@preventive/triage 1.0.0-alpha.22 → 1.0.0-alpha.25

package/server-managed/package-entry-points.ts

@@ -0,0 +1,51 @@
+import { Buffer } from 'node:buffer'
+import { normalizeTeamPath } from './repo-path.ts'
+
+export const MAX_PACKAGE_BYTES = 256 * 1024
+const MAX_ENTRY_POINTS = 100
+
+// Declared paths, not a Node resolver: never guess defaults, expand export
+// patterns, or execute package code. Keep every suggestion in its package.
+export function packageEntryPoints(manifest: unknown, directory: string): string[] {
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return []
+  const pkg = manifest as { main?: unknown; exports?: unknown; bin?: unknown }
+  const paths = new Set<string>()
+  const add = (value: unknown) => {
+    if (typeof value !== 'string' || value.startsWith('/') || value.endsWith('/') || /[*?]|^[a-z][a-z\d+.-]*:/iu.test(value)) return
+    const normalized = normalizeTeamPath(value)
+    if (!normalized.ok || !normalized.path || normalized.path === 'package.json') return
+    const path = directory ? `${directory}/${normalized.path}` : normalized.path
+    if (path.length <= 500 && paths.size < MAX_ENTRY_POINTS) paths.add(path)
+  }
+  add(pkg.main)
+  const pending = [pkg.exports]
+  for (let visited = 0; pending.length > 0 && visited < 4096; visited++) {
+    const value = pending.pop()
+    if (typeof value === 'string') { if (value.startsWith('./')) add(value); continue }
+    if (Array.isArray(value)) pending.push(...value.slice(0, 4096 - visited).toReversed())
+    else if (value && typeof value === 'object') {
+      const entries = Object.entries(value).filter(([key]) => key !== 'types' && !key.startsWith('types@'))
+      pending.push(...entries.slice(0, 4096 - visited).toReversed().map(([, target]) => target))
+    }
+  }
+  if (typeof pkg.bin === 'string') add(pkg.bin)
+  else if (pkg.bin && typeof pkg.bin === 'object' && !Array.isArray(pkg.bin)) Object.values(pkg.bin).forEach(add)
+  return [...paths]
+}
+
+// Use the immutable blob from the authorized listing, never download_url or a
+// resolved symlink target. Malformed or oversized manifests are optional.
+export async function readPackageEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
+  try {
+    const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
+    if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
+      || blob.size < 0 || blob.size > MAX_PACKAGE_BYTES || blob.content.length > MAX_PACKAGE_BYTES * 2) return []
+    const bytes = Buffer.from(blob.content, 'base64')
+    if (bytes.length !== blob.size || bytes.length > MAX_PACKAGE_BYTES) return []
+    return packageEntryPoints(JSON.parse(bytes.toString('utf8')), directory)
+  } catch {
+    // Suggestions must not prevent browsing. The handler still rechecks
+    // GitHub and managed access after this optional upstream read.
+    return []
+  }
+}

package/server-managed/public-workspace.ts

@@ -8,7 +8,6 @@ import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { sendJson } from './http-response.ts'
 import { hashToken } from './crypto.ts'
 import { TeamReportsError, loadTeamReports, teamReportVisibility } from './team-reports.ts'
-import { MAX_FINDING_ID, MAX_TRIAGE_HISTORY } from '../common/managed/triage.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
@@ -30,7 +29,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed)$/u.exec(url.pathname)
-  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|triage\/history|comments|sources)$/u.exec(url.pathname)
+  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
   const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
@@ -85,15 +84,6 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
     await recheck()
     if (part === 'sources') { await sources(res, deps, snapshot, id, visible.sourcePaths, recheck, stream); return }
     if (part === 'comments') { await send({ comments: await deps.db.listComments([...visible.ids]) }); return }
-    if (part === 'triage/history') {
-      const finding = url.searchParams.get('finding') ?? ''
-      if (!finding || finding.length > MAX_FINDING_ID) { json(res, 400, { error: 'bad-request' }); return }
-      if (!visible.ids.has(finding)) { json(res, 404, { error: 'no-finding' }); return }
-      const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map(row => ({
-        seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
-      }))
-      await send({ finding, events }); return
-    }
     const entries = Object.fromEntries((await deps.db.listTriage([...visible.ids])).map(row => [row.findingId, triageWireEntry(row)]))
     await send({ entries }); return
   }

package/server-managed/repository-browser.ts

@@ -1,6 +1,7 @@
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -16,6 +17,10 @@ export function scopedDirectory(path: string, scopes: (string | null)[]): Reposi
 export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
 type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
 
