@preventive/triage 1.0.0-alpha.22 → 1.0.0-alpha.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.22",
+  "version": "1.0.0-alpha.23",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT",
   "author": {
@@ -109,6 +109,7 @@
     "server-managed/db-table-names.ts",
     "server-managed/db.ts",
     "server-managed/github-app.ts",
+    "server-managed/github-errors.ts",
     "server-managed/github-metadata.ts",
     "server-managed/github-issue-oauth.ts",
     "server-managed/github-issues.ts",

package/server-managed/db-methods.ts

@@ -281,6 +281,7 @@ export interface UserTeamReport {
   id: string
   slug: string
   filename: string
+  analyzer: string | null
   repoFullName: string | null
   repoDirectory: string
   cacheKey: string
@@ -748,7 +749,7 @@ function prepareStatements(db: ManagedSql) {
     // Reports attached to the repos of the user's teams, tagged by team (a report
     // shows under every team whose repo it's attached to). Newest first.
     selectUserTeamReportsStmt: db.prepare(
-      `SELECT DISTINCT tr.team_id AS teamId, r.id AS id, r.slug AS slug, r.filename AS filename, r.uploaded_at,
+      `SELECT DISTINCT tr.team_id AS teamId, r.id AS id, r.slug AS slug, r.filename AS filename, r.analyzer, r.uploaded_at,
               r.sha256 AS sha256, r.bundle_id AS bundleId, r.repo_id AS repoId, r.repo_directory AS repoDirectory, sr.full_name AS repoFullName,
               tu.view_dependencies AS dependencies, tu.view_security AS security,
               (SELECT role FROM managed_user WHERE id = tu.user_id) AS role
@@ -1194,14 +1195,14 @@ function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
       const scopes = await stmts.selectUserTeamScopesStmt.all(userId) as { teamId: string; repoId: number; path: string; fullName: string }[]
       const reportsByTeam = new Map<string, UserTeamReport[]>()
       for (const r of (await selectUserTeamReportsStmt.all(userId)) as {
-        teamId: string; id: string; slug: string; filename: string; sha256: string; bundleId: string | null; repoId: number
+        teamId: string; id: string; slug: string; filename: string; analyzer: string | null; sha256: string; bundleId: string | null; repoId: number
         repoDirectory: string; repoFullName: string | null; dependencies: number; security: number; role: string
       }[]) {
         const list = reportsByTeam.get(r.teamId) ?? []
         const cacheKey = createHash('sha256').update(JSON.stringify([
           r.sha256, r.bundleId, r.filename, r.repoId, r.repoDirectory, r.repoFullName, r.dependencies, r.security, r.role,
         ])).digest('base64url')
-        list.push({ id: r.id, slug: r.slug, filename: r.filename, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory, cacheKey })
+        list.push({ id: r.id, slug: r.slug, filename: r.filename, analyzer: r.analyzer, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory, cacheKey })
         reportsByTeam.set(r.teamId, list)
       }
       const bundlesByTeam = new Map<string, UserTeamBundle[]>()

package/server-managed/github-app.ts

@@ -5,6 +5,9 @@
 import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
 import type { ManagedConfig } from './config.ts'
+import { GithubApiError, throwGithubResponseError } from './github-errors.ts'
+
+export { GithubApiError } from './github-errors.ts'
 
 const GITHUB_API = 'https://api.github.com'
 const API_VERSION = '2022-11-28'
@@ -39,17 +42,6 @@ export interface ConnectedRepo {
   installationId: number | null
 }
 
-// A failure carrying the HTTP status the router should surface. 401 passes
-// through so the user-token path can map it to "log in again".
-export class GithubApiError extends Error {
-  status: number
-  constructor(status: number, message: string) {
-    super(message)
-    this.name = 'GithubApiError'
-    this.status = status
-  }
-}
-
 // App installation credentials are configured (id + private key present) →
 // private repos can be listed via its installation tokens.
 export function githubAppConfigured(config: ManagedConfig): boolean {
@@ -89,12 +81,8 @@ export async function githubJson(url: string, token: string | null, fetchImpl: t
       },
     })
   } catch { throw new GithubApiError(502, 'github-unreachable') }
-  if (res.status === 401) {
-    discardInstallationToken(token, fetchImpl)
-    throw new GithubApiError(401, 'github-unauthorized')
-  }
-  if (res.status === 404) throw new GithubApiError(404, 'github-not-found')
-  if (!res.ok) throw new GithubApiError(502, `github-status-${res.status}`)
+  if (res.status === 401) discardInstallationToken(token, fetchImpl)
+  if (!res.ok) await throwGithubResponseError(res)
   try { return await res.json() } catch { throw new GithubApiError(502, 'github-malformed') }
 }
 

