[FEAT] Upload images for failed device policy

[github-actions]

This is an automated pull request to merge chas/upload-policy-images into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
app	Ready	Preview, Comment	Jan 21, 2026 2:13am
portal	Ready	Preview, Comment	Jan 21, 2026 2:13am

[cursor]

PR Summary

Introduces end-to-end support for attaching and viewing images as evidence for device policy results.

• New UI components: FleetPolicyItem, PolicyImageUploadModal, PolicyImagePreviewModal, and shared CarouselControls; refactors device views to show policy status, actions, and image previews
• Backend APIs: POST /api/confirm-fleet-policy to upload images to org assets S3 bucket and persist FleetPolicyResult; GET /api/fleet-policy to return results (with signed URLs when available); app-side GET /api/get-image-url to sign individual image keys
• Data layer: adds FleetPolicyResult model/migrations and relations; augments fetched Fleet host policies with computed MDM policy and DB-backed response/attachments
• Types/utilities: extend FleetPolicy with optional fields and attachments; add S3 org assets support in utils

^{Written by Cursor Bugbot for commit 0a46363. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Missing array bounds check in image preview modal

Low Severity

The PolicyImagePreviewModal in apps/app lacks a bounds check before accessing images[currentIndex]. The portal version has hasImages && currentIndex >= 0 && currentIndex < images.length, but this version only checks hasImages. If images.length changes between renders (before the useEffect resets currentIndex to 0), accessing images[currentIndex] with an out-of-bounds index could pass undefined to PolicyImagePreview, causing a brief "Failed to load image" flash.

 

[cursor]

Incorrect directive in Next.js Route Handler

Medium Severity

The 'use server' directive is incorrectly placed in a Next.js Route Handler file. This directive is intended for Server Actions, not Route Handlers. Route Handlers (files exporting HTTP method functions like GET, POST) are inherently server-side and don't use this directive. Other route files in the codebase (confirm-fleet-policy/route.ts, fleet-policy/route.ts) correctly omit this directive. This misuse could cause unexpected behavior in certain Next.js configurations or future versions.