fix(people): address cubic review findings for offboarding feature

[Marfuen]

Summary

Fixes all valid Cubic review findings from #2878:

Security (P1):

• Prevent CSV formula injection in offboarding export by prefixing dangerous leading chars (=, +, -, @, \t, \r)
• Sanitize attachment filenames in ZIP paths to prevent path traversal
• Scope revocation lookup by organizationId to prevent cross-tenant deletion
• Rollback completion record if evidence upload fails (prevents partial state)
• Scope attachment deletion to member and event type (not just org+attachmentId)

Bug fixes (P2):

• Add member ID to bulk export folder names to prevent name collisions
• Filter pending offboarding completion counts to enabled template items only
• Validate date query params before DB filters (prevents 500s on invalid dates)
• Use @IsInt() for sortOrder DTO validation
• Show "Until {date}" when only end date is set in date range filter
• Clear file input in finally block so failed uploads can be retried
• Validate tab query param against dynamically available tabs (respects feature flags)
• Show error state in TodosOverview on fetch failure instead of false "All clear"

Test plan

• Export offboarding data — CSV should have formula-safe fields
• Upload evidence with special characters in filename — ZIP should sanitize
• Bulk export with duplicate member names — folders should be unique
• Complete checklist item with evidence — if upload fails, completion should rollback
• Filter people by invalid date string — should return 400, not 500
• Set only end date in date range filter — label should show "Until {date}"
• Navigate to ?tab=offboarding for non-offboarded employee — should fallback to details

🤖 Generated with Claude Code

---

Summary by cubic

Strengthens the offboarding workflow with key security fixes and UX/validation improvements across exports, evidence uploads, and filters. Aligns with CS-312 by making employment event filtering and evidence collection safer and more reliable.

• Security

  • CSV export: prefix dangerous leading chars to prevent formula injection.
  • ZIP export: sanitize attachment filenames to block path traversal; restrict attachment deletion by member and event type.
  • Access revocations: scope lookups by organizationId to prevent cross-tenant actions.
  • Checklist: rollback completion if evidence upload fails to avoid partial state.

• Bug Fixes

  • Exports: add member ID to folder names to avoid collisions.
  • Pending counts: include only enabled template items.
  • Validation: strict date param parsing (400 on invalid); use @IsInt() for sortOrder.
  • UI: show “Until {date}” when only an end date is set; show error state in TodosOverview on fetch failure.
  • UX: always clear file input after upload attempts; validate the employee tab against available tabs (feature flags and offboarding).

^{Written for commit 7414aca. Summary will update on new commits. Review in cubic}

[linear]

CS-312

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 20, 2026 8:47pm
comp-framework-editor	Ready	Preview, Comment	May 20, 2026 8:47pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		May 20, 2026 8:47pm

[cubic-dev-ai]

cubic analysis

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Linked issue analysis

Linked issue: CS-312: [Feature] Add personnel Employment events date tracking + supporting evidence upload section

Status	Acceptance criteria	Notes
✅	Prevent CSV formula injection in offboarding export by prefixing dangerous leading characters	escapeCsvField now prefixes dangerous leading characters to make CSV fields formula-safe.
✅	Sanitize attachment filenames in ZIP paths to prevent path traversal / unsafe names	Added sanitizeFileName and used safeName when appending files into archive paths.
✅	Scope revocation lookup by organizationId to prevent cross-tenant deletion	Replaced findUnique lookup with findFirst and included organizationId in where clause.
✅	Rollback offboarding checklist completion if evidence upload fails	Upload is wrapped in try/catch and deletes the completion on error, then rethrows the error.
✅	Scope attachment deletion to member and event type (not just org + attachmentId)	Controller resolves the event entity type and verifies the attachment belongs to that member and event type before deletion.
✅	Make bulk export folder names unique by including member ID to prevent name collisions	Export prefix now includes member.id when building offboarded-employees folder name.
✅	Filter pending offboarding completion counts to enabled template items only	Query for offboardingChecklistCompletions includes a where clause restricting templateItem to isEnabled: true.
✅	Validate date query params before applying DB filters (prevent 500s on invalid dates)	Added parseDateParam that throws BadRequestException for invalid date strings and used it for onboard/offboard date params.
✅	Use integer validation for sortOrder DTO	Replaced @IsNumber with @ISINT for sortOrder and adjusted imports.
✅	Show "Until {date}" when only end date is set in date range filter UI	DateRangeFilter formatting now returns an "Until {date}" label when only end date is present.
✅	Clear file input in finally so failed uploads can be retried	File input clearing moved into a finally block to ensure it always resets after upload attempts.
✅	Validate tab query param against dynamically available tabs and only expose offboarding tab when appropriate	Replaced static VALID_TABS with availableTabs computed from feature flags and employee.offboardDate, and uses it for tab resolution.
✅	Show error state in TodosOverview when fetch of pending offboarding fails	TodosOverview now checks error from SWR and displays a failed-to-load message instead of assuming success.

_{Re-trigger cubic}

[claudfuen]

🎉 This PR is included in version 3.60.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