package/server-managed/github-errors.ts

@@ -0,0 +1,28 @@
+// A failure carrying the HTTP status the router should surface. 401 passes
+// through so the user-token path can map it to "log in again".
+export class GithubApiError extends Error {
+  status: number
+  retryAfter: number | null
+  constructor(status: number, message: string, retryAfter: number | null = null) {
+    super(message)
+    this.name = 'GithubApiError'
+    this.status = status
+    this.retryAfter = retryAfter
+  }
+}
+
+export async function throwGithubResponseError(res: Response): Promise<never> {
+  if (res.status === 403 || res.status === 429) {
+    const body = await res.json().catch(() => null) as { message?: unknown } | null
+    if (res.status === 429 || res.headers.get('x-ratelimit-remaining') === '0' || res.headers.has('retry-after')
+      || (typeof body?.message === 'string' && /rate limit|abuse detection/iu.test(body.message))) {
+      const retry = Number(res.headers.get('retry-after'))
+      const reset = Number(res.headers.get('x-ratelimit-reset')) * 1000
+      const wait = Math.max(Number.isFinite(retry) ? retry : 0, Number.isFinite(reset) ? (reset - Date.now()) / 1000 : 0)
+      throw new GithubApiError(429, 'github-rate-limited', Math.max(60, Math.ceil(wait)))
+    }
+  }
+  if (res.status === 401) throw new GithubApiError(401, 'github-unauthorized')
+  if (res.status === 404) throw new GithubApiError(404, 'github-not-found')
+  throw new GithubApiError(502, `github-status-${res.status}`)
+}

package/server-managed/http.ts

@@ -1060,7 +1060,10 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
       ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false } : {}), path, commit,
     })
   } catch (err) {
-    if (err instanceof GithubApiError) { sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }); return }
+    if (err instanceof GithubApiError) {
+      sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+      return
+    }
     throw err
   }
 }

package/server-managed/repository-browser.ts

@@ -16,6 +16,10 @@ export function scopedDirectory(path: string, scopes: (string | null)[]): Reposi
 export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
 type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
 
+function credentialFailure(err: unknown): err is GithubApiError {
+  return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
+}
+
 // Create once per HTTP request. Coalesce concurrent credential lookups without
 // caching repository visibility or permissions, or sharing credentials across users.
 export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
@@ -32,31 +36,40 @@ export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryB
     return identity
   }
   return {
-    async reader(repo: SelectedRepo) {
-      let token = Promise.resolve<string | null>(null)
-      if (repo.installationId != null) {
+    reader(repo: SelectedRepo) {
+      const installationToken = () => {
+        if (repo.installationId == null) return Promise.resolve(null)
         const cached = tokens.get(repo.installationId)
-        token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
-          if (!(err instanceof GithubApiError)) throw err
-          // Stale installations cannot prevent verified anonymous public access.
+        const token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
+          if (!credentialFailure(err)) throw err
+          // Stale installations cannot prevent verified public access.
           return null
         })
         if (!cached) tokens.set(repo.installationId, token)
+        return token
       }
-      return repositoryReader(repo, await token, getIdentity, fetchImpl)
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
     },
   }
 }
 
-async function repositoryReader(repo: SelectedRepo, token: string | null, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
   const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate.
+  let token = userToken ?? await installationToken()
   const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
   const metadata = async () => {
     try { return await read('') }
     catch (err) {
-      if (!token || !(err instanceof GithubApiError)) throw err
-      // A valid installation token may have lost this particular repository.
-      // After falling back, all reads and rechecks stay anonymous.
+      if (!token || !credentialFailure(err)) throw err
+      const fallback = await installationToken()
+      if (fallback && fallback !== token) {
+        token = fallback
+        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+      }
+      // Anonymous fallback is only for unavailable credentials, never rate
+      // limits, network errors, or GitHub outages.
       token = null
       return read('')
     }
@@ -70,9 +83,12 @@ async function repositoryReader(repo: SelectedRepo, token: string | null, getIde
     }
     if (data.private === false && data.visibility === 'public') return data
     if (!token) throw new GithubApiError(404, 'no-repository')
-    if (!(await githubRepoReadPermission(repo.fullName, token, await getIdentity(freshIdentity), fetchImpl))) {
+    const appToken = await installationToken()
+    if (!appToken) throw new GithubApiError(404, 'no-repository')
+    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
       throw new GithubApiError(404, 'no-repository')
     }
+    token = appToken
     return data
   }
   const current = await checkAccess()

package/server-managed/workspace-shares.ts

@@ -71,7 +71,7 @@ function shareQueries(db: ManagedSql) {
   const repositories = db.prepare(`SELECT tr.repo_id AS repoId, sr.full_name AS github, tr.path
     FROM managed_team_repo tr JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
     WHERE tr.team_id = ? ORDER BY tr.repo_id, tr.path`)
-  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.byte_size AS byteSize,
+  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.analyzer, r.byte_size AS byteSize,
     r.sha256, r.repo_directory AS directory, sr.full_name AS github
     FROM managed_team_repo tr JOIN managed_report r ON r.repo_id = tr.repo_id
     JOIN managed_selected_repo sr ON sr.repo_id = r.repo_id
@@ -128,7 +128,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       if (!grant) return null
       const { dependencies, security, ...team } = grant
       const permissions = { dependencies: dependencies === 1, security: security === 1 }
-      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; byteSize: number; sha256: string; directory: string; github: string }[]
+      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; analyzer: string | null; byteSize: number; sha256: string; directory: string; github: string }[]
       const bundleRows = await q.bundles.all(team.id) as (ManagedBundle & { repoFullName: string })[]
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
@@ -138,7 +138,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team,
-          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, repoFullName: row.github, repoDirectory: row.directory,
+          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,
             filename: row.filename, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName })),