@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.23",
+  "version": "1.0.0-alpha.25",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT",
   "author": {
@@ -119,7 +119,9 @@
     "server-managed/http.ts",
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
+    "server-managed/management.ts",
     "server-managed/index.ts",
+    "server-managed/package-entry-points.ts",
     "server-managed/public-workspace.ts",
     "server-managed/repo-path.ts",
     "server-managed/report-migration.ts",
@@ -153,6 +155,7 @@
     "report/index.js",
     "report/src/finding-id.js",
     "report/src/finding.js",
+    "report/src/severity.js",
     "report/src/security.js",
     "report/src/labels.js",
     "report/src/md-structure.js",

package/report/index.js

@@ -82,6 +82,7 @@ import { parseDeepviewMarkdown } from './src/parse-deepview-md.js'
 import { parseMarkdownFindings } from './src/parse-md.js'
 import { parsePioliumFindings } from './src/parse-piolium.js'
 import { deriveFindingId } from './src/finding-id.js'
+import { normalizeFindingSeverity } from './src/severity.js'
 
 // The rest of the surface, so a consumer needs one import: the codex
 // splitter, the id helpers the analyzer shares with the viewer, and the
@@ -193,7 +194,10 @@ export function readReport(content) {
   let jsonError
   try {
     const data = JSON.parse(content)
-    if (reportEntries(data)) return { data, format: 'json', reason: null }
+    if (reportEntries(data)) {
+      for (const finding of flattenFindings(reportEntries(data))) normalizeFindingSeverity(finding)
+      return { data, format: 'json', reason: null }
+    }
     return { data: null, format: null, reason: 'JSON, but not a report: no findings array' }
   } catch (err) {
     jsonError = err
@@ -233,6 +237,8 @@ function flattenFindings(entries) {
 // untouched. Batched via Promise.all — sequential awaits would
 // serialise hundreds of crypto.subtle.digest calls for no reason.
 export async function backfillFindingIds(findings) {
+  // Managed responses may arrive as already-parsed objects.
+  for (const finding of findings) normalizeFindingSeverity(finding)
   const idLess = findings.filter((f) => !f.id)
   if (idLess.length === 0) return
   const derived = await Promise.all(idLess.map(deriveFindingId))

package/report/src/finding-id.js

@@ -71,7 +71,7 @@ export async function deriveFindingId(f) {
 // The choice above as the object that gets hashed. Key order is part of
 // the id — JSON.stringify keeps insertion order — so every shape lists
 // severity and description first.
-function fingerprintOf(f) {
+export function fingerprintOf(f) {
   if (f._idBasis) return f._idBasis
   const { severity, description } = f
   if (f.fileHash) return { severity, description, fileHash: f.fileHash }

package/report/src/finding.js

@@ -8,6 +8,7 @@
 
 import { fenceRanges, inFence } from './md-structure.js'
 import { SOURCE_LABELS } from './labels.js'
+import { canonicalSeverity } from './severity.js'
 
 // Severity ranking — higher = more severe. Two stacks: vulnerabilities
 // (critical → low) over bug-class findings (high_bug → bug), with
@@ -33,6 +34,7 @@ export const SEVERITIES = ['critical', 'high', 'medium', 'low', 'high_bug', 'bug
 // Only a known tier counts: an unrecognised one would sort to rank 0 and
 // render an uncolored badge, so the intrinsic severity stands instead.
 function validCorrected(corrected) {
+  corrected = canonicalSeverity(corrected)
   return corrected != null && corrected in SEVERITY_ORDER ? corrected : null
 }
 
@@ -40,20 +42,20 @@ function validCorrected(corrected) {
 // correction — it IS that report's finding — so no report key is needed;
 // divergence across reports comes from correctedVariants.
 export function effectiveSeverity(f) {
-  return validCorrected(f?.correctedSeverity) ?? f?.severity
+  return validCorrected(f?.correctedSeverity) ?? canonicalSeverity(f?.severity)
 }
 
 // True when the finding carries a valid correction that actually changes
 // the tier — the trigger for the dual badge / reason affordance.
 export function hasSeverityCorrection(f) {
   const c = validCorrected(f?.correctedSeverity)
-  return c != null && c !== f?.severity
+  return c != null && c !== canonicalSeverity(f?.severity)
 }
 
