWS_*config; adds tests and keeps regeneration resilient to S3 errors.pdfUrlkeys before deleting.APP_AWS_*S3 config (region, credentials, optional endpoint); skips cleanup ifAPP_AWS_BUCKET_NAMEisn't set.@aws-sdk/client-s3covering capture, dedupe, failure, skip, and editor-only drafts.Written for commit 5c97145. Summary will update on new commits.