@preventive/triage 1.0.0-alpha.21 → 1.0.0-alpha.23

package/server-managed/github-issue-oauth.ts

@@ -0,0 +1,48 @@
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedSession } from './db.ts'
+import { randomToken, safeEqual } from './crypto.ts'
+import { buildCookie, clearCookie, cookieName, parseCookies } from './session.ts'
+import { OAuthError, ensureUserAccessToken, exchangeCode, fetchIdentity } from './github-oauth.ts'
+
+export const ISSUE_LOGIN_PATH = '/api/oauth/github/issues/login'
+const COOKIE = 'dvissuestate'
+
+export function isIssueOAuthCallback(config: ManagedConfig, query: URLSearchParams, cookie: string | undefined): boolean {
+  const expected = parseCookies(cookie).get(cookieName(config, COOKIE))?.split('.')[0]
+  return !!expected && safeEqual(query.get('state') ?? '', expected)
+}
+
+export function issueLoginRedirect(config: ManagedConfig, session: ManagedSession, now = Date.now()) {
+  const state = randomToken()
+  const url = new URL('https://github.com/login/oauth/authorize')
+  url.searchParams.set('client_id', config.githubClientId)
+  url.searchParams.set('redirect_uri', config.oauthCallbackUrl)
+  url.searchParams.set('state', state)
+  url.searchParams.set('allow_signup', 'false')
+  // Reauthorize the same app for the current account, without replacing the
+  // DeepView session or permitting an OAuth account switch during creation.
+  const value = `${state}.${session.id}.${now}`
+  return { location: url.href, setCookie: buildCookie(cookieName(config, COOKIE), value,
+    { secure: config.cookieSecure, maxAgeS: 600, sameSite: 'Lax' }) }
+}
+
+export async function issueOAuthCallback(config: ManagedConfig, db: ManagedDb, session: ManagedSession,
+  query: URLSearchParams, cookie: string | undefined, fetchImpl: typeof fetch = fetch, now = Date.now()) {
+  const [expected, sessionId, timestamp] = (parseCookies(cookie).get(cookieName(config, COOKIE)) ?? '').split('.')
+  const code = query.get('code'), state = query.get('state')
+  if (!code || !state || !expected || !safeEqual(state, expected) || sessionId !== session.id
+    || !timestamp || !Number.isFinite(Number(timestamp)) || now < Number(timestamp) || now - Number(timestamp) > 600_000) {
+    throw new OAuthError(400, 'invalid-oauth-state')
+  }
+  const tokens = await exchangeCode(config, code, now, fetchImpl)
+  const identity = await fetchIdentity(tokens.accessToken, fetchImpl)
+  if (identity.githubUserId !== await db.getUserGithubId(session.userId)) throw new OAuthError(403, 'github-account-mismatch')
+  const current = await db.sessionWithUser(session.id, Date.now())
+  if (!current || current.user.role === 'none' || current.session.userId !== session.userId) throw new OAuthError(401, 'unauthenticated')
+  await db.setUserTokens(session.userId, tokens)
+  return { location: '/github-issue-authorized.html', setCookie: clearCookie(cookieName(config, COOKIE), config.cookieSecure) }
+}
+
+export function issueUserToken(config: ManagedConfig, db: ManagedDb, userId: string, fetchImpl: typeof fetch = fetch) {
+  return ensureUserAccessToken(config, db, userId, Date.now(), fetchImpl)
+}

package/server-managed/github-issues.ts

@@ -0,0 +1,152 @@
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedSession } from './db.ts'
+import type { BlobStore } from './blob-store.ts'
+import type { ManagedIssue } from './managed-issues.ts'
+import { randomToken } from './crypto.ts'
+import { githubIssueClosedReason } from '../common/github-pr.ts'
+import { reportEntries, reportRepoGithub } from '../report/index.js'
+import { newIssueLabels } from '../common/github-issue-labels.js'
+import { appJwt, githubAppConfigured, installUrl, publicRepositoryName } from './github-app.ts'
+import { ISSUE_LOGIN_PATH, issueUserToken } from './github-issue-oauth.ts'
+import { TeamReportsError, loadTeamReports, recheckTeam, teamSnapshot } from './team-reports.ts'
+
+export const MAX_ISSUE_BODY_BYTES = 512_000
+export class IssueError extends Error {
+  status: number
+  constructor(status: number, message: string) { super(message); this.status = status }
+}
+
+type Context = { reportId: string; findingId: string; repository: string }
+export function parseIssueContext(raw: unknown): Context {
+  const value = raw as Partial<Context> | null
+  const repository = publicRepositoryName(value?.repository)
+  if (!repository || typeof value?.reportId !== 'string' || !value.reportId || value.reportId.length > 200
+    || typeof value.findingId !== 'string' || !value.findingId || value.findingId.length > 4096) throw new IssueError(400, 'bad-request')
+  return { repository, reportId: value.reportId, findingId: value.findingId }
+}
+
+async function github(path: string, token: string, fetchImpl: typeof fetch, payload?: unknown) {
+  let response: Response
+  try {
+    response = await fetchImpl(`https://api.github.com${path}`, {
+      method: payload === undefined ? 'GET' : 'POST', redirect: 'error', signal: AbortSignal.timeout(15_000),
+      headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json',
+        'user-agent': 'deepview-triage', 'x-github-api-version': '2022-11-28', 'content-type': 'application/json' },
+      ...(payload === undefined ? {} : { body: JSON.stringify(payload) }),
+    })
+  } catch { throw new IssueError(502, payload === undefined ? 'github-unavailable' : 'github-create-uncertain') }
+  return response
+}
+
+function referenceResult(stored: ManagedIssue, repoIds: number[]) {
+  // A shared finding ID does not grant access to another team's repository.
+  if (!repoIds.includes(stored.repoId)) return { mode: 'unavailable' as const }
+  return stored.issueUrl ? { mode: 'existing' as const, url: stored.issueUrl }
+    : { mode: 'pending' as const, repositoryUrl: `https://github.com/${stored.repository}/issues` }
+}
+
+function issueDetails(raw: unknown, url: string, number: number, fallback: { title: string; body: string; labels: string[] }) {
+  const issue = raw as { title?: unknown; body?: unknown; state?: unknown; state_reason?: unknown;
+    user?: { login?: unknown }; labels?: ({ name?: unknown } | string)[] } | null
+  const status = issue?.state === 'closed' ? 'closed' : 'open'
+  return { url, number, title: typeof issue?.title === 'string' ? issue.title : fallback.title,
+    description: typeof issue?.body === 'string' ? issue.body : fallback.body, status,
+    stateReason: status === 'closed' ? githubIssueClosedReason(issue?.state_reason) : null,
+    author: typeof issue?.user?.login === 'string' ? issue.user.login : null,
+    labels: Array.isArray(issue?.labels) ? issue.labels.map(label => typeof label === 'string' ? label : label?.name).filter((label): label is string => typeof label === 'string') : fallback.labels }
+}
+
+// Authorize before any upstream lookup, including installation/label discovery.
+// Report filtering also supplies the full row/link isSecurity classification.
+export async function prepareGithubIssue(config: ManagedConfig, db: ManagedDb, store: BlobStore,
+  session: ManagedSession, teamId: string, context: Context, fetchImpl: typeof fetch = fetch) {
+  const snapshot = await teamSnapshot(db, session.id, teamId)
+  if (!snapshot.reports.some(report => report.id === context.reportId)) throw new TeamReportsError(404, 'no-report')
+  const reports = await loadTeamReports(db, store, snapshot)
+  const report = reports.find(item => item.id === context.reportId)!
+  const findings = (reportEntries(report.data) ?? []).flat() as Record<string, unknown>[]
+  const finding = findings.find(item => item['id'] === context.findingId)
+  if (!finding) throw new TeamReportsError(404, 'no-finding')
+  const recheck = () => recheckTeam(db, session.id, snapshot)
+  await recheck()
+  const labels = newIssueLabels(finding['isSecurity'] === true, config.githubNewIssueLabels ?? '')
+  const repoIds = snapshot.repositories.map(repo => repo.repoId)
+  const stored = await db.getManagedIssue(context.findingId)
+  if (stored) return { ...referenceResult(stored, repoIds), labels, recheck }
+  // The target comes from this finding's own source, or the report's managed
+  // assignment. Team membership alone must not let a caller claim an unrelated
+  // repository's issue as the permanent reference for this finding.
+  const findingRepo = finding['repo'] as { github?: unknown } | null | undefined
+  const targetRepository = publicRepositoryName(reportRepoGithub({ repo: { github: findingRepo?.github || report.repo.github } }))