 // Every display, count and sort site reads severity through this with the
 // current lens (`state.severityMode`), not off `f.severity`.
 export function displayedSeverity(f, mode) {
-  return mode === 'original' ? f?.severity : effectiveSeverity(f)
+  return mode === 'original' ? canonicalSeverity(f?.severity) : effectiveSeverity(f)
 }
 
 // The per-report map of a deduped survivor, but only where the reports
@@ -61,7 +63,7 @@ export function displayedSeverity(f, mode) {
 export function correctedVariants(f) {
   const byReport = f?._correctedByReport
   if (!byReport) return null
-  const tiers = new Set(Object.values(byReport).map((v) => v?.severity))
+  const tiers = new Set(Object.values(byReport).map((v) => canonicalSeverity(v?.severity)))
   return tiers.size > 1 ? byReport : null
 }
 

package/report/src/labels.js

@@ -3,6 +3,8 @@
 // export dialog, the analyzer dropdown, the page header — so a filter
 // the dialog lists and the header line in the file can't disagree.
 
+import { canonicalSeverity } from './severity.js'
+
 export const SEVERITY_LABELS = {
   critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low',
   high_bug: 'High bug', bug: 'Bug', informational: 'Informational',
@@ -29,5 +31,5 @@ export const SOURCE_LABELS = {
 // invent one, and the reader is better served by the word than by a
 // blank.
 export function severityLabel(severity) {
-  return SEVERITY_LABELS[severity] ?? String(severity ?? '')
+  return SEVERITY_LABELS[canonicalSeverity(severity)] ?? String(severity ?? '')
 }

package/report/src/parse-codex.js

@@ -14,6 +14,8 @@
 // Only the first path in `relevant_paths` becomes `f.file` (some
 // findings list several, as `path1 | path2 | …`); the rest are dropped.
 
+import { normalizeFindingSeverity } from './severity.js'
+
 const REQUIRED_COLUMNS = [
   'finding_url', 'repository', 'title', 'description', 'severity',
   'configured_scan_id', 'relevant_paths',
@@ -143,5 +145,5 @@ function rowToFinding(r) {
   if (r.commit_hash) finding.commitHash = r.commit_hash
   if (r.detected_at) finding.detectedAt = r.detected_at
   if (r.committed_at) finding.committedAt = r.committed_at
-  return finding
+  return normalizeFindingSeverity(finding)
 }

package/report/src/parse-deepsec.js

@@ -30,6 +30,7 @@
 // `## SEVERITY (n)` header appears and the chain moves on.
 
 import { normalizeNewlines, splitHeadingLine } from './md-structure.js'
+import { normalizeFindingSeverity } from './severity.js'
 
 // The `## SEVERITY (n)` header that marks a DeepSec document. Splitting
 // on it with the tier captured interleaves tiers and content:
@@ -50,6 +51,7 @@ function mapSeverity(s) {
     case 'HIGH_BUG': return 'high_bug'
     case 'BUG': return 'bug'
     case 'INFO': case 'INFORMATIONAL': return 'informational'
+    case 'INFORMATIVE': return 'informative'
     default: return 'medium'
   }
 }
@@ -193,5 +195,5 @@ function parseBlock(block, severity) {
     if (fields.reasoning) finding.revalidateVerdict = fields.reasoning.replaceAll('**', '')
   }
   if (fields.slug) finding.slug = fields.slug
-  return finding
+  return normalizeFindingSeverity(finding, severity === 'informative' ? 'medium' : severity)
 }

package/report/src/parse-deepview-md.js

@@ -56,6 +56,7 @@
 import { locationLabel } from './finding.js'
 import { H2_RE, H3_RE, H4_RE, normalizeNewlines, splitByHeading, splitLeading } from './md-structure.js'
 import { applyFact, buildDescription, narrativeSplit, readAnalyzer, readEvidence, readProse, readRepository, splitFacts, splitSections, tierOf } from './parse-deepview-fields.js'
+import { normalizeFindingSeverity } from './severity.js'
 
 const MARKER_RE = /^<!--\s*DeepView findings export\b[^>]*-->/u
 const CASE_RE = /^Case \d+ of \d+(?:\s|$)/u
@@ -136,7 +137,7 @@ function readCase(body, depth, entryTitle, tier) {
   for (const [field, value] of fields) f[field] = value
   const reason = sections.find((s) => s.label.toLowerCase() === 'severity correction')
   if (reason?.body) f.correctedSeverityReason = readProse(reason.body)
-  return { finding: f, analyzer }
+  return { finding: normalizeFindingSeverity(f), analyzer }
 }
 
 // The producer and the run for the whole report: from the Analyzer facts

package/report/src/parse-md.js

@@ -30,9 +30,10 @@
 // carry anything mandatory.
 
 import { frozenIdBasis } from './parse-md-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import { LIST_MARKER_RE, findMdLink, normalizeNewlines, splitHeadingLine, unescapeMd } from './md-structure.js'
 
-const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'high_bug', 'bug', 'informational'])
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'high_bug', 'bug', 'informational', 'informative'])
 
 export function parseMarkdownFindings(content) {
   const text = normalizeNewlines(content).trim()
@@ -115,7 +116,7 @@ function parseBlock(block) {
   const idBasis = frozenIdBasis(block)
   if (idBasis) finding._idBasis = idBasis
 
-  return finding
+  return normalizeFindingSeverity(finding)
 }
 
 // The sections half (before the first `---`) and the metadata half

package/report/src/parse-piolium-rows.js

@@ -5,8 +5,9 @@
 
 import { cellValue, parseCodeRef, stripBold, tableObjects } from './md-structure.js'
 import { frozenIdBasis } from './parse-piolium-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import {
-  idCell, leadingId, leadingLink, mapSeverity, severityFromId, slugTitle,
+  idCell, leadingId, leadingLink, mapSeverity, resolveSeverity, severityFromId, slugTitle,
 } from './parse-piolium-tokens.js'
 
 // Normalize a table-row object to the shared row shape used by the
@@ -33,10 +34,7 @@ export function indexRowOf(obj) {
 // namespaced to read as an opaque token rather than a URL. A Location
 // column, where a table has one, is parsed like any code reference.
 export function fromIndexRow(row, sevFallback = '') {
-  const severity = mapSeverity(row.severity)
-    || sevFallback
-    || severityFromId(row.id)
-    || 'medium'
+  const { severity, identitySeverity } = resolveSeverity(mapSeverity(row.severity), sevFallback, severityFromId(row.id))
   const { file, line, locationLink } = parseCodeRef(row.location || '')
   const finding = {
     file: file || 'unknown',
@@ -49,12 +47,12 @@ export function fromIndexRow(row, sevFallback = '') {
   // The fingerprint reads the same reference its own way — see
   // parse-piolium-id.js.
   finding._idBasis = frozenIdBasis({
-    severity, description: finding.description, ref: row.location || '', id: row.id,
+    severity: identitySeverity, description: finding.description, ref: row.location || '', id: row.id,
   })
   if (row.pocStatus) finding.pocStatus = row.pocStatus
   if (row.status) finding.status = row.status
   if (row.parent) finding.parent = row.parent
-  return finding
+  return normalizeFindingSeverity(finding)
 }
 
 // Findings rendered as a list: the mode outline asks for "links to
@@ -92,10 +90,7 @@ export function listFindings(body, sev, index) {
     }
 
     const row = index.get(id)
-    const severity = mapSeverity(row?.severity)
-      || sev
-      || severityFromId(id)
-      || 'medium'
+    const { severity, identitySeverity } = resolveSeverity(mapSeverity(row?.severity), sev, severityFromId(id))
     const finding = { file: 'unknown', line: '?', severity, description: stripBold(title) }
     if (id) finding.location = `piolium:${id}`
     else if (link) finding.location = link
@@ -103,7 +98,7 @@ export function listFindings(body, sev, index) {
     if (row?.pocStatus) finding.pocStatus = row.pocStatus
     if (row?.status) finding.status = row.status
     if (row?.parent) finding.parent = row.parent
-    out.push({ id, finding })
+    out.push({ id, finding: normalizeFindingSeverity(finding, identitySeverity) })
   }
   return out
 }

package/report/src/parse-piolium-tokens.js

@@ -23,10 +23,20 @@ export function mapSeverity(s) {
     case 'MEDIUM': return 'medium'
     case 'LOW': return 'low'
     case 'INFO': case 'INFORMATIONAL': return 'informational'
+    case 'INFORMATIVE': return 'informative'
     default: return ''
   }
 }
 
