@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.26

package/server-managed/db-methods.ts

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
-import type { Role } from '../common/managed/roles.ts'
+import { type Role, roleAtLeast } from '../common/managed/roles.ts'
 import type { TeamUserPermissions } from '../common/managed/permissions.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
 import { preferredSlug } from './slugs.ts'
@@ -11,6 +11,7 @@ import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts
 import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
+import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
 
 // A managed user identity (the subset of GitHub's `GET /user` we keep). Input
 // to the upsert; `githubUserId` is the provider lookup key, never exposed to
@@ -203,7 +204,9 @@ export interface TriageEventRow {
   comment: string | null
   fix: string | null
   flagged: boolean | null
+  actorId: string | null
   actorLogin: string | null
+  actorName: string | null
   at: number
 }
 
@@ -307,7 +310,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore {
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -349,9 +352,11 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   insertReport(report: ReportRecordInput, now: number): Promise<void>
   // Content reuse is atomic with insertion, including across server instances.
   // Existing copies are kept; the oldest matching row is the stable identity.
-  insertOrReuseReport(report: ReportRecordInput, now: number): Promise<ReportRecord>
+  // HTTP uploads pass sessionId to recheck role/destination in that transaction.
+  insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord>
   getReportByHash(sha256: string, analyzer: string | null): Promise<ReportRecord | null>
   listReports(userId?: string): Promise<AdminReport[]>
+  listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]>
   getReport(id: string): Promise<ReportRecord | null>
   getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null>
   getReportAccessSnapshot(sessionId: string, now: number, ids: readonly string[]): Promise<ReportAccessSnapshot | null>
@@ -385,7 +390,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // (referencing reports' bundle_id null out via the FK). linkReportsToBundle
   // attaches a freshly-stored bundle to the (still-unlinked) reports that
   // declared its integrity.
-  insertBundle(bundle: BundleInput, now: number): Promise<void>
+  insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void>
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
@@ -569,6 +574,7 @@ function prepareStatements(db: ManagedSql) {
           WHERE tr.repo_id = r.repo_id AND tu.user_id = ? AND ${REPORT_IN_TEAM_PATH_SQL}))
         ORDER BY r.uploaded_at DESC, r.filename ASC`,
     ),
+    findingCatalogReportsStmt: db.prepare(`SELECT id, byte_size AS byteSize FROM managed_report WHERE id > ? ORDER BY id LIMIT ?`),
     selectReportStmt: db.prepare(
       `SELECT id, slug, filename, content_type AS contentType, byte_size AS byteSize,
               sha256, uploaded_by AS uploadedBy, uploaded_at AS uploadedAt,
@@ -644,7 +650,7 @@ function prepareStatements(db: ManagedSql) {
     selectTriageHistoryStmt: db.prepare(
       `SELECT e.seq AS seq, e.finding_id AS findingId, e.batch_id AS batchId, e.color AS color, e.triage AS triage,
               e.comment AS comment, e.fix AS fix, e.flagged AS flagged,
-              COALESCE(u.login, e.actor_login) AS actorLogin, e.at AS at
+              u.id AS actorId, COALESCE(u.login, e.actor_login) AS actorLogin, u.name AS actorName, e.at AS at
          FROM managed_finding_triage_event e
          LEFT JOIN managed_user u ON u.id = e.actor_id
         WHERE e.finding_id = ?
@@ -904,8 +910,20 @@ type ReportRow = {
   bundleId: string | null
 }
 
-// The report slice of ManagedDb, split out (like selectedRepoMethods) to keep
-// openSqliteManagedDb small. Closes over its prepared statements.
+// Byte storage may outlast a logout or grant change. HTTP uploads reauthorize
+// inside the metadata writer transaction after their bytes have been stored.
+async function authorizeUpload(stmts: ReturnType<typeof prepareStatements>, sessionId: string | undefined,
+  item: { uploadedBy: string | null; repoId: number | null; repoDirectory?: string }) {
+  if (sessionId === undefined) return // Trusted imports and fixtures use the raw store API.
+  const user = await stmts.selectSessionStmt.get(sessionId, Date.now()) as SessionRow | undefined
+  if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+  if (user.uid !== item.uploadedBy || !roleAtLeast(user.role, 'manage')) throw new ManagedMutationError(403, 'forbidden')
+  if (item.repoId === null) return
+  if (!(await stmts.selectReposStmt.all() as RepoRow[]).some(repo => repo.repoId === item.repoId)) throw new ManagedMutationError(400, 'repo-not-selected')
+  if (user.role !== 'admin' && !await stmts.selectRepoPathReadableStmt.get(item.repoDirectory ?? '', item.repoId, user.uid)) throw new ManagedMutationError(403, 'repo-forbidden')
+}
+
+// The report slice of ManagedDb closes over its prepared statements.
 function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
   const { insertReportStmt, selectReportsStmt, selectReportStmt, deleteReportStmt, setReportRepoStmt, setReportVisibleStmt } = stmts
   async function getReport(id: string): Promise<ReportRecord | null> {
@@ -929,7 +947,8 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
     insertReport,
     getReport,
     getReportByHash,
-    async insertOrReuseReport(report: ReportRecordInput, now: number): Promise<ReportRecord> {
+    async insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord> {
+      await authorizeUpload(stmts, sessionId, report)
       // The driver holds its writer lock for this whole operation. Checking
       // again here closes the race between the HTTP lookup and blob upload.
       const existing = await getReportByHash(report.sha256, report.analyzer ?? null)
@@ -948,6 +967,9 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
         uploadedAt: r.uploadedAt,
       }))
     },
+    async listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]> {
+      return await stmts.findingCatalogReportsStmt.all(after, limit) as Pick<ReportRecord, 'id' | 'byteSize'>[]
+    },
     async getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null> {
       const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
       if (!session) return null
@@ -1004,7 +1026,9 @@ type TriageDbRow = {
   updatedByLogin: string | null; updatedAt: number
 }
 type TriageStateDbRow = { color: string | null; triage: string | null; comment: string | null; fix: string | null; flagged: number | null }
-type TriageEventDbRow = TriageStateDbRow & { seq: number; findingId: string; batchId: string; actorLogin: string | null; at: number }
+type TriageEventDbRow = TriageStateDbRow & {
+  seq: number; findingId: string; batchId: string; actorId: string | null; actorLogin: string | null; actorName: string | null; at: number
+}
 
 // The per-finding triage slice of ManagedDb. Closes over its prepared
 // statements (and the handle, for the batch write's transaction). A
@@ -1059,7 +1083,7 @@ function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimi
         seq: r.seq, findingId: r.findingId, batchId: r.batchId,
         color: r.color, triage: r.triage, comment: r.comment, fix: r.fix,
         flagged: r.flagged == null ? null : r.flagged === 1,
-        actorLogin: r.actorLogin, at: r.at,
+        actorId: r.actorId, actorLogin: r.actorLogin, actorName: r.actorName, at: r.at,
       }))
     },
     async listTriage(findingIds: readonly string[]): Promise<TriageRow[]> {
@@ -1108,7 +1132,8 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>) {
     selectBundlesStmt, deleteBundleStmt, setBundleRepoStmt, linkReportsToBundleStmt, selectBundleReadableStmt, selectRepoReadableStmt, selectRepoPathReadableStmt,
   } = stmts
   return {
-    async insertBundle(bundle: BundleInput, now: number): Promise<void> {
+    async insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void> {
+      await authorizeUpload(stmts, sessionId, bundle)
       await insertBundleStmt.run(
         bundle.id, preferredSlug(bundle.id), bundle.integrity, bundle.filename, bundle.kind,
         bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now,
@@ -1291,13 +1316,14 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const comments = commentMethods(db)
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
+  const reports = reportMethods(stmts)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, deleteSessionStmt, deleteExpiredStmt,
   } = stmts
 
-  return {
+  const methods: Omit<ManagedDb, keyof ManagementStore> = {
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1355,13 +1381,14 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...activity,
     ...comments,
     ...workspaceShareMethods(db),
-    ...reportMethods(stmts),
+    ...reports,
     ...triage,
-    ...importTriageMethods({ ...triage, ...comments }),
+    ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
     ...bundleMethods(stmts),
     ...teamMethods(stmts),
     async close() {
       await db.close()
     },
   }
+  return { ...methods, ...managementMethods(methods) }
 }

package/server-managed/db-neon.ts

@@ -6,7 +6,7 @@ import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-met
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
-import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { ManagedCommitError, type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -144,16 +144,23 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
     async scope(write, work) {
       if (closed) throw new Error('Managed database is closed')
       const db = await connect()
+      let commitAttempted = false
+      let result
       try {
         await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
         if (write) await db.query(LOCK)
-        const result = await context.run(db, work)
+        result = await context.run(db, work)
+        commitAttempted = true
         await db.query('COMMIT')
-        return result
       } catch (err) {
         await db.query('ROLLBACK').catch(() => {})
+        await db.release().catch(() => {})
+        if (write && commitAttempted) throw new ManagedCommitError(err)
         throw err
-      } finally { await db.release() }
+      }
+      try { await db.release() }
+      catch (err) { if (write) throw new ManagedCommitError(err); throw err }
+      return result
     },
     close() { closed = true },
   }