+  if (!targetRepository || targetRepository.toLowerCase() !== context.repository.toLowerCase()) throw new IssueError(400, 'bad-issue-repository')
+  const repository = snapshot.repositories.find(repo => repo.github.toLowerCase() === targetRepository.toLowerCase())
+  if (!repository || !githubAppConfigured(config)) return { mode: 'form' as const, labels, recheck }
+  const path = `/repos/${targetRepository.split('/').map(encodeURIComponent).join('/')}`
+  const installation = await github(`${path}/installation`, appJwt(config.githubAppId!, config.githubAppPrivateKey!), fetchImpl)
+  if (installation.status === 404) return { mode: 'form' as const, labels, recheck }
+  if (!installation.ok) throw new IssueError(502, 'github-unavailable')
+  let installed: { permissions?: { issues?: string } }
+  try { installed = await installation.json() } catch { throw new IssueError(502, 'github-unavailable') }
+  if (installed?.permissions?.issues !== 'write') return { mode: 'permissions' as const, authorizationPath: installUrl(config), labels, recheck }
+  const token = await issueUserToken(config, db, session.userId, fetchImpl)
+  if (!token) return { mode: 'authorize' as const, authorizationPath: ISSUE_LOGIN_PATH, labels, recheck }
+  // All requested labels are optional, including security and operator labels.
+  // Omit missing names rather than rejecting issue creation or creating labels.
+  const existingLabels: string[] = []
+  for (const name of labels) {
+    const label = await github(`${path}/labels/${encodeURIComponent(name)}`, token, fetchImpl)
+    if (label.status === 401) return { mode: 'authorize' as const, authorizationPath: ISSUE_LOGIN_PATH, labels, recheck }
+    if (label.status === 404) continue
+    if (!label.ok) throw new IssueError(502, 'github-unavailable')
+    existingLabels.push(name)
+  }
+  return { mode: 'api' as const, token, path, labels: existingLabels, recheck,
+    db, findingId: context.findingId, repoId: repository.repoId, repository: targetRepository, repoIds, userId: session.userId }
+}
+
+export async function createGithubIssue(prepared: Awaited<ReturnType<typeof prepareGithubIssue>>, input: unknown, fetchImpl: typeof fetch = fetch) {
+  if (prepared.mode !== 'api') throw new IssueError(409, 'github-authorization-required')
+  const { title, body } = input as { title?: unknown; body?: unknown }
+  if (typeof title !== 'string' || !title.trim() || title.length > 256 || typeof body !== 'string' || body.length > 65_536) throw new IssueError(400, 'bad-issue')
+  const { db, findingId } = prepared
+  const requestId = randomToken()
+  if (!await db.claimManagedIssue({ findingId, repoId: prepared.repoId, repository: prepared.repository,
+    requestId, createdBy: prepared.userId, createdAt: Date.now() })) {
+    const stored = await db.getManagedIssue(findingId)
+    await prepared.recheck()
+    // The competing request may have released its reservation after a definite
+    // failure. Still return a listing, never a fresh creation form, for this race.
+    return stored ? referenceResult(stored, prepared.repoIds)
+      : { mode: 'pending' as const, repositoryUrl: `https://github.com/${prepared.repository}/issues` }
+  }
+  // The last awaited operation before the external write checks current access.
+  // Release only when we know no issue was created; unknown outcomes stay claimed.
+  try { await prepared.recheck() }
+  catch (error) { await db.releaseManagedIssue(findingId, requestId); throw error }
+  const response = await github(`${prepared.path}/issues`, prepared.token, fetchImpl, { title: title.trim(), body, labels: prepared.labels })
+  if (response.status >= 400 && response.status < 500) await db.releaseManagedIssue(findingId, requestId)
+  if (response.status === 401) throw new IssueError(409, 'github-authorization-required')
+  if (response.status === 403) throw new IssueError(403, 'github-issue-forbidden')
+  if (!response.ok) throw new IssueError(response.status === 422 ? 422 : 502, response.status >= 500 ? 'github-create-uncertain' : 'github-create-failed')
+  let issue: { number?: unknown }
+  try { issue = await response.json() } catch { throw new IssueError(502, 'github-create-uncertain') }
+  if (!Number.isSafeInteger(issue?.number) || Number(issue.number) <= 0) throw new IssueError(502, 'github-create-uncertain')
+  // Construct the URL from validated inputs, never an upstream redirect target.
+  const number = Number(issue.number), url = `https://github.com${prepared.path.slice('/repos'.length)}/issues/${issue.number}`
+  if (!await db.finishManagedIssue(findingId, requestId, url)) throw new IssueError(502, 'github-create-uncertain')
+  let details = issueDetails(issue, url, number, { title, body, labels: prepared.labels }), detailsUnavailable = true
+  try {
+    const fetched = await github(`${prepared.path}/issues/${number}`, prepared.token, fetchImpl)
+    if (fetched.ok) {
+      details = issueDetails(await fetched.json(), url, number, { title, body, labels: prepared.labels })
+      detailsUnavailable = false
+    }
+  } catch { /* Creation and its permanent reference succeeded; detail reads are best effort. */ }
+  try { await prepared.recheck() }
+  catch {
+    // The external write and permanent reference succeeded. Withhold details
+    // if current access cannot be confirmed, but never advertise a safe retry.
+    return { mode: 'created-unavailable' as const }
+  }
+  return { url, issue: details, detailsUnavailable }
+}

package/server-managed/github-oauth.ts

@@ -1,22 +1,6 @@
-// GitHub App user-authorization (identity) for the managed server. This is the
-// GitHub *App* user-to-server flow, NOT an OAuth App: the authorize request
-// carries NO `scope` (a GitHub App's permissions live on the App itself), so
-// login asks for identity only — repo access is a SEPARATE installation flow
-// (later work), keeping the broad "act on your behalf" ask off of login.
-//
-//   GET /api/oauth/github/login     → 302 to github.com/login/oauth/authorize
-//                                      with a CSRF `state` mirrored into a
-//                                      short-lived state cookie.
-//   GET /api/oauth/github/callback   → verify `state` vs the cookie, exchange
-//                                      the code for a user token, read the
-//                                      GitHub identity, upsert the user, mint a
-//                                      session, set the cookie, 302 to the app.
-//
-// The user-to-server token is read for the identity AND persisted (see
-// db.setUserTokens): the "Manage repositories" page lists the user's repos with
-// it on demand (GET /user/repos — public repos with no App install; private
-// ones once the App is installed). `ensureUserAccessToken` refreshes it when the
-// App issues expiring tokens.
+// GitHub App user authorization for managed sign-in. Configure no additional
+// account permissions on the App. Repository permissions are granted separately
+// at installation; login does not install the App or request OAuth scopes.
 import { Buffer } from 'node:buffer'
 import type { AvatarStore } from './avatar-store.ts'
 import type { ManagedConfig } from './config.ts'
@@ -47,8 +31,8 @@ export interface CallbackDeps { config: ManagedConfig; db: ManagedDb; avatarStor
 
 // GET /api/oauth/github/login — redirect to GitHub, stashing the CSRF state. No
 // `scope` is sent: as the GitHub App user-authorization flow, the App's own
-// permission set governs access, so login requests identity only (repo access
-// is granted separately by installing the App).
+// permission set governs access. Keep account permissions minimal; repository
+// grants are approved separately when installing the App.
 export function buildLoginRedirect(config: ManagedConfig): { location: string; setCookie: string } {
   const state = randomToken()
   const u = new URL(GITHUB_AUTHORIZE_URL)
@@ -97,7 +81,7 @@ export async function handleCallback(
 }
 
 // Exchange the authorization code for a user-to-server token set.
-function exchangeCode(config: ManagedConfig, code: string, now: number, fetchImpl: typeof fetch): Promise<UserTokens> {
+export function exchangeCode(config: ManagedConfig, code: string, now: number, fetchImpl: typeof fetch): Promise<UserTokens> {
   return postToken({
     client_id: config.githubClientId, client_secret: config.githubClientSecret,
     code, redirect_uri: config.oauthCallbackUrl,
@@ -160,7 +144,7 @@ export async function ensureUserAccessToken(
 }
 
 // Read the authenticated user's identity (`GET /user`).
-async function fetchIdentity(token: string, fetchImpl: typeof fetch): Promise<ManagedUser> {
+export async function fetchIdentity(token: string, fetchImpl: typeof fetch): Promise<ManagedUser> {
   let res: Response
   try {
     res = await fetchImpl(GITHUB_USER_URL, {

package/server-managed/http.ts

@@ -23,6 +23,7 @@
 //   GET  /api/admin/repositories → admin repo list (each flagged selected) | 401/403
 //   POST /api/admin/repositories/select → admin selects/deactivates a repo | 401/403
 //   GET /api/admin/repositories/impact → admin attached data summary
+//   GET /api/admin/repositories/{browsable,refs,contents} → admin|manage + GitHub read access
 //   POST /api/admin/repositories/remove → admin permanently removes a repo
 //   GET  /api/admin/reports      → admin|manage list of uploaded reports | 401/403
 //   POST /api/admin/reports      → admin|manage uploads a report (raw body) | 401/403/413
@@ -58,7 +59,7 @@ import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
 import { bundleIntegrity, bundleKind, reportBundleHashes } from './bundle.ts'
 import type { ManagedConfig } from './config.ts'
-import type { ManagedDb, ManagedSession, StoredUser, TriageEventRow } from './db.ts'
+import type { ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
 import type { OriginGate } from '../server-common/origin.ts'
 import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
@@ -71,10 +72,11 @@ import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
 import { CONFIG_PATH, type ServerInfo } from '../common/server-info.ts'
-import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName } from './github-app.ts'
+import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName, repositoryInstallation } from './github-app.ts'
 import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
+import { createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
 import { clearCookie, endSession, readSession } from './session.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
@@ -82,6 +84,8 @@ import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamReports, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
 import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
+import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
+import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
 import { sendJson, writeResponse } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
@@ -97,8 +101,12 @@ const ADMIN_HISTORY_PATH = '/api/admin/history'
 const ADMIN_SCAN_MODELS_PATH = '/api/admin/scan/models'
 const SET_ROLE_PATH = '/api/admin/set-role'
 const ADMIN_REPOS_PATH = '/api/admin/repositories'
+const BROWSABLE_REPOS_PATH = '/api/admin/repositories/browsable'
+const REPO_REFS_PATH = '/api/admin/repositories/refs'
+const REPO_CONTENTS_PATH = '/api/admin/repositories/contents'
 const SELECT_REPO_PATH = '/api/admin/repositories/select'
 const ADD_PUBLIC_REPO_PATH = '/api/admin/repositories/add-public'
+const CONNECT_REPO_APP_PATH = '/api/admin/repositories/connect-app'
 const REPO_IMPACT_PATH = '/api/admin/repositories/impact'
 const REMOVE_REPO_PATH = '/api/admin/repositories/remove'
 const ADMIN_REPORTS_PATH = '/api/admin/reports'
@@ -140,6 +148,29 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
   sendJson(res, 200, { fixes })
 }
 
+async function handleWorkspaceIssue(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps,
+  cookie: string | undefined, teamId: string, query: URLSearchParams): Promise<void> {
+  if (req.method !== 'GET' && req.method !== 'POST') { send405(res, 'GET, POST'); return }
+  const s = req.method === 'GET' ? await readWorkspaceSession(res, deps, cookie) : await checkMutation(req, res, deps, cookie)
+  if (!s) return
+  if (!roleAtLeast(s.user.role, 'view')) { sendJson(res, 403, { error: 'forbidden' }); return }
+  let body: unknown = Object.fromEntries(query)
+  if (req.method === 'POST') {
+    try { body = await readJsonBody(req, MAX_ISSUE_BODY_BYTES) }
+    catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  }
+  const context = parseIssueContext(body)
+  const prepared = await prepareGithubIssue(deps.config, deps.db, deps.reportStore, s.session, teamId, context)
+  await prepared.recheck()
+  if (req.method === 'POST' && prepared.mode === 'api') {
+    sendJson(res, 201, await createGithubIssue(prepared, body)); return
+  }
+  sendJson(res, 200, { mode: prepared.mode, labels: prepared.labels,
+    ...(prepared.mode === 'existing' ? { url: prepared.url } : {}),
+    ...(prepared.mode === 'pending' ? { repositoryUrl: prepared.repositoryUrl } : {}),
+    ...(prepared.mode === 'authorize' || prepared.mode === 'permissions' ? { authorizationPath: prepared.authorizationPath } : {}) })
+}
+
 function activity(deps: ManagedHttpDeps, user: StoredUser, kind: ActivityInput['kind'], action: string, context: Pick<ActivityInput, 'repo' | 'reportId' | 'bundleId' | 'report' | 'repoId' | 'repoDirectory'> = {}): Promise<void> {
   return deps.db.recordActivity({ kind, actor: user.login, actorId: user.id, action, ...context }, Date.now())
 }
@@ -495,6 +526,43 @@ async function handleAddPublicRepository(req: IncomingMessage, res: ServerRespon
   await connectRepository(res, deps, s.user, repo)
 }
 
+// Associate an existing connection with this App without changing its active
+// state, ownership, team grants, or stored data. GitHub grants remain separate
+// from the per-user checks required for browsing source.
+async function handleConnectRepositoryApp(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
+  const s = await adminMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const repoId = (body as { repoId?: unknown } | null)?.repoId
+  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const repo = (await deps.db.listAllRepos()).find(row => row.repoId === repoId)
+  if (repo == null) { sendJson(res, 404, { error: 'repo-not-connected' }); return }
+  if (repo.installationId != null) { sendJson(res, 200, { connected: true }); return }
+  let installationId
+  try { installationId = await repositoryInstallation(deps.config, repo.repoId, repo.fullName) } catch (err) {
+    if (!(err instanceof GithubApiError)) throw err
+    // These credentials belong to the server App, not the user's session.
+    sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }); return
+  }
+  if (await readAdminSession(res, deps, cookie) == null) return
+  if (installationId == null) {
+    const current = (await deps.db.listAllRepos()).find(row => row.repoId === repoId)
+    if (current == null || current.fullName !== repo.fullName || current.addedAt !== repo.addedAt || current.installationId != null) {
+      sendJson(res, 409, { error: 'repo-connection-changed' }); return
+    }
+    const url = installUrl(deps.config)
+    if (url == null) { sendJson(res, 503, { error: 'github-app-not-configured' }); return }
+    sendJson(res, 200, { connected: false, installUrl: url }); return
+  }
+  if (!await deps.db.connectRepoInstallation(repo, installationId, s.session.id, Date.now())) {
+    sendJson(res, 409, { error: 'repo-connection-changed' }); return
+  }
+  await activity(deps, s.user, 'repository', 'connected GitHub App access', { repo: repo.fullName })
+  sendJson(res, 200, { connected: true })
+}
+
 // POST /api/admin/repositories/select — an admin toggles whether a repo is
 // active in the operate-on set. Mutation: same-origin + CSRF. Body { repoId,
 // selected }. selected:true verifies + records the read context; selected:false
@@ -786,6 +854,17 @@ async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, byte
   return { bundleId: null, integrity: hashes[0] ?? null }
 }
 
+async function sendUploadedReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, report: ReportRecord, deduped: boolean): Promise<void> {
+  const current = await checkMutation(req, res, deps, cookie)
+  if (!current || !requireManageRole(res, current.user)) return
+  // Uploading known bytes cannot reveal another team's report or its source
+  // bundle. The stored location/ownership wins over the upload headers.
+  if (!(await canViewReport(deps, current.user, report.id))) { sendJson(res, 409, { error: 'report-conflict' }); return }
+  const bundleId = report.bundleId != null && await canAccessBundle(deps, current.user, report.bundleId) ? report.bundleId : null
+  const { id, slug, filename, byteSize, sha256, repoId, repoDirectory, repoEmbedded, analyzer, visible } = report
+  sendJson(res, deduped ? 200 : 201, { id, slug, filename, byteSize, sha256, repoId, repoDirectory, repoEmbedded, analyzer, visible, bundleId, ...(deduped ? { deduped: true } : {}) })
+}
+
 // POST /api/admin/reports — upload a report. Mutation: same-origin + CSRF,
 // admin|manage. The body is the raw report bytes (any findings format — JSON /
 // markdown / CSV — archived as-is, like the e2e objstore; the server parses them
@@ -793,9 +872,9 @@ async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, byte
 // directory come from the report header, or from optional repository/directory
 // headers when the report has no repository metadata. The bundle link is
 // auto-resolved from the report's bundleHashes. New reports start hidden until
-// published. Bytes
+// published. Identical content reuses its stored identity and metadata. Bytes
 // are written first (keyed by a fresh uuid) then the metadata row — a failed
-// insert drops the orphan blob. 413 over the cap, 400 on empty.
+// insert or concurrent duplicate drops the orphan blob. 413 over the cap, 400 on empty.
 async function handleUploadReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   let s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
@@ -837,13 +916,18 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
     matchedRepo = legacyRepo.repoId == null ? null : selected.find((repo) => repo.repoId === legacyRepo.repoId) ?? null
   }
   if (matchedRepo && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, matchedRepo.repoId, directory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
+  const sha256 = createHash('sha256').update(bytes).digest('base64url')
+  // The analyzer also distinguishes a CSV from the same bytes previously
+  // uploaded under a filename that did not identify it as a report.
+  const existing = await deps.db.getReportByHash(sha256, analyzer)
+  if (existing) { await sendUploadedReport(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
-  const sha256 = createHash('sha256').update(bytes).digest('base64url')
   const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
   await deps.reportStore.put(id, bytes)
+  let report: ReportRecord
   try {
-    await deps.db.insertReport({
+    report = await deps.db.insertOrReuseReport({
       id, filename, contentType, byteSize: bytes.length, sha256,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
@@ -852,7 +936,8 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
     await deps.reportStore.delete(id).catch(() => {})
     throw err
   }
-  sendJson(res, 201, { id, slug: (await deps.db.getReport(id))!.slug, filename, byteSize: bytes.length, sha256, repoId: matchedRepo?.repoId ?? null, repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId })
+  if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
+  await sendUploadedReport(req, res, deps, cookie, report, report.id !== id)
 }
 