+function credentialFailure(err: unknown): err is GithubApiError {
+  return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
+}
+
 // Create once per HTTP request. Coalesce concurrent credential lookups without
 // caching repository visibility or permissions, or sharing credentials across users.
 export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
@@ -32,31 +37,40 @@ export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryB
     return identity
   }
   return {
-    async reader(repo: SelectedRepo) {
-      let token = Promise.resolve<string | null>(null)
-      if (repo.installationId != null) {
+    reader(repo: SelectedRepo) {
+      const installationToken = () => {
+        if (repo.installationId == null) return Promise.resolve(null)
         const cached = tokens.get(repo.installationId)
-        token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
-          if (!(err instanceof GithubApiError)) throw err
-          // Stale installations cannot prevent verified anonymous public access.
+        const token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
+          if (!credentialFailure(err)) throw err
+          // Stale installations cannot prevent verified public access.
           return null
         })
         if (!cached) tokens.set(repo.installationId, token)
+        return token
       }
-      return repositoryReader(repo, await token, getIdentity, fetchImpl)
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
     },
   }
 }
 
-async function repositoryReader(repo: SelectedRepo, token: string | null, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
   const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate.
+  let token = userToken ?? await installationToken()
   const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
   const metadata = async () => {
     try { return await read('') }
     catch (err) {
-      if (!token || !(err instanceof GithubApiError)) throw err
-      // A valid installation token may have lost this particular repository.
-      // After falling back, all reads and rechecks stay anonymous.
+      if (!token || !credentialFailure(err)) throw err
+      const fallback = await installationToken()
+      if (fallback && fallback !== token) {
+        token = fallback
+        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+      }
+      // Anonymous fallback is only for unavailable credentials, never rate
+      // limits, network errors, or GitHub outages.
       token = null
       return read('')
     }
@@ -70,9 +84,12 @@ async function repositoryReader(repo: SelectedRepo, token: string | null, getIde
     }
     if (data.private === false && data.visibility === 'public') return data
     if (!token) throw new GithubApiError(404, 'no-repository')
-    if (!(await githubRepoReadPermission(repo.fullName, token, await getIdentity(freshIdentity), fetchImpl))) {
+    const appToken = await installationToken()
+    if (!appToken) throw new GithubApiError(404, 'no-repository')
+    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
       throw new GithubApiError(404, 'no-repository')
     }
+    token = appToken
     return data
   }
   const current = await checkAccess()
@@ -105,7 +122,11 @@ async function repositoryReader(repo: SelectedRepo, token: string | null, getIde
         const type = item.submodule_git_url ? 'submodule' : item.type
         if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
       }
-      return { entries, limited: data.length >= 1000 }
+      const manifestPath = path ? `${path}/package.json` : 'package.json'
+      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
+        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}) }
     },
   }
 }

package/server-managed/sql.ts

@@ -4,6 +4,11 @@ import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
 
 type MaybePromise<T> = T | Promise<T>
+// A failed COMMIT acknowledgement (or connection close after COMMIT) does not
+// establish rollback. Callers must retain primary bytes until reconciled.
+export class ManagedCommitError extends Error {
+  constructor(cause: unknown) { super('Managed commit outcome is uncertain', { cause }) }
+}
 export interface ManagedSql {
   prepare(sql: string): {
     get(...params: unknown[]): MaybePromise<unknown>

package/server-managed/workspace-shares.ts

@@ -71,7 +71,7 @@ function shareQueries(db: ManagedSql) {
   const repositories = db.prepare(`SELECT tr.repo_id AS repoId, sr.full_name AS github, tr.path
     FROM managed_team_repo tr JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
     WHERE tr.team_id = ? ORDER BY tr.repo_id, tr.path`)
-  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.byte_size AS byteSize,
+  const reports = db.prepare(`SELECT DISTINCT r.id, r.slug, r.filename, r.analyzer, r.byte_size AS byteSize,
     r.sha256, r.repo_directory AS directory, sr.full_name AS github
     FROM managed_team_repo tr JOIN managed_report r ON r.repo_id = tr.repo_id
     JOIN managed_selected_repo sr ON sr.repo_id = r.repo_id
@@ -128,7 +128,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       if (!grant) return null
       const { dependencies, security, ...team } = grant
       const permissions = { dependencies: dependencies === 1, security: security === 1 }
-      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; byteSize: number; sha256: string; directory: string; github: string }[]
+      const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; analyzer: string | null; byteSize: number; sha256: string; directory: string; github: string }[]
       const bundleRows = await q.bundles.all(team.id) as (ManagedBundle & { repoFullName: string })[]
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
@@ -138,7 +138,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team,
-          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, repoFullName: row.github, repoDirectory: row.directory,
+          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,
             filename: row.filename, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName })),