feat: allow selecting which policies to download when clicking download all

* feat(policies): allow filtering download-all by policyIds

* feat(policies): parse policyIds query param on download-all endpoint

* fix(policies): use typed mockAuthContext in controller spec

* feat(policies): add policy download picker sheet

* feat(policies): open download picker sheet from Download All button

* chore(policies): import icons from design-system re-export

* fix(policies): reset picker selection on reopen and accept array policyIds

Addresses cubic review on PR #2672:
- PolicyDownloadSheet: reset selection to current policy IDs whenever the
  sheet opens or the policies prop changes, so reopens and upstream data
  refreshes don't leave stale or deleted IDs selected.
- Controller: accept repeated-key array form (?policyIds=a&policyIds=b)
  in addition to comma-separated, and flatten both into a single deduped
  string[].

---------

Co-authored-by: Mariano <marfuen98@gmail.com>

Author: github-actions[bot]

apps/api/src/policies/policies.controller.spec.ts

@@ -53,6 +53,10 @@ jest.mock('@db', () => ({
     draft: 'draft',
     published: 'published',
   },
+  FindingType: {
+    soc2: 'soc2',
+    iso27001: 'iso27001',
+  },
 }));
 
 jest.mock('@trigger.dev/sdk', () => ({
@@ -188,17 +192,115 @@ describe('PoliciesController', () => {
       const result = await controller.downloadAllPolicies(
         orgId,
         mockAuthContext,
+        undefined,
       );
 
       expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
         orgId,
+        undefined,
       );
       expect(result).toEqual({
         url: 'https://s3.example.com/bundle.pdf',
         authType: 'session',
         authenticatedUser: { id: 'usr_123', email: 'test@example.com' },
       });
     });
+
+    it('parses comma-separated policyIds and passes an array to the service', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 2 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        'p1, p2 ,p3',
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        ['p1', 'p2', 'p3'],
+      );
+    });
+
+    it('dedupes policyIds and strips empty entries', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 1 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        'p1,,p1,p2,',
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        ['p1', 'p2'],
+      );
+    });
+
+    it('passes undefined when policyIds query is missing', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 10 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        undefined,
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        undefined,
+      );
+    });
+
+    it('passes undefined when policyIds query is an empty string', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 10 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        '',
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        undefined,
+      );
+    });
+
+    it('handles repeated-key array form (policyIds=a&policyIds=b)', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 2 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        ['p1', 'p2'],
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        ['p1', 'p2'],
+      );
+    });
+
+    it('handles mixed array form where each value itself contains commas', async () => {
+      const mockResult = { downloadUrl: 'https://s3/signed', name: 'all-policies', policyCount: 3 };
+      mockPoliciesService.downloadAllPoliciesPdf.mockResolvedValue(mockResult);
+
+      await controller.downloadAllPolicies(
+        orgId,
+        mockAuthContext,
+        ['p1,p2', 'p3'],
+      );
+
+      expect(policiesService.downloadAllPoliciesPdf).toHaveBeenCalledWith(
+        orgId,
+        ['p1', 'p2', 'p3'],
+      );
+    });
   });
 
   describe('getPolicy', () => {

apps/api/src/policies/policies.controller.ts

@@ -72,6 +72,22 @@ import {
 } from './schemas/version-responses';
 import { PolicyResponseDto } from './dto/policy-responses.dto';
 
+function parsePolicyIdsParam(
+  raw: string | string[] | undefined,
+): string[] | undefined {
+  if (!raw) return undefined;
+  const values = Array.isArray(raw) ? raw : [raw];
+  const ids = Array.from(
+    new Set(
+      values
+        .flatMap((value) => value.split(','))
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0),
+    ),
+  );
+  return ids.length > 0 ? ids : undefined;
+}
+
 @ApiTags('Policies')
 @ApiExtraModels(PolicyResponseDto)
 @Controller({ path: 'policies', version: '1' })
@@ -154,9 +170,14 @@ export class PoliciesController {
   async downloadAllPolicies(
     @OrganizationId() organizationId: string,
     @AuthContext() authContext: AuthContextType,
+    @Query('policyIds') policyIdsParam?: string | string[],
   ) {
-    const result =
-      await this.policiesService.downloadAllPoliciesPdf(organizationId);
+    const policyIds = parsePolicyIdsParam(policyIdsParam);
+
+    const result = await this.policiesService.downloadAllPoliciesPdf(
+      organizationId,
+      policyIds,
+    );
 
     return {
       ...result,

apps/api/src/policies/policies.service.ts

@@ -1268,7 +1268,10 @@ export class PoliciesService {
   /**
    * Download all published policies as a single PDF bundle (no watermark)
    */
-  async downloadAllPoliciesPdf(organizationId: string) {
+  async downloadAllPoliciesPdf(
+    organizationId: string,
+    policyIds?: string[],
+  ) {
     // Get organization info
     const organization = await db.organization.findUnique({
       where: { id: organizationId },
@@ -1285,6 +1288,9 @@ export class PoliciesService {
         organizationId,
         isArchived: false,
         archivedAt: null,
+        ...(policyIds && policyIds.length > 0
+          ? { id: { in: policyIds } }
+          : {}),
       },
       select: {
         id: true,

apps/app/package.json

@@ -150,6 +150,7 @@
         "@testing-library/dom": "^10.4.0",
         "@testing-library/jest-dom": "^6.6.3",
         "@testing-library/react": "^16.3.0",
+        "@testing-library/user-event": "^14.6.1",
         "@trigger.dev/build": "4.4.3",
         "@types/d3": "^7.4.3",
         "@types/jspdf": "^2.0.0",