@preventive/triage 1.0.0-alpha.3 → 1.0.0-alpha.31

package/server-managed/combined.ts

@@ -0,0 +1,46 @@
+// Compose the existing HTTP apps on e2e's listener, including its WS/SSE
+// transports and static UI. Managed handles its API, discovery and page HTML;
+// assets and other requests fall through to the unchanged e2e HTTP handler.
+import { resolve } from 'node:path'
+import type { Server } from 'node:http'
+import { withReap } from '../server-common/reap.ts'
+import { loadConfig } from '../server-e2e/config.ts'
+import { createE2eApp } from '../server-e2e/app.ts'
+import { loadManagedConfig } from './config.ts'
+import { LOGIN_PATH } from './github-oauth.ts'
+import { createManagedApp, logManagedStartup } from './index.ts'
+
+export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server> {
+  const config = loadManagedConfig({ combined: true })
+  const e2eConfig = loadConfig()
+  if (!e2eConfig.neonUrl && !config.neonUrl && config.dbPath !== ':memory:' && resolve(config.dbPath) === resolve(e2eConfig.dbPath)) {
+    throw new Error('MANAGED_DB_PATH must differ from e2e DB_PATH in combined mode.')
+  }
+  const e2e = await createE2eApp(e2eConfig)
+  // Replace the assembled server's single
+  // request listener; adding a second would write two responses per request.
+  const handlers = e2e.httpServer.listeners('request')
+  const next = handlers[0]
+  if (handlers.length !== 1 || !next) throw new Error('Expected one e2e HTTP request handler')
+  const managed = await createManagedApp(config, {
+    next: e2e.handleRequest,
+    isShuttingDown: e2e.isShuttingDown,
+    serverInfo: {
+      mode, managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName },
+      ...(e2eConfig.deepviewScanServer ? { deepviewScanServer: e2eConfig.deepviewScanServer } : {}),
+    },
+  }).catch(async err => {
+    await e2e.httpServer[Symbol.asyncDispose]()
+    throw err
+  })
+  e2e.onShutdown(managed.close)
+  e2e.httpServer.removeListener('request', next)
+  e2e.httpServer.on('request', withReap(managed.handleRequest,
+    { e2e: e2e.reap, managed: managed.reap }, { isShuttingDown: e2e.isShuttingDown }))
+  e2e.httpServer.once('listening', () => {
+    const address = e2e.httpServer.address()
+    const port = typeof address === 'object' && address ? address.port : config.port
+    logManagedStartup(config, port, mode)
+  })
+  return e2e.httpServer
+}