+// Keep the pre-alias fallback for the ID fingerprint, while displaying the
+// newly recognized tier. Inputs are ordered from strongest to weakest source.
+export function resolveSeverity(...tiers) {
+  return {
+    severity: tiers.find(Boolean) || 'medium',
+    identitySeverity: tiers.find(tier => tier && tier !== 'informative') || 'medium',
+  }
+}
+
 // Final-report ids are severity-prefixed and sequential — `C1`, `H2`,
 // `H-001` in lite consolidation — so the prefix is a second source for
 // the tier. Only that exact scheme counts: a bare leading letter would
@@ -42,7 +52,7 @@ export function severityFromId(id) {
 // findings. Anchored to the whole heading, so "High memory usage in
 // parser" is never mistaken for one.
 export function severityGroupOf(heading) {
-  const m = /^(critical|high|medium|low|informational|info)(?:[ -](?:severity|risk))?(?:[ -]findings?)?(?:\s*\(\d+\))?$/iu
+  const m = /^(critical|high|medium|low|informational|informative|info)(?:[ -](?:severity|risk))?(?:[ -]findings?)?(?:\s*\(\d+\))?$/iu
     .exec((heading || '').trim())
   return m ? mapSeverity(m[1]) : ''
 }
@@ -51,7 +61,7 @@ export function severityGroupOf(heading) {
 // `High: remaining` — for sections recognized by their CONTENT rather
 // than the anchored severityGroupOf shape.
 export function headerSeverity(header) {
-  const m = /^(critical|high|medium|low|informational|info)\b/iu.exec((header || '').trim())
+  const m = /^(critical|high|medium|low|informational|informative|info)\b/iu.exec((header || '').trim())
   return m ? mapSeverity(m[1]) : ''
 }
 

package/report/src/parse-piolium.js

@@ -64,11 +64,12 @@
 
 import { H2_RE, H3_RE, H4_RE, normalizeNewlines, parseCodeRef, parseLabelledFields, splitByHeading, splitLeading, tableObjects } from './md-structure.js'
 import { frozenIdBasis } from './parse-piolium-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import { fromIndexRow, indexRowOf, listFindings, variantFindings } from './parse-piolium-rows.js'
 import {
   CODE_REF_FIELDS, codeRefOf, headerSeverity, idCell, idFromToken,
   isVariantsHeading, mapSeverity, parseHeading, preambleMeta,
-  severityFromId, severityGroupOf,
+  resolveSeverity, severityFromId, severityGroupOf,
 } from './parse-piolium-tokens.js'
 
 
@@ -295,11 +296,9 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   // Precedence: the block's own bullet, the index row, the enclosing
   // group, the id's prefix, then medium — where an unrecognized tier
   // stays visible rather than dropping out.
-  const severity = mapSeverity(fields.severity)
-    || mapSeverity(row?.severity)
-    || groupSeverity
-    || severityFromId(id)
-    || 'medium'
+  const { severity, identitySeverity } = resolveSeverity(
+    mapSeverity(fields.severity), mapSeverity(row?.severity), groupSeverity, severityFromId(id),
+  )
 
   const ref = parseCodeRef(codeRefOf(fields))
   // A `**Line:**` / `**Lines:**` bullet supplies the line when the
@@ -332,7 +331,7 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   // not. finding-id.js prefers `_idBasis` when deriving the uuid; read
   // that module's header before touching either side.
   finding._idBasis = frozenIdBasis({
-    severity, description: finding.description, ref: codeRefOf(fields), lineBullet, id,
+    severity: identitySeverity, description: finding.description, ref: codeRefOf(fields), lineBullet, id,
   })
   // Auxiliary provenance, kept as plain strings so an export can cite
   // the audit's own artifacts — as parse-md.js keeps branch / status.
@@ -344,7 +343,7 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   const parent = row?.parent || (variantOf ? idCell(variantOf[1]) : '')
   if (parent) finding.parent = parent
 
-  return { id, finding }
+  return { id, finding: normalizeFindingSeverity(finding) }
 }
 
 // The `## ` sections, keyed case-folded. A repeated header CONCATENATES

package/report/src/severity.js

@@ -0,0 +1,18 @@
+import { fingerprintOf } from './finding-id.js'
+
+// Informative is an input spelling of the existing Informational tier.
+export function canonicalSeverity(value) {
+  return typeof value === 'string' && value.trim().toLowerCase() === 'informative' ? 'informational' : value
+}
+
+// Normalize presentation without re-keying stored triage. Markdown parsers
+// can supply the severity their previous fallback used for the fingerprint.
+export function normalizeFindingSeverity(finding, identitySeverity = finding.severity) {
+  const severity = canonicalSeverity(finding.severity)
+  if (severity !== finding.severity) {
+    if (!finding.id && !finding._idBasis) finding._idBasis = fingerprintOf({ ...finding, severity: identitySeverity })
+    finding.severity = severity
+  }
+  if (finding.correctedSeverity !== undefined) finding.correctedSeverity = canonicalSeverity(finding.correctedSeverity)
+  return finding
+}

package/server-common/vercel-blob.ts

@@ -17,6 +17,7 @@ import type { Buffer } from 'node:buffer'
 
 type VercelBlobBody = Readable | Buffer | string | Blob | ArrayBuffer | ReadableStream<Uint8Array>
 export type VercelBlobSdk = {
+  BlobNotFoundError: new () => Error
   put: (
     pathname: string,
     body: VercelBlobBody,
@@ -83,24 +84,12 @@ export type VercelBlobSdk = {
 }
 
 // Recognise "blob is gone" errors uniformly across read/write/delete
-// paths so callers can treat them as success (delete) or
-// not-found (read). The SDK exposes BlobNotFoundError as a class with
-// `.name === 'BlobNotFoundError'`; checking the name string avoids
-// importing the class at the top level (which would force the optional
-// peer dep to resolve).
-//
-// Class-name check ONLY — the SDK's internal mapper turns every API
-// `not_found` into BlobNotFoundError-by-name, so a bare-404 transport
-// leak doesn't reach here. A broader `/does not exist|\b404\b/` match
-// is DANGEROUS: it also matches BlobStoreNotFoundError's "This store
-// does not exist.", so a config fault (revoked token, deleted store)
-// would silently surface as every-blob-missing across reads/unlinks,
-// masking the fatal misconfiguration. The tight name check lets
-// BlobStoreNotFoundError / other classes propagate as real exceptions.
-export function isNotFound(err: unknown): boolean {
-  if (err == null || typeof err !== 'object') return false
-  const name = (err as { name?: unknown }).name
-  return typeof name === 'string' && name === 'BlobNotFoundError'
+// paths so callers can treat them as success (delete) or not-found (read).
+// SDK error subclasses retain `.name === 'Error'`; identify the missing-blob
+// class from the same lazily loaded SDK instance that performs the request.
+// Store/configuration failures must propagate, never masquerade as cache misses.
+export function isNotFound(err: unknown, sdk: Pick<VercelBlobSdk, 'BlobNotFoundError'>): boolean {
+  return err instanceof sdk.BlobNotFoundError
 }
 
 export async function loadVercelBlobSdk(): Promise<VercelBlobSdk> {

package/server-e2e/objstore/blob-vercel.ts

@@ -195,7 +195,7 @@ function buildStatStaging(sdk: VercelBlobSdk, token: string): BlobBackend['statS
       const h = await sdk.head(stagingBlobPath(tag, stagingId), { token })
       return h.size
     } catch (err) {
-      if (isNotFound(err)) return null
+      if (isNotFound(err, sdk)) return null
       throw err
     }
   }
@@ -266,7 +266,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
       // same condition (blob-fs.ts maps ENOENT → `unavailable`), telling
       // the client the resource is gone for good when it should refetch.
       // See server-e2e/README.md's GET status table.
-      if (isNotFound(err)) return { ok: false, reason: 'unavailable', detail: 'vercel-get-not-found' }
+      if (isNotFound(err, sdk)) return { ok: false, reason: 'unavailable', detail: 'vercel-get-not-found' }
       throw err
     }
     // SDK returned null (no blob) — same "bytes missing for a live row"
@@ -297,7 +297,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
         // Blob vanished between get() and the head() size fallback (a
         // racing reaper GC) — still the "live row present, bytes gone"
         // transient, so `unavailable` (503), matching the get() path above.
-        if (isNotFound(headErr)) return { ok: false, reason: 'unavailable', detail: 'vercel-head-not-found' }
+        if (isNotFound(headErr, sdk)) return { ok: false, reason: 'unavailable', detail: 'vercel-head-not-found' }
         throw headErr
       }
     }
@@ -328,7 +328,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
 function buildUnlink(sdk: VercelBlobSdk, token: string, op: 'staging' | 'live', toPath: (tag: string, id: string) => string): (tag: string, id: string) => Promise<void> {
   return async (tag, id) => {
     try { await sdk.del(toPath(tag, id), { token }) } catch (err) {
-      if (isNotFound(err)) return
+      if (isNotFound(err, sdk)) return
       // Don't propagate — the DB-side row drop has already
       // committed by the time the caller reaches here, and the
       // reaper picks up the stranded blob on its next sweep. Same

package/server-managed/blob-vercel.ts

@@ -64,7 +64,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
       // Content-Length in that case so HTTP clients do not truncate the body.
       const size = result.blob.size === 0 ? null : result.blob.size
       return { size, stream: Readable.fromWeb(result.stream as Parameters<typeof Readable.fromWeb>[0]) }
-    } catch (err) { if (isNotFound(err)) return null; throw err }
+    } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
   }
   async function get(path: string) {
     const result = await open(path)
@@ -74,7 +74,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
     return Buffer.concat(parts)
   }
   async function remove(path: string) {
-    try { await blobs.del(path, { token }) } catch (err) { if (!isNotFound(err)) throw err }
+    try { await blobs.del(path, { token }) } catch (err) { if (!isNotFound(err, blobs)) throw err }
   }
   function store(name: string, suffix = ''): BlobStore {
     const path = (id: string) => `.managed/${name}/${validate(id)}${suffix}`
@@ -90,7 +90,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
   const cacheStorage: BundleCacheStorage = {
     async exists(id, file) {
       try { await blobs.head(cachePath(id, file), { token }); return true }
-      catch (err) { if (isNotFound(err)) return false; throw err }
+      catch (err) { if (isNotFound(err, blobs)) return false; throw err }
     },
     put: (id, file, bytes) => put(cachePath(id, file), bytes),
     async open(id, file) {
@@ -110,7 +110,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
   const reportSourcesStorage: CacheStorage = {
     async exists(key) {
       try { await blobs.head(sourcesPath(key), { token }); return true }
-      catch (err) { if (isNotFound(err)) return false; throw err }
+      catch (err) { if (isNotFound(err, blobs)) return false; throw err }
     },
     put: (key, bytes) => put(sourcesPath(key), bytes),
     async open(key) {

package/server-managed/db-methods.ts

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
-import type { Role } from '../common/managed/roles.ts'
+import { type Role, roleAtLeast } from '../common/managed/roles.ts'
 import type { TeamUserPermissions } from '../common/managed/permissions.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
 import { preferredSlug } from './slugs.ts'
@@ -11,6 +11,7 @@ import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts
 import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
+import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
 
 // A managed user identity (the subset of GitHub's `GET /user` we keep). Input
 // to the upsert; `githubUserId` is the provider lookup key, never exposed to
@@ -307,7 +308,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore {
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -349,7 +350,8 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   insertReport(report: ReportRecordInput, now: number): Promise<void>
   // Content reuse is atomic with insertion, including across server instances.
   // Existing copies are kept; the oldest matching row is the stable identity.
-  insertOrReuseReport(report: ReportRecordInput, now: number): Promise<ReportRecord>
+  // HTTP uploads pass sessionId to recheck role/destination in that transaction.
+  insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord>
   getReportByHash(sha256: string, analyzer: string | null): Promise<ReportRecord | null>
   listReports(userId?: string): Promise<AdminReport[]>
   getReport(id: string): Promise<ReportRecord | null>
@@ -385,7 +387,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // (referencing reports' bundle_id null out via the FK). linkReportsToBundle
   // attaches a freshly-stored bundle to the (still-unlinked) reports that
   // declared its integrity.
-  insertBundle(bundle: BundleInput, now: number): Promise<void>
+  insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void>
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
@@ -904,8 +906,20 @@ type ReportRow = {
   bundleId: string | null
 }
 
-// The report slice of ManagedDb, split out (like selectedRepoMethods) to keep
-// openSqliteManagedDb small. Closes over its prepared statements.
+// Byte storage may outlast a logout or grant change. HTTP uploads reauthorize
+// inside the metadata writer transaction after their bytes have been stored.
+async function authorizeUpload(stmts: ReturnType<typeof prepareStatements>, sessionId: string | undefined,
+  item: { uploadedBy: string | null; repoId: number | null; repoDirectory?: string }) {
+  if (sessionId === undefined) return // Trusted imports and fixtures use the raw store API.
+  const user = await stmts.selectSessionStmt.get(sessionId, Date.now()) as SessionRow | undefined
+  if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+  if (user.uid !== item.uploadedBy || !roleAtLeast(user.role, 'manage')) throw new ManagedMutationError(403, 'forbidden')
+  if (item.repoId === null) return
+  if (!(await stmts.selectReposStmt.all() as RepoRow[]).some(repo => repo.repoId === item.repoId)) throw new ManagedMutationError(400, 'repo-not-selected')
+  if (user.role !== 'admin' && !await stmts.selectRepoPathReadableStmt.get(item.repoDirectory ?? '', item.repoId, user.uid)) throw new ManagedMutationError(403, 'repo-forbidden')
+}
+
+// The report slice of ManagedDb closes over its prepared statements.
 function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
   const { insertReportStmt, selectReportsStmt, selectReportStmt, deleteReportStmt, setReportRepoStmt, setReportVisibleStmt } = stmts
   async function getReport(id: string): Promise<ReportRecord | null> {
@@ -929,7 +943,8 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
     insertReport,
     getReport,
     getReportByHash,
-    async insertOrReuseReport(report: ReportRecordInput, now: number): Promise<ReportRecord> {
+    async insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord> {
+      await authorizeUpload(stmts, sessionId, report)
       // The driver holds its writer lock for this whole operation. Checking
       // again here closes the race between the HTTP lookup and blob upload.
       const existing = await getReportByHash(report.sha256, report.analyzer ?? null)
@@ -1108,7 +1123,8 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>) {
     selectBundlesStmt, deleteBundleStmt, setBundleRepoStmt, linkReportsToBundleStmt, selectBundleReadableStmt, selectRepoReadableStmt, selectRepoPathReadableStmt,
   } = stmts
   return {
-    async insertBundle(bundle: BundleInput, now: number): Promise<void> {
+    async insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void> {
+      await authorizeUpload(stmts, sessionId, bundle)
       await insertBundleStmt.run(
         bundle.id, preferredSlug(bundle.id), bundle.integrity, bundle.filename, bundle.kind,
         bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now,
@@ -1297,7 +1313,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, deleteSessionStmt, deleteExpiredStmt,
   } = stmts
 
-  return {
+  const methods: Omit<ManagedDb, keyof ManagementStore> = {
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1364,4 +1380,5 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       await db.close()
     },
   }
+  return { ...methods, ...managementMethods(methods) }
 }

package/server-managed/db-neon.ts

@@ -6,7 +6,7 @@ import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-met
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
-import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { ManagedCommitError, type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -144,16 +144,23 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
     async scope(write, work) {
       if (closed) throw new Error('Managed database is closed')
       const db = await connect()
+      let commitAttempted = false
+      let result
       try {
         await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
         if (write) await db.query(LOCK)
-        const result = await context.run(db, work)
+        result = await context.run(db, work)
+        commitAttempted = true
         await db.query('COMMIT')
-        return result
       } catch (err) {
         await db.query('ROLLBACK').catch(() => {})
+        await db.release().catch(() => {})
+        if (write && commitAttempted) throw new ManagedCommitError(err)
         throw err
-      } finally { await db.release() }
+      }
+      try { await db.release() }
+      catch (err) { if (write) throw new ManagedCommitError(err); throw err }
+      return result
     },
     close() { closed = true },
   }