@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.26

package/server-managed/http.ts

@@ -48,7 +48,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
 import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
-import { UPLOAD_CHUNK_BYTES, type UploadKind, putUploadPart, readUpload, validUploadPart } from './uploads.ts'
+import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import type { BundleStore } from './bundle-store.ts'
@@ -82,7 +82,7 @@ import { clearCookie, endSession, readSession } from './session.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamReports, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
-import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
+import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
@@ -92,6 +92,8 @@ import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
 import { hashToken, randomToken } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
+import { ManagedCommitError } from './sql.ts'
+import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 
 const SESSION_PATH = '/api/auth/session'
 const AVATAR_PREFIX = '/api/avatar/'
@@ -278,19 +280,33 @@ function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: st
 }
 
 async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string) {
-  if (req.method !== 'POST') { send405(res, 'POST'); return }
+  const cancel = req.method === 'DELETE'
+  if (req.method !== 'POST' && !cancel) { send405(res, 'POST, DELETE'); return }
   const s = await checkMutation(req, res, deps, cookie)
   if (!s || !requireManageRole(res, s.user)) return
   if (!deps.uploadStore) { sendJson(res, 404, { error: 'not-found' }); return }
-  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)\/(0|[1-9][0-9]*)$/u.exec(path)
-  if (!match) { sendJson(res, 400, { error: 'bad-upload' }); return }
-  const id = match[2]!, index = Number(match[3]), kind = match[1] as UploadKind
+  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)(?:\/(0|[1-9][0-9]*))?$/u.exec(path)
+  if (!match || (cancel ? match[3] !== undefined : match[3] === undefined)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const id = match[2]!, kind = match[1] as UploadKind
+  if (cancel) {
+    const count = Number(req.headers['x-upload-parts'])
+    if (!validUpload(id, count)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+    await deleteUpload(deps.uploadStore, s.session.id, kind, id, count)
+    sendJson(res, 200, { ok: true }); return
+  }
+  const index = Number(match[3])
   const maxBytes = kind === 'reports' ? deps.config.maxReportBytes : deps.config.maxBundleBytes
-  if (!validUploadPart(id, index, maxBytes)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const discard = async () => {
+    if (validUpload(id, index + 1)) {
+      await deleteUpload(deps.uploadStore!, s.session.id, kind, id, index + 1).catch(err => console.warn('managed: upload cleanup failed:', err))
+    }
+  }
+  if (!validUploadPart(id, index, maxBytes)) { await discard(); sendJson(res, 400, { error: 'bad-upload' }); return }
   let bytes
   try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxBytes)) }
-  catch { sendJson(res, 413, { error: 'too-large' }); return }
-  if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
+  catch { await discard(); sendJson(res, 413, { error: 'too-large' }); return }
+  if (bytes.length === 0) { await discard(); sendJson(res, 400, { error: 'empty' }); return }
+  if (await manageMutation(req, res, deps, cookie) == null) return
   await putUploadPart(deps.uploadStore, s.session.id, kind, id, index, bytes)
   sendJson(res, 200, { ok: true })
 }
@@ -462,7 +478,7 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
 // access (never trust a client-supplied id) and capture the server-derived read
 // context (installation id, default branch). A PRIVATE repo with no installation
 // can't be read server-side → 409. Stores via selectRepo (upsert).
-async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user: StoredUser, repoId: number): Promise<void> {
+async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user: StoredUser, repoId: number, cookie: string | undefined): Promise<void> {
   if (!canAddRepositories(user)) { sendJson(res, 403, { error: 'forbidden' }); return }
   const userId = user.id
   const token = await ensureUserAccessToken(deps.config, deps.db, userId, Date.now())
@@ -489,6 +505,7 @@ async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user
       sendJson(res, 403, { error: 'forbidden' }); return
     }
   }
+  if (await readAdminSession(res, deps, cookie) == null) return
   await connectRepository(res, deps, user, repo)
 }
 
@@ -580,11 +597,12 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
   }
   if (!selected) {
     const repo = (await deps.db.listSelectedRepos()).find(row => row.repoId === repoId)
+    if (await readAdminSession(res, deps, cookie) == null) return
     await deps.db.deactivateRepo(repoId)
     if (repo) await activity(deps, s.user, 'repository', 'deactivated a repository', { repo: repo.fullName })
     sendJson(res, 200, { ok: true, selected: false }); return
   }
-  await selectRepository(res, deps, s.user, repoId)
+  await selectRepository(res, deps, s.user, repoId, cookie)
 }
 
 async function repositoryFindingIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[]): Promise<Set<string>> {
@@ -614,13 +632,15 @@ async function repositoryImpact(deps: ManagedHttpDeps, repoId: number) {
   }
 }
 
-async function repositoryExclusiveTriageIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[], otherReports: { id: string, filename: string }[]): Promise<string[]> {
+async function repositoryExclusiveTriageIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[], otherReports: { id: string, filename: string }[], annotationsOnly = true): Promise<string[]> {
   const targetIds = await repositoryFindingIds(deps, reports)
-  const triage = await deps.db.listTriage([...targetIds])
-  const commentIds = await deps.db.listCommentedFindingIds([...targetIds])
-  const annotatedIds = new Set([...triage.map(entry => entry.findingId), ...commentIds])
+  const triage = annotationsOnly ? await deps.db.listTriage([...targetIds]) : []
+  const commentIds = annotationsOnly ? await deps.db.listCommentedFindingIds([...targetIds]) : []
+  // Removal includes every exclusive finding, including annotations created
+  // during the blob scan; impact only needs the currently annotated subset.
+  const annotatedIds = annotationsOnly ? new Set([...triage.map(entry => entry.findingId), ...commentIds]) : targetIds
   if (annotatedIds.size === 0) return []
-  // Only annotated findings need an overlap check.
+  // Impact can skip unannotated findings; deletion must also cover new writes.
   // TODO(managed): Persist finding IDs per report at upload time and maintain
   // the index on report deletion. Use it for repository impact and triage
   // cleanup so overlap checks do not fetch and parse every other report blob.
@@ -661,13 +681,12 @@ async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse,
   const repo = (await deps.db.listAllRepos()).find((candidate) => candidate.repoId === repoId)
   if (repo == null) { sendJson(res, 404, { error: 'no-repo' }); return }
   if (repo.fullName !== fullName) { sendJson(res, 400, { error: 'repo-name-mismatch' }); return }
-  const reports = await deps.db.listReportsForRepo(repoId)
-  const bundles = await deps.db.listBundlesForRepo(repoId)
+  const allReports = deleteTriage ? await deps.db.listReports() : []
   const triageIds = deleteTriage
-    ? await repositoryExclusiveTriageIds(deps, reports, (await deps.db.listReports()).filter((report) => report.repoId !== repoId))
+    ? await repositoryExclusiveTriageIds(deps, allReports.filter(report => report.repoId === repoId), allReports.filter(report => report.repoId !== repoId), false)
     : []
-  const deletedReports = await deps.db.deleteReportsForRepo(repoId)
-  const deletedBundles = await deps.db.deleteBundlesForRepo(repoId)
+  const { reports, bundles, deletedReports, deletedBundles, deletedTriage } = await deps.db.removeRepository(s.session.id, repo,
+    deleteTriage ? { reports: reportReferenceSnapshot(allReports), ids: triageIds } : null)
   // Remove metadata first so a blob-store failure leaves an orphaned blob for
   // later cleanup, rather than a live row pointing at missing report data.
   for (const report of reports) {
@@ -675,15 +694,11 @@ async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse,
     await deps.reportStore.delete(report.id).catch(() => {})
   }
   for (const bundle of bundles) {
-    // Cache cleanup must not interrupt triage/repository removal after the
-    // report rows needed to reconstruct exclusive finding IDs are gone.
+    // Best-effort derivative cleanup follows the committed metadata removal.
     await deps.bundleCache?.delete(bundle.id).catch((err) => { console.warn('managed: bundle cache delete failed:', err) })
     await deps.reportSourcesCache?.deleteBundle(bundle.id).catch((err) => { console.warn('managed: report sources delete failed:', err) })
     await deps.bundleStore.delete(bundle.id).catch(() => {})
   }
-  const deletedTriage = await deps.db.deleteTriage(triageIds)
-  await deps.db.deleteRepo(repoId)
-  await activity(deps, s.user, 'delete', `removed a repository (${deletedReports} reports, ${deletedBundles} bundles, ${deletedTriage} triage entries)`, { repo: repo.fullName })
   sendJson(res, 200, { ok: true, deletedReports, deletedBundles, deletedTriage })
 }
 
@@ -733,15 +748,6 @@ async function resolveUploadRepoId(req: IncomingMessage, res: ServerResponse, de
   return { ok: true, repoId: n }
 }
 
-// True iff `repoId` may be linked to a report / bundle: null (detach) or a
-// currently-selected repo id (so the FK can't dangle and you can only attach to
-// a managed repo).
-async function repoIdAllowed(deps: ManagedHttpDeps, repoId: unknown): Promise<boolean> {
-  if (repoId == null) return true
-  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId)) return false
-  return (await deps.db.listSelectedRepos()).some((r) => r.repoId === repoId)
-}
-
 async function canChangeReportRepo(deps: ManagedHttpDeps, user: StoredUser, reportId: string): Promise<boolean> {
   if (!roleAtLeast(user.role, 'manage') || !(await canViewReport(deps, user, reportId))) return false
   const report = await deps.db.getReport(reportId)
@@ -761,18 +767,12 @@ async function handleSetReportRepo(req: IncomingMessage, res: ServerResponse, de
   const repoId = (body as { repoId?: unknown } | null)?.repoId ?? null
   const directory = (body as { directory?: unknown } | null)?.directory ?? ''
   if (typeof reportId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canViewReport(deps, s.user, reportId))) { sendJson(res, 404, { error: 'no-report' }); return }
-  const report = await deps.db.getReport(reportId)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, reportId))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (report.repoEmbedded) { sendJson(res, 409, { error: 'repo-in-report' }); return }
-  if (!(await repoIdAllowed(deps, repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
+  if (repoId !== null && (typeof repoId !== 'number' || !Number.isSafeInteger(repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
   const normalized = normalizeTeamPath(directory)
   if (!normalized.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
-  if (repoId !== null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId as number, normalized.path ?? ''))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (!(await deps.db.setReportRepo(reportId, repoId as number | null, normalized.path ?? ''))) { sendJson(res, 404, { error: 'no-report' }); return }
+  const { report, user } = await deps.db.mutateReport(s.session.id, reportId, { type: 'repo', repoId, directory: normalized.path ?? '' })
   if (report.repoId !== repoId || report.repoDirectory !== (repoId == null ? '' : normalized.path ?? '')) {
-    await activity(deps, s.user, 'repository', repoId == null ? 'detached a report from its repository' : `assigned a report to repository path ${normalized.path || '/'}`, { reportId, report: report.filename, repo: await repositoryName(deps, (repoId as number | null) ?? report.repoId) })
+    await activity(deps, user, 'repository', repoId == null ? 'detached a report from its repository' : `assigned a report to repository path ${normalized.path || '/'}`, { reportId, report: report.filename, repo: await repositoryName(deps, repoId ?? report.repoId) })
   }
   sendJson(res, 200, { ok: true, repoId, repoDirectory: normalized.path ?? '' })
 }
@@ -787,12 +787,8 @@ async function handleSetReportVisible(req: IncomingMessage, res: ServerResponse,
   const reportId = (body as { reportId?: unknown } | null)?.reportId
   const visible = (body as { visible?: unknown } | null)?.visible
   if (typeof reportId !== 'string' || typeof visible !== 'boolean') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canViewReport(deps, s.user, reportId))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, reportId))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const report = await deps.db.getReport(reportId)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await deps.db.setReportVisible(reportId, visible))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (report.visible !== visible) await activity(deps, s.user, 'visibility', visible ? 'published a report' : 'hid a report', { reportId, report: report.filename, repo: await repositoryName(deps, report.repoId) })
+  const { report, user } = await deps.db.mutateReport(s.session.id, reportId, { type: 'visibility', visible })
+  if (report.visible !== visible) await activity(deps, user, 'visibility', visible ? 'published a report' : 'hid a report', { reportId, report: report.filename, repo: await repositoryName(deps, report.repoId) })
   sendJson(res, 200, { ok: true, visible })
 }
 
@@ -809,16 +805,9 @@ async function handleSetBundleRepo(req: IncomingMessage, res: ServerResponse, de
   if (!normalized.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
   const directory = repoId == null ? '' : normalized.path ?? ''
   if (typeof bundleId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canAccessBundle(deps, s.user, bundleId))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const bundle = await deps.db.getBundle(bundleId)
-  if (bundle == null) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (!(await canChangeBundleRepo(deps, s.user, bundle.repoId, bundle.repoDirectory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (!(await repoIdAllowed(deps, repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
-  if (repoId !== null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId as number, directory))) {
-    sendJson(res, 403, { error: 'forbidden' }); return
-  }
-  if (!(await deps.db.setBundleRepo(bundleId, repoId as number | null, directory))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (bundle.repoId !== repoId || bundle.repoDirectory !== directory) await activity(deps, s.user, 'repository', repoId == null ? 'detached a bundle from its repository' : `assigned a bundle to repository path ${directory || '/'}`, { bundleId, report: bundle.filename, repo: await repositoryName(deps, (repoId as number | null) ?? bundle.repoId) })
+  if (repoId !== null && (typeof repoId !== 'number' || !Number.isSafeInteger(repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
+  const { bundle, user } = await deps.db.mutateBundle(s.session.id, bundleId, { type: 'repo', repoId, directory })
+  if (bundle.repoId !== repoId || bundle.repoDirectory !== directory) await activity(deps, user, 'repository', repoId == null ? 'detached a bundle from its repository' : `assigned a bundle to repository path ${directory || '/'}`, { bundleId, report: bundle.filename, repo: await repositoryName(deps, repoId ?? bundle.repoId) })
   sendJson(res, 200, { ok: true, repoId, repoDirectory: directory })
 }
 
@@ -873,8 +862,9 @@ async function sendUploadedReport(req: IncomingMessage, res: ServerResponse, dep
 // headers when the report has no repository metadata. The bundle link is
 // auto-resolved from the report's bundleHashes. New reports start hidden until
 // published. Identical content reuses its stored identity and metadata. Bytes
-// are written first (keyed by a fresh uuid) then the metadata row — a failed
-// insert or concurrent duplicate drops the orphan blob. 413 over the cap, 400 on empty.
+// are written first (keyed by a fresh uuid) then the metadata row. A definite
+// insert failure or concurrent duplicate drops the orphan blob; an uncertain
+// commit retains it. 413 over the cap, 400 on empty.
 async function handleUploadReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   let s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
@@ -931,9 +921,10 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
       id, filename, contentType, byteSize: bytes.length, sha256,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
-    }, Date.now())
+    }, Date.now(), s.session.id)
   } catch (err) {
-    await deps.reportStore.delete(id).catch(() => {})
+    // Losing the commit acknowledgement cannot turn primary bytes into garbage.
+    if (!(err instanceof ManagedCommitError)) await deps.reportStore.delete(id).catch(() => {})
     throw err
   }
   if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
@@ -976,15 +967,10 @@ async function handleDeleteReport(req: IncomingMessage, res: ServerResponse, dep
   const s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
-  if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, id))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const report = await deps.db.getReport(id)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  const existed = await deps.db.deleteReport(id)
+  const { report, user } = await deps.db.mutateReport(s.session.id, id, { type: 'delete' })
   await deps.reportSourcesCache?.deleteReport(report).catch((err) => { console.warn('managed: report sources delete failed:', err) })
   await deps.reportStore.delete(id).catch((err) => { console.warn('managed: report bytes delete failed:', err) })
-  if (!existed) { sendJson(res, 404, { error: 'no-report' }); return }
-  await activity(deps, s.user, 'delete', 'deleted a report', { repoId: report.repoId, repoDirectory: report.repoDirectory, reportId: id, report: report.filename, repo: await repositoryName(deps, report.repoId) })
+  await activity(deps, user, 'delete', 'deleted a report', { repoId: report.repoId, repoDirectory: report.repoDirectory, reportId: id, report: report.filename, repo: await repositoryName(deps, report.repoId) })
   sendJson(res, 200, { ok: true })
 }
 
@@ -1057,7 +1043,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (!current) return
     if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
     sendJson(res, 200, refs ? result : {
-      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false } : {}), path, commit,
+      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [] } : {}), path, commit,
     })
   } catch (err) {
     if (err instanceof GithubApiError) {
@@ -1206,6 +1192,8 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
   const existing = await deps.db.getBundleByIntegrity(integrity)
   if (existing != null) {
+    s = await manageMutation(req, res, deps, cookie)
+    if (!s) return
     if (!(await canAccessBundle(deps, s.user, existing.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
     // Reports uploaded while this bundle was inaccessible retain only its
     // integrity. An authorized re-upload repairs those pending links too.
@@ -1221,14 +1209,18 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     await deps.db.insertBundle({
       id, integrity, filename, kind,
       byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: repo.repoId, repoDirectory: directory,
-    }, Date.now())
+    }, Date.now(), s.session.id)
   } catch (err) {
-    await deps.bundleStore.delete(id).catch(() => {})
+    // A committed row may already point here even though insertion rejected.
+    if (!(err instanceof ManagedCommitError)) await deps.bundleStore.delete(id).catch(() => {})
+    if (err instanceof ManagedMutationError) throw err
     // A concurrent upload of identical bytes can insert this integrity (UNIQUE)
     // between our dedup check and this insert — treat that as a dedup, not a 500.
     // Any other failure rethrows.
     const raced = await deps.db.getBundleByIntegrity(integrity)
     if (raced != null) {
+      s = await manageMutation(req, res, deps, cookie)
+      if (!s) return
       if (!(await canAccessBundle(deps, s.user, raced.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
       await deps.db.linkReportsToBundle(integrity, raced.id, s.user.role === 'admin' ? undefined : s.user.id)
       prebuildBundle(deps, raced.id)
@@ -1236,6 +1228,8 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     throw err
   }
   // Auto-link reports that declared this integrity before the bundle existed.
+  s = await manageMutation(req, res, deps, cookie)
+  if (!s) return
   await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
   prebuildBundle(deps, id)
   sendJson(res, 201, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory })
@@ -1279,16 +1273,11 @@ async function handleDeleteBundle(req: IncomingMessage, res: ServerResponse, dep
   const s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
-  if (!(await canAccessBundle(deps, s.user, id))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const bundle = await deps.db.getBundle(id)
-  if (bundle == null) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (!(await canChangeBundleRepo(deps, s.user, bundle.repoId, bundle.repoDirectory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const existed = await deps.db.deleteBundle(id)
+  const { bundle, user } = await deps.db.mutateBundle(s.session.id, id, { type: 'delete' })
   await deps.bundleCache?.delete(id).catch((err) => { console.warn('managed: bundle cache delete failed:', err) })
   await deps.reportSourcesCache?.deleteBundle(id).catch((err) => { console.warn('managed: report sources delete failed:', err) })
   await deps.bundleStore.delete(id).catch((err) => { console.warn('managed: bundle bytes delete failed:', err) })
-  if (!existed) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  await activity(deps, s.user, 'delete', 'deleted a bundle', { repoId: bundle.repoId, repoDirectory: bundle.repoDirectory, bundleId: id, report: bundle.filename, repo: await repositoryName(deps, bundle.repoId) })
+  await activity(deps, user, 'delete', 'deleted a bundle', { repoId: bundle.repoId, repoDirectory: bundle.repoDirectory, bundleId: id, report: bundle.filename, repo: await repositoryName(deps, bundle.repoId) })
   sendJson(res, 200, { ok: true })
 }
 
@@ -1589,25 +1578,30 @@ async function handleGetReportTriage(res: ServerResponse, deps: ManagedHttpDeps,
 }
 
 // GET /api/reports/<id>/triage/history?finding=<fid> — one finding's triage
-// trail (newest first, capped), gated exactly like the entries: the caller
-// may view the report, and the finding is one their visibility permissions
+// trail (newest first, capped). The caller must have at least triage access
+// to the report, and the finding is one their visibility permissions
 // keep in it (a stripped or foreign id 404s without revealing whether it
 // exists). Each event is the entry as written then (null = a clear), who
 // wrote it and when; "what changed" is the diff against the next-older event.
 async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, query: URLSearchParams, teamId: string | null): Promise<void> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!(await canTriageReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   const finding = query.get('finding') ?? ''
   if (finding === '' || finding.length > MAX_FINDING_ID) { sendJson(res, 400, { error: 'bad-request' }); return }
   await visibleFindingIds(deps, s.user, id, s.session.id, teamId)
   const current = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!current || !(await canViewReport(deps, current.user, id)) || current.user.role !== s.user.role) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!current || !(await canTriageReport(deps, current.user, id)) || current.user.role !== s.user.role) { sendJson(res, 404, { error: 'no-report' }); return }
   const visible = await visibleFindingIds(deps, current.user, id, current.session.id, teamId)
   if (!visible.has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map((row: TriageEventRow) => ({
-    seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
+    seq: row.seq, at: row.at, actorId: row.actorId, actorLogin: row.actorLogin, actorName: row.actorName,
+    batchId: row.batchId, entry: triageWireEntry(row, true),
   }))
+  // A database read can outlive a role, membership, or visibility change.
+  const latest = await readSession(deps.config, deps.db, cookie, Date.now())
+  if (!latest || latest.user.role !== current.user.role || !(await canTriageReport(deps, latest.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!(await visibleFindingIds(deps, latest.user, id, latest.session.id, teamId)).has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   sendJson(res, 200, { finding, events })
 }
 