package/server-managed/comments.ts

@@ -0,0 +1,151 @@
+import { randomUUID } from 'node:crypto'
+import type { DatabaseSync } from 'node:sqlite'
+import { type ManagedComment, canDeleteComment } from '../common/managed/comments.ts'
+import type { ManagedSql } from './sql.ts'
+
+export interface CommentInput {
+  findingId: string
+  body: string
+  // Runtime imports may omit authorship, including future admin UI imports.
+  // Ordinary comment posts always supply the authenticated user as author.
+  authorId: string | null
+  authorLogin: string | null
+  // The user performing an import need not be the author of its comments.
+  // Omitted for ordinary posts, where the author is also the acting user.
+  actor?: { id: string; login: string }
+  // Omitted dates default to the action time; null preserves unknown dates.
+  createdAt?: number | null
+  updatedAt?: number | null
+  reportId?: string | null
+}
+
+export interface CommentStore {
+  listComments(findingIds: readonly string[]): Promise<ManagedComment[]>
+  listCommentedFindingIds(findingIds: readonly string[]): Promise<string[]>
+  getComment(id: string): Promise<ManagedComment | null>
+  createComment(input: CommentInput, now: number): Promise<ManagedComment>
+  editComment(id: string, authorId: string, authorLogin: string, body: string, version: number, reportId: string, now: number): Promise<ManagedComment | 'conflict' | 'forbidden' | null>
+  deleteComment(id: string, actorId: string, actorLogin: string, version: number, reportId: string, now: number): Promise<'deleted' | 'conflict' | 'forbidden' | null>
+}
+
+const COMMENT_COLUMNS = `id TEXT PRIMARY KEY, finding_id TEXT NOT NULL, body TEXT NOT NULL,
+  author_id TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  author_login TEXT, created_at INTEGER, updated_at INTEGER,
+  version INTEGER NOT NULL DEFAULT 1`
+
+export const COMMENT_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS managed_finding_comment (${COMMENT_COLUMNS}) STRICT;
+    CREATE INDEX IF NOT EXISTS finding_comment_finding_idx ON managed_finding_comment(finding_id, created_at, id);
+    CREATE TABLE IF NOT EXISTS managed_finding_comment_event (
+      seq INTEGER PRIMARY KEY, comment_id TEXT NOT NULL, finding_id TEXT NOT NULL,
+      actor_id TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+      actor_login TEXT, action TEXT NOT NULL, at INTEGER NOT NULL,
+      report_id TEXT, report TEXT, repo TEXT
+    ) STRICT;
+    CREATE INDEX IF NOT EXISTS finding_comment_event_finding_idx ON managed_finding_comment_event(finding_id, seq);
+    CREATE INDEX IF NOT EXISTS finding_comment_event_actor_at_idx ON managed_finding_comment_event(actor_id, at);
+    CREATE INDEX IF NOT EXISTS finding_comment_event_at_idx ON managed_finding_comment_event(at, seq);
+`
+
+export function initCommentMethods(db: DatabaseSync): void {
+  db.exec(COMMENT_SCHEMA)
+  migrateCommentDates(db)
+  // updated_by belongs to the whole triage row, not necessarily its comment.
+  // Preserve legacy text without guessing an author. Clearing the old column
+  // in the same transaction makes the migration safe to restart. Use a fresh
+  // ID so a later legacy-server write cannot collide with an earlier import.
+  db.exec('BEGIN')
+  try {
+    db.exec(`INSERT INTO managed_finding_comment (id, finding_id, body, created_at, updated_at)
+      SELECT 'legacy:' || lower(hex(randomblob(16))), finding_id, comment, updated_at, updated_at
+      FROM managed_finding_triage WHERE comment IS NOT NULL AND comment != '';
+      UPDATE managed_finding_triage SET comment = NULL WHERE comment IS NOT NULL;`)
+    db.exec('COMMIT')
+  } catch (err) {
+    db.exec('ROLLBACK')
+    throw err
+  }
+}
+
+export function commentMethods(db: ManagedSql): CommentStore {
+  const fields = `c.id, c.finding_id AS findingId, c.body, c.author_id AS authorId,
+    COALESCE(u.login, c.author_login) AS authorLogin,
+    c.created_at AS createdAt, c.updated_at AS updatedAt, c.version`
+  const select = db.prepare(`SELECT ${fields} FROM managed_finding_comment c
+    LEFT JOIN managed_user u ON u.id = c.author_id WHERE c.id = ?`)
+  const list = db.prepare(`SELECT ${fields} FROM managed_finding_comment c
+    LEFT JOIN managed_user u ON u.id = c.author_id
+    WHERE c.finding_id IN (SELECT value FROM json_each(?)) ORDER BY c.created_at NULLS FIRST, c.id`)
+  const insert = db.prepare(`INSERT INTO managed_finding_comment
+    (id, finding_id, body, author_id, author_login, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+  const update = db.prepare(`UPDATE managed_finding_comment SET body = ?, updated_at = ?, version = version + 1
+    WHERE id = ? AND author_id = ? AND version = ?`)
+  const remove = db.prepare('DELETE FROM managed_finding_comment WHERE id = ? AND (author_id = ? OR (author_id IS NULL AND ? IS NULL)) AND version = ?')
+  const userRole = db.prepare('SELECT role FROM managed_user WHERE id = ?')
+  // Deleted comments still have audit events which explicit annotation purges
+  // must find, including when no current triage/comment record remains.
+  const annotated = db.prepare(`SELECT finding_id AS id FROM managed_finding_comment WHERE finding_id IN (SELECT value FROM json_each(?))
+    UNION SELECT finding_id AS id FROM managed_finding_comment_event WHERE finding_id IN (SELECT value FROM json_each(?))`)
+  const event = db.prepare(`INSERT INTO managed_finding_comment_event
+    (comment_id, finding_id, actor_id, actor_login, action, at, report_id, report, repo)
+    VALUES (?, ?, ?, ?, ?, ?, ?, (SELECT filename FROM managed_report WHERE id = ?),
+      (SELECT p.full_name FROM managed_report r JOIN managed_selected_repo p ON p.repo_id = r.repo_id WHERE r.id = ?))`)
+  const read = async (id: string) => (await select.get(id)) as ManagedComment | undefined
+  return {
+    async listComments(ids) { return ids.length > 0 ? (await list.all(JSON.stringify(ids))) as unknown as ManagedComment[] : [] },
+    async listCommentedFindingIds(ids) {
+      const json = JSON.stringify(ids)
+      return ((await annotated.all(json, json)) as { id: string }[]).map(row => row.id)
+    },
+    async getComment(id) { return (await read(id)) ?? null },
+    async createComment(input, now) {
+      const id = randomUUID()
+      const createdAt = input.createdAt === undefined ? now : input.createdAt
+      const updatedAt = input.updatedAt === undefined ? createdAt : input.updatedAt
+      await insert.run(id, input.findingId, input.body, input.authorId, input.authorLogin, createdAt, updatedAt)
+      await event.run(id, input.findingId, input.actor?.id ?? input.authorId, input.actor?.login ?? input.authorLogin, 'added a comment', now,
+        input.reportId ?? null, input.reportId ?? null, input.reportId ?? null)
+      return (await read(id))!
+    },
+    async editComment(id, authorId, authorLogin, body, version, reportId, now) {
+      // Identity/version checks and the event share the operation transaction.
+      const current = await read(id)
+      if (!current || current.authorId !== authorId || current.version !== version || current.body === body) {
+        if (!current) return null
+        if (current.authorId !== authorId) return 'forbidden'
+        if (current.version !== version) return 'conflict'
+        return current
+      }
+      await update.run(body, now, id, authorId, version)
+      await event.run(id, current.findingId, authorId, authorLogin, 'edited a comment', now, reportId, reportId, reportId)
+      return (await read(id))!
+    },
+    async deleteComment(id, actorId, actorLogin, version, reportId, now) {
+      const current = await read(id)
+      const role = (await userRole.get(actorId) as { role: string } | undefined)?.role ?? 'none'
+      const allowed = current != null && canDeleteComment(current, { id: actorId, role })
+      if (!current || !allowed || current.version !== version) {
+        if (!current) return null
+        return allowed ? 'conflict' : 'forbidden'
+      }
+      await remove.run(id, current.authorId, current.authorId, version)
+      await event.run(id, current.findingId, actorId, actorLogin, 'deleted a comment', now, reportId, reportId, reportId)
+      return 'deleted'
+    },
+  }
+}
+
+function migrateCommentDates(db: DatabaseSync): void {
+  const columns = db.prepare('PRAGMA table_info(managed_finding_comment)').all() as { name: string; notnull: number }[]
+  if (!columns.some(column => ['created_at', 'updated_at'].includes(column.name) && column.notnull)) return
+  db.exec('BEGIN')
+  try {
+    db.exec(`CREATE TABLE managed_finding_comment_nullable_dates (${COMMENT_COLUMNS}) STRICT;
+      INSERT INTO managed_finding_comment_nullable_dates (id, finding_id, body, author_id, author_login, created_at, updated_at, version)
+        SELECT id, finding_id, body, author_id, author_login, created_at, updated_at, version FROM managed_finding_comment;
+      DROP TABLE managed_finding_comment;
+      ALTER TABLE managed_finding_comment_nullable_dates RENAME TO managed_finding_comment;
+      CREATE INDEX finding_comment_finding_idx ON managed_finding_comment(finding_id, created_at, id);`)
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}

