fix(vendors): fix PATCH 400 error for vendors with empty descriptions

PartialType(CreateVendorDto) preserves @isnotempty() from the create
DTO. Combined with @IsOptional() added by PartialType, this means:
- null/undefined → @IsOptional() skips validators → OK
- "" (empty string) → @IsOptional() does NOT skip → @isnotempty() fails → 400

Vendors created during onboarding can have empty descriptions, causing
all subsequent PATCH updates to fail with 400 Bad Request.

Replace PartialType with an explicit DTO that drops @isnotempty() on
description (empty strings are valid for updates) while keeping it on
name (a vendor must always have a non-empty name).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/api/src/vendors/dto/update-vendor.dto.ts

@@ -1,4 +1,84 @@
-import { PartialType } from '@nestjs/swagger';
-import { CreateVendorDto } from './create-vendor.dto';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import {
+  IsString,
+  IsNotEmpty,
+  IsOptional,
+  IsEnum,
+  IsUrl,
+  IsBoolean,
+} from 'class-validator';
+import { Transform } from 'class-transformer';
+import {
+  VendorCategory,
+  VendorStatus,
+  Likelihood,
+  Impact,
+} from '@trycompai/db';
 
-export class UpdateVendorDto extends PartialType(CreateVendorDto) {}
+/**
+ * DTO for PATCH /vendors/:id
+ *
+ * Defined explicitly rather than using PartialType(CreateVendorDto) because
+ * PartialType preserves @IsNotEmpty() — which rejects empty strings even
+ * when @IsOptional() is added. For PATCH, empty-string fields like
+ * `description: ""` (common for vendors created during onboarding) should
+ * not cause a 400.
+ */
+export class UpdateVendorDto {
+  @ApiPropertyOptional({ description: 'Vendor name' })
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  name?: string;
+
+  @ApiPropertyOptional({ description: 'Vendor description' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiPropertyOptional({ description: 'Vendor category', enum: VendorCategory })
+  @IsOptional()
+  @IsEnum(VendorCategory)
+  category?: VendorCategory;
+
+  @ApiPropertyOptional({ description: 'Assessment status', enum: VendorStatus })
+  @IsOptional()
+  @IsEnum(VendorStatus)
+  status?: VendorStatus;
+
+  @ApiPropertyOptional({ description: 'Inherent probability', enum: Likelihood })
+  @IsOptional()
+  @IsEnum(Likelihood)
+  inherentProbability?: Likelihood;
+
+  @ApiPropertyOptional({ description: 'Inherent impact', enum: Impact })
+  @IsOptional()
+  @IsEnum(Impact)
+  inherentImpact?: Impact;
+
+  @ApiPropertyOptional({ description: 'Residual probability', enum: Likelihood })
+  @IsOptional()
+  @IsEnum(Likelihood)
+  residualProbability?: Likelihood;
+
+  @ApiPropertyOptional({ description: 'Residual impact', enum: Impact })
+  @IsOptional()
+  @IsEnum(Impact)
+  residualImpact?: Impact;
+
+  @ApiPropertyOptional({ description: 'Vendor website URL' })
+  @IsOptional()
+  @IsUrl()
+  @Transform(({ value }) => (value === '' ? undefined : value))
+  website?: string;
+
+  @ApiPropertyOptional({ description: 'Whether the vendor is a sub-processor' })
+  @IsOptional()
+  @IsBoolean()
+  isSubProcessor?: boolean;
+
+  @ApiPropertyOptional({ description: 'Assignee member ID' })
+  @IsOptional()
+  @IsString()
+  assigneeId?: string;
+}