@@ -1652,9 +1646,31 @@ async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true })
 }
 
+// GET only: clients match local annotations against these IDs without sending
+// their local finding IDs or annotation bodies to discover which reports exist.
+async function handleImportFindingIds(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, search: URLSearchParams): Promise<void> {
+  const s = await readAdminSession(res, deps, cookie)
+  if (!s) return
+  const after = search.get('after') ?? ''
+  if (after && !/^[a-f\d-]{36}$/iu.test(after)) { sendJson(res, 400, { error: 'bad-cursor' }); return }
+  const stored = await deps.db.listFindingCatalogReports(after, FINDING_CATALOG_PAGE_COUNT + 1)
+  const reports = []
+  let bytes = 0, cursor = after, processed = 0
+  for (const report of stored) {
+    if (processed >= FINDING_CATALOG_PAGE_COUNT || (processed > 0 && bytes + report.byteSize > FINDING_CATALOG_PAGE_BYTES)) break
+    bytes += report.byteSize
+    processed++
+    cursor = report.id
+    const findingIds = [...await visibleFindingIds(deps, s.user, report.id, s.session.id, null)]
+    if (findingIds.length > 0) reports.push({ id: report.id, findingIds })
+  }
+  if (await readAdminSession(res, deps, cookie) == null) return
+  sendJson(res, 200, { reports, nextCursor: processed < stored.length ? cursor : null })
+}
+
 // Admin imports compare the exact snapshot shown by the conflict dialog before
 // writing. The store commits shared finding triage and imported comments together.
-async function handleImportReportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
+async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
   const s = await adminMutation(req, res, deps, cookie)
   if (!s) return
   let body: { findingIds?: unknown; entries?: unknown; expected?: unknown }
@@ -1940,7 +1956,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
-        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? { uploadChunkBytes: UPLOAD_CHUNK_BYTES } : {}) } })
+        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
+          uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
+        } : {}) } })
       return
     }
     // OAuth: start → redirect to GitHub with the CSRF state cookie.
@@ -2079,10 +2097,14 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleSetReportVisible(req, res, deps, cookie); return
     }
+    if (path === '/api/admin/reports/finding-ids') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleImportFindingIds(res, deps, cookie, url.searchParams); return
+    }
     const importTriage = /^\/api\/admin\/reports\/([a-f\d-]{36})\/import-triage$/iu.exec(path)
     if (importTriage) {
       if (method !== 'POST') { send405(res, 'POST'); return }
-      await handleImportReportTriage(req, res, deps, cookie, importTriage[1]!); return
+      await handleImportTriage(req, res, deps, cookie, importTriage[1]!); return
     }
     if (path.startsWith(REPORT_PREFIX)) {
       const id = path.slice(REPORT_PREFIX.length)
@@ -2204,7 +2226,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
   return (req, res) => {
     if (isShuttingDown()) { sendJson(res, 503, { error: 'shutting-down' }, { connection: 'close' }); return }
     const work = route(req, res).catch((err) => {
-      if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
+      if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)
       if (res.headersSent) { try { res.destroy() } catch {} }
       else sendJson(res, 500, { error: 'internal' })

package/server-managed/import-triage.ts

@@ -15,7 +15,7 @@ export interface ImportTriageStore {
 }
 
 // Raw store methods share one transaction for comparison, triage, and comments.
-export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
+export function importTriageMethods(store: Pick<ManagedDb, 'getReport' | 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
   async function snapshot(ids: readonly string[]) {
     const rows = new Map((await store.listTriage(ids)).map(row => [row.findingId, row]))
     const comments = await store.listComments(ids)
@@ -30,6 +30,9 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
   return {
     getImportTriage: snapshot,
     async importTriage(entries, expected, actor, reportId, now) {
+      // A report deleted after the HTTP membership check must not leave newly
+      // imported annotations behind. Check existence in the write transaction.
+      if (!reportId || !(await store.getReport(reportId))) return false
       const current = await snapshot(entries.map(([id]) => id))
       if (entries.some(([id]) => current[id]!.version !== expected[id])) return false
       const changes: [string, TriageEntryPatch | null][] = []

package/server-managed/index.ts

@@ -12,9 +12,10 @@ import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
 import { loadManagedStatic } from './static.ts'
 import { openManagedStorage } from './storage.ts'
 
-// Expired-session sweep period. Lookups already exclude expired rows
-// (`WHERE expires_at > now`), so this is housekeeping, not a security control.
-const SESSION_GC_INTERVAL_MS = 3_600_000
+// Housekeeping runs on ordinary traffic too, including serverless instances
+// without a timer or cron. Failed sweeps retry on later traffic after a minute.
+const REAP_INTERVAL_MS = 3_600_000
+const REAP_RETRY_MS = 60_000
 
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
@@ -39,25 +40,46 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
     indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
   })
-  const handleRequest = createManagedRequestHandler({
+  const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
     ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
     isShuttingDown, track,
   })
 
   let cleanup: Promise<void> | undefined
+  let nextCleanupAt = 0
   function reap(): Promise<void> {
     if (cleanup) return cleanup
+    const startedAt = Date.now()
+    nextCleanupAt = startedAt + REAP_INTERVAL_MS
+    let sessions = 0, uploads = 0
     cleanup = runReapers({
-      sessions: () => db.deleteExpiredSessions(Date.now()),
-      ...('reapUploads' in storage ? { uploads: () => storage.reapUploads() } : {}),
+      sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
+      ...('reapUploads' in storage ? { uploads: async () => { uploads = await storage.reapUploads() } } : {}),
+    }).then(() => {
+      nextCleanupAt = Date.now() + REAP_INTERVAL_MS
+      return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)
+    }, err => {
+      nextCleanupAt = Date.now() + REAP_RETRY_MS
+      throw err
     }).finally(() => { cleanup = undefined })
     track(cleanup)
     return cleanup
   }
+  function automaticReap(): Promise<void> {
+    if (isShuttingDown() || cleanup || Date.now() < nextCleanupAt) return Promise.resolve()
+    return reap().catch(err => console.warn('managed-reaper: cleanup failed:', err))
+  }
+  async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
+    const maintenance = automaticReap()
+    // Send the normal response without waiting for storage housekeeping, but
+    // keep the invocation alive until both finish. No detached serverless work.
+    try { await routeRequest(req, res) }
+    finally { await maintenance }
+  }
   const gcTimer = config.serverless ? null : setInterval(() => {
-    void reap().catch(err => console.warn('managed: maintenance failed:', err))
-  }, SESSION_GC_INTERVAL_MS)
+    void automaticReap()
+  }, REAP_INTERVAL_MS)
   rollback.defer(stop)
 
   function stop(): void {

package/server-managed/management.ts

@@ -0,0 +1,86 @@
+import type { AdminReport, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
+import { roleAtLeast } from '../common/managed/roles.ts'
+
+export class ManagedMutationError extends Error {
+  status: number
+  constructor(status: number, message: string) { super(message); this.status = status }
+}
+
+export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string }
+export type ReportMutation = ContentMutation | { type: 'visibility'; visible: boolean }
+type RemovalRepo = Pick<ManagedRepo, 'repoId' | 'fullName' | 'addedAt'>
+type RemovalAnnotations = { reports: string; ids: string[] }
+export interface ManagementStore {
+  mutateReport(sessionId: string, id: string, change: ReportMutation): Promise<{ report: ReportRecord; user: StoredUser }>
+  mutateBundle(sessionId: string, id: string, change: ContentMutation): Promise<{ bundle: ManagedBundle; user: StoredUser }>
+  removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null): Promise<{
+    reports: RepoReportItem[]; bundles: RepoDataItem[]; deletedReports: number; deletedBundles: number; deletedTriage: number
+  }>
+}
+type ManagementDb = Pick<ManagedDb, 'sessionWithUser' | 'getReport' | 'getBundle' | 'listReports' | 'listReportsForRepo'
+  | 'listBundlesForRepo' | 'listAllRepos' | 'listSelectedRepos' | 'userCanReadReport' | 'userCanReadBundle' | 'userCanReadRepoPath'
+  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo'
+  | 'deleteReportsForRepo' | 'deleteBundlesForRepo' | 'deleteRepo' | 'deleteTriage' | 'recordActivity'>
+
+// Only immutable bytes/format and repository membership affect the overlap
+// scan. Ignore publication, user display names, and unrelated bundle links.
+export function reportReferenceSnapshot(reports: readonly Pick<AdminReport, 'id' | 'sha256' | 'filename' | 'repoId'>[]): string {
+  return JSON.stringify(reports.map(r => [r.id, r.sha256, r.filename, r.repoId]).toSorted((a, b) => String(a[0]).localeCompare(String(b[0]))))
+}
+
+// These methods are wrapped by scopeManagedMethods: authorization, comparison,
+// metadata changes (and repository-removal audit) share the writer transaction. Blob reads
+// and deletes stay outside it. Use the raw store here, never nested scopes.
+export function managementMethods(db: ManagementDb): ManagementStore {
+  async function authorize(sessionId: string, role: 'admin' | 'manage') {
+    const s = await db.sessionWithUser(sessionId, Date.now())
+    if (!s) throw new ManagedMutationError(401, 'unauthenticated')
+    if (!roleAtLeast(s.user.role, role)) throw new ManagedMutationError(403, 'forbidden')
+    return s.user
+  }
+  async function destination(user: { id: string; role: string }, change: ContentMutation) {
+    if (change.type !== 'repo' || change.repoId === null) return
+    if (!(await db.listSelectedRepos()).some(repo => repo.repoId === change.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+    if (user.role !== 'admin' && !await db.userCanReadRepoPath(user.id, change.repoId, change.directory)) throw new ManagedMutationError(403, 'repo-forbidden')
+  }
+  return {
+    async mutateReport(sessionId: string, id: string, change: ReportMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const report = await db.getReport(id)
+      if (!report || (user.role !== 'admin' && report.uploadedBy !== user.id && !await db.userCanReadReport(user.id, id))) throw new ManagedMutationError(404, 'no-report')
+      if (user.role !== 'admin' && report.repoId !== null && !await db.userCanReadReport(user.id, id)) throw new ManagedMutationError(403, 'repo-forbidden')
+      if (change.type === 'repo' && report.repoEmbedded) throw new ManagedMutationError(409, 'repo-in-report')
+      if (change.type !== 'visibility') await destination(user, change)
+      if (change.type === 'delete') await db.deleteReport(id)
+      else if (change.type === 'visibility') await db.setReportVisible(id, change.visible)
+      else await db.setReportRepo(id, change.repoId, change.directory)
+      return { report, user }
+    },
+    async mutateBundle(sessionId: string, id: string, change: ContentMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle || (user.role !== 'admin' && !await db.userCanReadBundle(user.id, id))) throw new ManagedMutationError(404, 'no-bundle')
+      if (user.role !== 'admin' && bundle.repoId !== null && !await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)) throw new ManagedMutationError(403, 'repo-forbidden')
+      await destination(user, change)
+      if (change.type === 'delete') await db.deleteBundle(id)
+      else await db.setBundleRepo(id, change.repoId, change.directory)
+      return { bundle, user }
+    },
+    async removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null) {
+      const user = await authorize(sessionId, 'admin')
+      const repo = (await db.listAllRepos()).find(r => r.repoId === expected.repoId)
+      if (!repo) throw new ManagedMutationError(404, 'no-repo')
+      if (repo.fullName !== expected.fullName || repo.addedAt !== expected.addedAt) throw new ManagedMutationError(409, 'repository-changed')
+      if (annotations && reportReferenceSnapshot(await db.listReports()) !== annotations.reports) throw new ManagedMutationError(409, 'repository-changed')
+      const reports = await db.listReportsForRepo(repo.repoId)
+      const bundles = await db.listBundlesForRepo(repo.repoId)
+      const deletedReports = await db.deleteReportsForRepo(repo.repoId)
+      const deletedBundles = await db.deleteBundlesForRepo(repo.repoId)
+      const deletedTriage = await db.deleteTriage(annotations?.ids ?? [])
+      await db.deleteRepo(repo.repoId)
+      await db.recordActivity({ kind: 'delete', actor: user.login, actorId: user.id, repo: repo.fullName,
+        action: `removed a repository (${deletedReports} reports, ${deletedBundles} bundles, ${deletedTriage} triage entries)` }, Date.now())
+      return { reports, bundles, deletedReports, deletedBundles, deletedTriage }
+    },
+  }
+}