package/server-managed/config.ts

@@ -0,0 +1,149 @@
+// Managed-server boot config. GitHub user authorization establishes identity;
+// optional App installation credentials enable repository access. A single
+// GitHub App can provide both flows, with repository grants at installation.
+import { env } from 'node:process'
+import { databaseUrls } from '../server-common/database-config.ts'
+import { MAX_UPLOAD_BYTES } from './uploads.ts'
+import { parseStorageKey } from '../server-common/storage-crypto.ts'
+
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
+
+export interface ManagedConfig {
+  port: number
+  host: string
+  dbPath: string
+  neonUrl?: string | null
+  blobToken?: string | null
+  storageEncryptionKey?: string | null
+  storageEncryptionMigrate?: boolean
+  storageEncryptionMigrateMaxMs?: number
+  vercelPreview?: boolean
+  serverless?: boolean
+  debug: boolean
+  allowShare: boolean
+  trustProxyEnv: string | undefined
+  // GitHub App user-authorization (identity) credentials — the App's client id
+  // + secret, used by the login flow.
+  githubClientId: string
+  githubClientSecret: string
+  // Preapproved GitHub identity promoted on login when it is the only user
+  // and its role is No access, including a login after registration.
+  initialAdminGithubId: number | null
+  // Absolute callback registered with GitHub, e.g.
+  // 'https://triage.example.com/api/oauth/github/callback'.
+  oauthCallbackUrl: string
+  // Whether cookies carry `Secure` (callback is https). Also gates the
+  // `__Host-` prefix, so loopback http dev can run with a plain cookie name.
+  cookieSecure: boolean
+  sessionCookieName: string
+  sessionTtlMs: number
+  // Optional installation credentials for the same GitHub App as login.
+  // Repository permissions are approved when connecting repositories.
+  githubAppId: string | null
+  githubAppPrivateKey: string | null
+  githubAppSlug: string | null
+  githubNewIssueLabels?: string
+  // Max accepted size (bytes) for an uploaded report on the "Manage reports"
+  // page. Reports are findings dumps (JSON / markdown / CSV), small to a few MB.
+  maxReportBytes: number
+  // Max accepted size (bytes) for an uploaded bundle (sourcemap / stasis
+  // archive). Bundles run larger than reports, so a higher cap (default 200 MiB).
+  maxBundleBytes: number
+  // How many triage-trail events to keep per finding (managed_finding_triage_event):
+  // 0, the default, keeps everything — the trail is the record. An operator
+  // who would rather bound the store sets a positive count; older events of a
+  // finding are then trimmed as new ones land.
+  triageHistoryLimit: number
+}
+
+function fail(msg: string): never {
+  throw new Error(msg)
+}
+
+function requireStr(name: string): string {
+  const v = env[name]
+  if (v == null || v === '') fail(`Missing required env ${name} (managed mode).`)
+  return v
+}
+
+function intEnv(name: string, def: number, min: number, max: number): number {
+  const raw = env[name]
+  const n = raw == null ? def : Number(raw)
+  if (!Number.isSafeInteger(n) || n < min || n > max) {
+    fail(`Invalid ${name}: ${raw} — must be an integer in [${min}, ${max}].`)
+  }
+  return n
+}
+
+function optionalGithubId(name: string): number | null {
+  const raw = env[name]
+  if (raw == null || raw === '') return null
+  const id = Number(raw)
+  if (!/^[1-9]\d*$/u.test(raw) || !Number.isSafeInteger(id)) {
+    fail(`Invalid ${name}: must be a single positive numeric GitHub user ID.`)
+  }
+  return id
+}
+
+function urlOrFail(name: string, raw: string): URL {
+  try { return new URL(raw) } catch { fail(`${name} is not a valid URL: ${raw}`) }
+}
+
+export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
+  const serverless = env['VERCEL'] === '1'
+  const neonUrl = databaseUrls({ combined }).managed
+  const blobToken = env['BLOB_READ_WRITE_TOKEN'] || null
+  const storageEncryptionKey = env['MANAGED_STORAGE_ENCRYPTION_KEY'] || null
+  parseStorageKey(storageEncryptionKey)
+  const storageEncryptionMigrate = env['MANAGED_STORAGE_ENCRYPTION_MIGRATE'] === '1'
+  if (storageEncryptionMigrate && !storageEncryptionKey) fail('MANAGED_STORAGE_ENCRYPTION_MIGRATE requires MANAGED_STORAGE_ENCRYPTION_KEY.')
+  if (serverless && !neonUrl) fail('Vercel managed mode requires DATABASE_URL or MANAGED_DATABASE_URL.')
+  if (neonUrl && !blobToken) fail('Managed Neon mode requires BLOB_READ_WRITE_TOKEN.')
+  const host = env['HOST'] ?? '127.0.0.1'
+  const oauthCallbackUrl = requireStr('OAUTH_CALLBACK_URL')
+  const callback = urlOrFail('OAUTH_CALLBACK_URL', oauthCallbackUrl)
+  const cookieSecure = callback.protocol === 'https:'
+  // A `__Host-` cookie mandates `Secure`, so any non-loopback bind must be
+  // HTTPS — fail fast (mirrors server-e2e's boot check). Loopback dev over
+  // http is allowed with a non-prefixed cookie name.
+  if ((serverless || !LOOPBACK_HOSTS.has(host)) && !cookieSecure) {
+    fail(`Vercel or non-loopback HOST=${host} requires an https OAUTH_CALLBACK_URL — the session cookie needs Secure.`)
+  }
+  const sessionCookieName = env['SESSION_COOKIE_NAME'] ?? '__Host-dvsid'
+  if (sessionCookieName.startsWith('__Host-') && !cookieSecure) {
+    fail(`SESSION_COOKIE_NAME=${sessionCookieName} uses the __Host- prefix but the callback is not https. Use a non-prefixed name for loopback http dev.`)
+  }
+  return {
+    neonUrl, blobToken, serverless, storageEncryptionKey, storageEncryptionMigrate,
+    storageEncryptionMigrateMaxMs: intEnv('MANAGED_STORAGE_ENCRYPTION_MIGRATE_MAX_MS', 150_000, 1, serverless ? 240_000 : 3_600_000),
+    vercelPreview: env['VERCEL_ENV'] === 'preview',
+    port: intEnv('PORT', 8765, 0, 65535),
+    host,
+    // DB_PATH belongs to e2e in a combined process. Keep the two stores apart.
+    dbPath: env['MANAGED_DB_PATH'] ?? (combined ? undefined : env['DB_PATH']) ?? 'server-managed/data/managed.db',
+    debug: env['DEBUG'] === '1' || env['DEBUG'] === 'true',
+    allowShare: env['DEEPVIEW_ALLOW_SHARE'] === '1',
+    trustProxyEnv: env['TRUST_PROXY'] ?? (serverless ? '1' : undefined),
+    githubClientId: requireStr('GITHUB_CLIENT_ID'),
+    githubClientSecret: requireStr('GITHUB_CLIENT_SECRET'),
+    initialAdminGithubId: optionalGithubId('MANAGED_INITIAL_ADMIN_GITHUB_ID'),
+    oauthCallbackUrl,
+    cookieSecure,
+    sessionCookieName,
+    sessionTtlMs: intEnv('SESSION_TTL_MS', 1_209_600_000, 60_000, 7_776_000_000),
+    githubAppId: env['GITHUB_APP_ID'] ?? null,
+    githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
+    githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
+    githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
+    maxReportBytes: intEnv('MAX_REPORT_BYTES', 10_485_760, 1, 104_857_600),
+    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
+    triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
+  }
+}
+
+// PEM private keys are awkward in env vars; accept a literal multi-line value or
+// one with escaped newlines (`\n`). Empty/absent → null (private repos off).
+function normalizePem(raw: string | undefined): string | null {
+  if (raw == null || raw === '') return null
+  return raw.includes('\\n') ? raw.replaceAll('\\n', '\n') : raw
+}

package/server-managed/content-access.ts

@@ -0,0 +1,15 @@
+import type { ManagedDb, StoredUser } from './db.ts'
+
+export type RepoScope = { repoId: number; path: string | null }
+type Content = { repoId: number | null; repoDirectory?: string }
+
+// Read grants for each request: neither the manager role nor a cached page
+// confers repository access. Bundles have repository scope; reports also have
+// a directory scope. Unassigned content is only available to administrators.
+export async function contentAccess(db: Pick<ManagedDb, 'listRepoScopesForUser'>, user: StoredUser) {
+  const scopes = user.role === 'admin' ? null : await db.listRepoScopesForUser(user.id)
+  const bundle = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId)
+  const report = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId
+    && (!scope.path || item.repoDirectory === scope.path || item.repoDirectory?.startsWith(scope.path + '/')))
+  return { scopes, bundle, report }
+}

package/server-managed/crypto.ts

@@ -0,0 +1,25 @@
+// Token helpers for the managed auth server. The raw session token lives ONLY
+// in the cookie; the DB row id is its SHA-256 (see db.ts / session.ts), so a
+// DB read can't reconstruct a live cookie. No HMAC pepper is needed — the
+// tokens are 256-bit random, not guessable or reversible from their hash.
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+
+// 256-bit URL-safe random token: the session cookie value and the OAuth CSRF
+// `state` nonce.
+export function randomToken(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+// At-rest id for a session cookie token (stored as the managed_session PK).
+export function hashToken(token: string): string {
+  return createHash('sha256').update(token, 'utf8').digest('base64url')
+}
+
+// Constant-time equality for CSRF / OAuth-state checks. A length mismatch
+// short-circuits (the length of these fixed-width tokens isn't a secret).
+export function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a, 'utf8')
+  const bb = Buffer.from(b, 'utf8')
+  if (ab.length !== bb.length) return false
+  return timingSafeEqual(ab, bb)
+}