@preventive/triage 1.0.0-alpha.21 → 1.0.0-alpha.23

package/server-managed/report-sources.ts

@@ -4,6 +4,7 @@ import { extname } from 'node:path'
 import { promisify } from 'node:util'
 import { gzip } from 'node:zlib'
 import { bundleSourcesAsMap } from '../common/bundle-sources.js'
+import { bundleSourceImports } from '../common/bundle-source-links.js'
 import { loadManagedFindings, managedFindingSourcePaths } from '../common/managed/report-content.ts'
 import { type ViewerPermissions, filterReportContent } from '../common/managed/report-filter.ts'
 import type { CacheStorage } from './cache-storage.ts'
@@ -27,7 +28,7 @@ function formatDirectory(bundleId: string, sha256: string, name: string) {
 }
 function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
   const key = createHash('sha256').update(JSON.stringify([
-    'finding-access-v4', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+    'finding-access-v5', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
   ])).digest('hex')
   return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
 }
@@ -88,7 +89,8 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
     const details = await readBundleDetails(bundle, bundles)
     if (!details) return false
     const selection = selectSources(sourcePaths, bundleSourcesAsMap(details))
-    const body = await compress(Buffer.from(JSON.stringify({ integrity: bundle.integrity, ...selection })), { level: 6 })
+    const imports = [...bundleSourceImports(details, new Map(selection.files))].map(([parent, targets]) => [parent, [...targets]])
+    const body = await compress(Buffer.from(JSON.stringify({ integrity: bundle.integrity, ...selection, imports })), { level: 6 })
     // A duplicate with the same hash AND format can use these parsed bytes.
     // Another format must not keep a deleted variant's late build alive.
     if (!(await referenced(report, bundle))) return false