 // GET /api/admin/reports/<id> — download a stored report (admin|manage). Serves
@@ -925,6 +1010,64 @@ async function bundleRepos(deps: ManagedHttpDeps, user: StoredUser) {
   return repos.filter((_, index) => allowed[index])
 }
 
+async function repositoryBrowserUser(deps: ManagedHttpDeps, userId: string) {
+  const [githubUserId, token] = await Promise.all([
+    deps.db.getUserGithubId(userId), ensureUserAccessToken(deps.config, deps.db, userId, Date.now()),
+  ])
+  return { githubUserId, token }
+}
+
+// Listing connected repository names uses managed access only. Verify GitHub
+// access after selection, before returning any refs or source directory data.
+async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const s = await readManageSession(res, deps, cookie)
+  if (!s) return
+  sendJson(res, 200, { repos: selectableRepos(await bundleRepos(deps, s.user)) })
+}
+
+// Recheck repository/path grants after upstream reads, before returning names.
+async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const normalized = normalizeTeamPath(query.get('path') ?? '')
+  const ref = query.get('ref') ?? ''
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || !normalized.ok || ref.length > 1024 || /\p{Cc}/u.test(ref)) {
+    sendJson(res, 400, { error: 'bad-request' }); return
+  }
+  const path = normalized.path ?? ''
+  const authorize = async () => {
+    const s = await readManageSession(res, deps, cookie)
+    if (!s) return null
+    const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
+    if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
+    const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
+    const virtualEntries = scopedDirectory(path, scopes)
+    if (!refs && virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return { repo, virtualEntries, user: s.user }
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id))
+    const reader = await browser.reader(access.repo)
+    const commit = refs ? '' : await reader.commit(ref)
+    const result = refs ? await reader.refs() : access.virtualEntries
+      ? { entries: access.virtualEntries, limited: false } : await reader.directory(path, commit)
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, refs ? result : {
+      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false } : {}), path, commit,
+    })
+  } catch (err) {
+    if (err instanceof GithubApiError) {
+      sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+      return
+    }
+    throw err
+  }
+}
+
 function prebuildBundle(deps: ManagedHttpDeps, id: string) {
   if (!deps.bundleCache || deps.config.serverless) return
   deps.track((async () => {
@@ -1796,7 +1939,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path === CONFIG_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
-      sendJson(res, 200, { ...info, managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? { uploadChunkBytes: UPLOAD_CHUNK_BYTES } : {}) } })
+      sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
+        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? { uploadChunkBytes: UPLOAD_CHUNK_BYTES } : {}) } })
       return
     }
     // OAuth: start → redirect to GitHub with the CSRF state cookie.
@@ -1811,6 +1955,13 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path === CALLBACK_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       try {
+        if (isIssueOAuthCallback(config, url.searchParams, cookie)) {
+          const s = await readWorkspaceSession(res, deps, cookie)
+          if (!s) return
+          const result = await issueOAuthCallback(config, db, s.session, url.searchParams, cookie)
+          res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+          res.end(); return
+        }
         const result = await handleCallback(url.searchParams, cookie, { config, db, avatarStore })
         res.writeHead(302, { location: result.location, 'set-cookie': result.setCookies, 'cache-control': 'no-store' })
         res.end()
@@ -1820,6 +1971,14 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       return
     }
+    if (path === ISSUE_LOGIN_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const result = issueLoginRedirect(config, s.session)
+      res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+      res.end(); return
+    }
     // Who am I?
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
@@ -1837,6 +1996,10 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const managedDataPath = ['/api/admin', '/api/reports', '/api/bundles', '/api/teams', '/api/avatar', '/api/github']
       .some(prefix => path === prefix || path.startsWith(prefix + '/'))
     if (managedDataPath && await readWorkspaceSession(res, deps, cookie) == null) return
+    const issueRoute = /^\/api\/teams\/([^/]+)\/issues$/u.exec(path)
+    if (issueRoute) {
+      await handleWorkspaceIssue(req, res, deps, cookie, decodeURIComponent(issueRoute[1]!), url.searchParams); return
+    }
     if (path === '/api/admin/links') {
       if (!config.allowShare) { sendJson(res, 404, { error: 'sharing-disabled' }); return }
       if (method !== 'GET') { send405(res, 'GET'); return }
@@ -1887,9 +2050,18 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleRemoveRepository(req, res, deps, cookie); return
     }
+    if (path === BROWSABLE_REPOS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleBrowsableRepositories(res, deps, cookie); return
+    }
+    if (path === REPO_REFS_PATH || path === REPO_CONTENTS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryBrowser(res, deps, cookie, url.searchParams, path === REPO_REFS_PATH); return
+    }
     if (path === ADMIN_REPOS_PATH) { await handleListRepositories(req, res, deps, cookie, repositoryDiscovery); return }
     if (path === SELECT_REPO_PATH) { await handleSelectRepository(req, res, deps, cookie); return }
     if (path === ADD_PUBLIC_REPO_PATH) { await handleAddPublicRepository(req, res, deps, cookie); return }
+    if (path === CONNECT_REPO_APP_PATH) { await handleConnectRepositoryApp(req, res, deps, cookie); return }
     // Reports: list / upload on the exact path, download / delete per-id on the
     // prefix. Method-dispatched here since each path carries two verbs.
     if (path === ADMIN_REPORTS_PATH) {
@@ -2032,7 +2204,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
   return (req, res) => {
     if (isShuttingDown()) { sendJson(res, 503, { error: 'shutting-down' }, { connection: 'close' }); return }
     const work = route(req, res).catch((err) => {
-      if (err instanceof TeamReportsError && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
+      if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)
       if (res.headersSent) { try { res.destroy() } catch {} }
       else sendJson(res, 500, { error: 'internal' })

package/server-managed/managed-issues.ts

@@ -0,0 +1,47 @@
+import type { ManagedSql } from './sql.ts'
+
+// One immutable reference per finding, shared across reports and teams. Keep
+// reservations across crashes/uncertain GitHub responses to prevent duplicates.
+// No triage/import/admin patch accepts these fields.
+export const MANAGED_ISSUE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_finding_issue (
+  finding_id TEXT PRIMARY KEY,
+  repo_id INTEGER NOT NULL,
+  repository TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  issue_url TEXT,
+  created_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  created_at INTEGER NOT NULL
+) STRICT;
+`
+export interface ManagedIssue {
+  findingId: string
+  repoId: number
+  repository: string
+  requestId: string
+  issueUrl: string | null
+  createdBy: string | null
+  createdAt: number
+}
+export interface ManagedIssueStore {
+  getManagedIssue(findingId: string): Promise<ManagedIssue | null>
+  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl'>): Promise<boolean>
+  finishManagedIssue(findingId: string, requestId: string, url: string): Promise<boolean>
+  releaseManagedIssue(findingId: string, requestId: string): Promise<void>
+}
+export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
+  const get = db.prepare(`SELECT finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
+    issue_url AS issueUrl, created_by AS createdBy, created_at AS createdAt FROM managed_finding_issue WHERE finding_id = ?`)
+  const claim = db.prepare(`INSERT INTO managed_finding_issue (finding_id, repo_id, repository, request_id, created_by, created_at)
+    VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (finding_id) DO NOTHING`)
+  const finish = db.prepare(`UPDATE managed_finding_issue SET issue_url = ? WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
+  const release = db.prepare(`DELETE FROM managed_finding_issue WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
+  return {
+    async getManagedIssue(findingId) { return (await get.get(findingId) as ManagedIssue | undefined) ?? null },
+    async claimManagedIssue(issue) {
+      return Number((await claim.run(issue.findingId, issue.repoId, issue.repository, issue.requestId, issue.createdBy, issue.createdAt)).changes) > 0
+    },
+    async finishManagedIssue(findingId, requestId, url) { return Number((await finish.run(url, findingId, requestId)).changes) > 0 },
+    async releaseManagedIssue(findingId, requestId) { await release.run(findingId, requestId) },
+  }
+}