package/server-managed/repository-browser.ts

@@ -0,0 +1,127 @@
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+
+export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
+
+// Restricted managers can walk the ancestors of their grants, without seeing
+// sibling names or files outside those grants. null means the entire repo.
+export function scopedDirectory(path: string, scopes: (string | null)[]): RepositoryEntry[] | null {
+  if (scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))) return null
+  const prefix = path ? path + '/' : ''
+  const names = new Set(scopes.filter((scope): scope is string => !!scope && scope.startsWith(prefix)).map(scope => scope.slice(prefix.length).split('/')[0]!))
+  return [...names].toSorted().map(name => ({ name, path: prefix + name, type: 'dir' }))
+}
+
+export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
+type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
+
+function credentialFailure(err: unknown): err is GithubApiError {
+  return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
+}
+
+// Create once per HTTP request. Coalesce concurrent credential lookups without
+// caching repository visibility or permissions, or sharing credentials across users.
+export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
+  const tokens = new Map<number, Promise<string | null>>()
+  let identity: Promise<GithubIdentity> | undefined
+  const getIdentity = (fresh = false): Promise<GithubIdentity> => {
+    if (!user.token || user.githubUserId == null) return Promise.reject(new GithubApiError(404, 'no-repository'))
+    if (!identity || fresh) {
+      identity = githubUserIdentity(user.token, fetchImpl).then(value => {
+        if (value.id !== user.githubUserId) throw new GithubApiError(404, 'no-repository')
+        return value
+      })
+    }
+    return identity
+  }
+  return {
+    reader(repo: SelectedRepo) {
+      const installationToken = () => {
+        if (repo.installationId == null) return Promise.resolve(null)
+        const cached = tokens.get(repo.installationId)
+        const token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
+          if (!credentialFailure(err)) throw err
+          // Stale installations cannot prevent verified public access.
+          return null
+        })
+        if (!cached) tokens.set(repo.installationId, token)
+        return token
+      }
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
+    },
+  }
+}
+
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+  const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate.
+  let token = userToken ?? await installationToken()
+  const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
+  const metadata = async () => {
+    try { return await read('') }
+    catch (err) {
+      if (!token || !credentialFailure(err)) throw err
+      const fallback = await installationToken()
+      if (fallback && fallback !== token) {
+        token = fallback
+        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+      }
+      // Anonymous fallback is only for unavailable credentials, never rate
+      // limits, network errors, or GitHub outages.
+      token = null
+      return read('')
+    }
+  }
+  const checkAccess = async (freshIdentity = false) => {
+    // Stored visibility can be stale (or internal with private=false). Require
+    // current, explicit public visibility or the caller's effective permission.
+    const data = await metadata() as { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; default_branch?: unknown }
+    if (data?.id !== repo.repoId || typeof data.full_name !== 'string' || data.full_name.toLowerCase() !== repo.fullName.toLowerCase()) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    if (data.private === false && data.visibility === 'public') return data
+    if (!token) throw new GithubApiError(404, 'no-repository')
+    const appToken = await installationToken()
+    if (!appToken) throw new GithubApiError(404, 'no-repository')
+    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    token = appToken
+    return data
+  }
+  const current = await checkAccess()
+  const defaultBranch = typeof current.default_branch === 'string' ? current.default_branch : ''
+  return {
+    recheckAccess: () => checkAccess(true),
+    async refs() {
+      // Suggestions are bounded; the input also accepts any branch or tag name.
+      const results = await Promise.all(['branches', 'tags'].map(async kind => {
+        const data = await read(`/${kind}?per_page=100`)
+        if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+        return data.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
+      }))
+      return { defaultBranch, branches: results[0], tags: results[1] }
+    },
+    async commit(ref: string) {
+      if (/^[a-f\d]{40}$/iu.test(ref)) return ref
+      const data = await read(`/commits/${encodeURIComponent(ref || (defaultBranch ? `heads/${defaultBranch}` : 'HEAD'))}`) as { sha?: unknown }
+      if (typeof data?.sha !== 'string' || !/^[a-f\d]{40}$/iu.test(data.sha)) throw new GithubApiError(502, 'github-malformed')
+      return data.sha
+    },
+    async directory(path: string, commit: string) {
+      const data = await read(`/contents/${path.split('/').map(encodeURIComponent).join('/')}?ref=${encodeURIComponent(commit)}`)
+      if (!Array.isArray(data)) throw new GithubApiError(400, 'not-a-directory')
+      const entries: RepositoryEntry[] = []
+      for (const item of data) {
+        if (typeof item?.name !== 'string' || item.name.includes('/') || item.name === '.' || item.name === '..') continue
+        const expectedPath = path ? `${path}/${item.name}` : item.name
+        if (item.path !== expectedPath) continue
+        const type = item.submodule_git_url ? 'submodule' : item.type
+        if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
+      }
+      return { entries, limited: data.length >= 1000 }
+    },
+  }
+}

package/server-managed/workspace-shares.ts

@@ -71,7 +71,7 @@ function shareQueries(db: ManagedSql) {
   const repositories = db.prepare(`SELECT tr.repo_id AS repoId, sr.full_name AS github, tr.path
     FROM managed_team_repo tr JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
     WHERE tr.team_id = ? ORDER BY tr.repo_id, tr.path`)
-  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.byte_size AS byteSize,
+  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.analyzer, r.byte_size AS byteSize,
     r.sha256, r.repo_directory AS directory, sr.full_name AS github
     FROM managed_team_repo tr JOIN managed_report r ON r.repo_id = tr.repo_id
     JOIN managed_selected_repo sr ON sr.repo_id = r.repo_id
@@ -128,7 +128,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       if (!grant) return null
       const { dependencies, security, ...team } = grant
       const permissions = { dependencies: dependencies === 1, security: security === 1 }
-      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; byteSize: number; sha256: string; directory: string; github: string }[]
+      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; analyzer: string | null; byteSize: number; sha256: string; directory: string; github: string }[]
       const bundleRows = await q.bundles.all(team.id) as (ManagedBundle & { repoFullName: string })[]
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
@@ -138,7 +138,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team,
-          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, repoFullName: row.github, repoDirectory: row.directory,
+          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,
             filename: row.filename, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName })),