@preventive/triage 1.0.0-alpha.3 → 1.0.0-alpha.31

package/server-managed/github-metadata.ts

@@ -0,0 +1,98 @@
+import type { GithubFixStatus, GithubIssueClosedReason } from '../common/github-pr.ts'
+import type { ManagedSql } from './sql.ts'
+
+export interface GithubMetadata {
+  key: string
+  title: string
+  description: string | null
+  status: GithubFixStatus
+  // NULL on legacy entries; 'unknown' means a closed issue was checked but
+  // GitHub supplied no recognized reason, so it needs no further backfill.
+  stateReason: GithubIssueClosedReason | null
+  fetchedAt: number
+  attemptedAt: number | null
+}
+export interface GithubRepositoryVisibility {
+  repoId: number
+  github: string
+  public: boolean
+  checkedAt: number
+}
+export interface GithubMetadataStore {
+  listGithubMetadata(keys: readonly string[]): Promise<GithubMetadata[]>
+  setGithubMetadata(entries: readonly Omit<GithubMetadata, 'attemptedAt'>[]): Promise<void>
+  recordGithubMetadataAttempts(keys: readonly string[], attemptedAt: number): Promise<void>
+  listGithubRepositoryVisibility(repoIds: readonly number[]): Promise<GithubRepositoryVisibility[]>
+  setGithubRepositoryVisibility(entries: readonly GithubRepositoryVisibility[]): Promise<void>
+}
+
+// Successful GitHub reads are shared and retained without eviction. The stable
+// repository ID in the key survives renames, but is never an access grant.
+// Callers must verify current user -> team -> repo grants plus either recently
+// verified public visibility or the viewer's live GitHub access with their token.
+export const GITHUB_STATE_REASON_COLUMN = "TEXT CHECK (state_reason IN ('completed', 'not_planned', 'duplicate', 'unknown'))"
+export const GITHUB_METADATA_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_github_metadata (
+  cache_key TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  description TEXT,
+  status TEXT NOT NULL CHECK (status IN ('open', 'draft', 'closed', 'merged')),
+  state_reason ${GITHUB_STATE_REASON_COLUMN},
+  fetched_at INTEGER NOT NULL,
+  attempted_at INTEGER
+) STRICT;
+CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
+  repo_id INTEGER PRIMARY KEY,
+  github TEXT NOT NULL,
+  is_public INTEGER NOT NULL CHECK (is_public IN (0, 1)),
+  checked_at INTEGER NOT NULL
+) STRICT;
+`
+
+export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
+  const list = db.prepare(`SELECT cache_key AS key, title, description, status, state_reason AS stateReason, fetched_at AS fetchedAt, attempted_at AS attemptedAt
+    FROM managed_github_metadata WHERE cache_key IN (SELECT value FROM json_each(?))`)
+  const set = db.prepare(`INSERT INTO managed_github_metadata (cache_key, title, description, status, state_reason, fetched_at)
+    SELECT json_extract(e.value, '$.key'), json_extract(e.value, '$.title'),
+      json_extract(e.value, '$.description'), json_extract(e.value, '$.status'), json_extract(e.value, '$.stateReason'),
+      CAST(json_extract(e.value, '$.fetchedAt') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (cache_key) DO UPDATE SET title = excluded.title, description = excluded.description,
+      status = excluded.status, state_reason = excluded.state_reason, fetched_at = excluded.fetched_at
+    WHERE managed_github_metadata.status != 'merged' AND managed_github_metadata.fetched_at <= excluded.fetched_at`)
+  // Scheduling attempts never overwrite metadata or make stale data fresh.
+  // The monotonic guard preserves a newer attempt recorded by another reader.
+  const attempt = db.prepare(`UPDATE managed_github_metadata SET attempted_at = ?
+    WHERE cache_key IN (SELECT value FROM json_each(?)) AND (attempted_at IS NULL OR attempted_at < ?)`)
+  const visibility = db.prepare(`SELECT repo_id AS repoId, github, is_public AS public, checked_at AS checkedAt
+    FROM managed_github_repository_visibility WHERE repo_id IN (SELECT CAST(value AS BIGINT) FROM json_each(?))`)
+  const setVisibility = db.prepare(`INSERT INTO managed_github_repository_visibility (repo_id, github, is_public, checked_at)
+    SELECT CAST(json_extract(e.value, '$.repoId') AS BIGINT), json_extract(e.value, '$.github'),
+      CAST(json_extract(e.value, '$.public') AS BIGINT), CAST(json_extract(e.value, '$.checkedAt') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (repo_id) DO UPDATE SET github = excluded.github, is_public = excluded.is_public, checked_at = excluded.checked_at
+    WHERE managed_github_repository_visibility.checked_at < excluded.checked_at
+      OR (managed_github_repository_visibility.checked_at = excluded.checked_at
+        AND (managed_github_repository_visibility.is_public = 1 OR excluded.is_public = 0))`)
+  return {
+    async listGithubMetadata(keys) {
+      if (keys.length === 0) return []
+      const rows = await list.all(JSON.stringify(keys)) as GithubMetadata[]
+      return rows.map(row => ({ ...row }))
+    },
+    async setGithubMetadata(entries) {
+      if (entries.length > 0) await set.run({ contexts: JSON.stringify(entries) })
+    },
+    async recordGithubMetadataAttempts(keys, attemptedAt) {
+      if (keys.length > 0) await attempt.run(attemptedAt, JSON.stringify(keys), attemptedAt)
+    },
+    async listGithubRepositoryVisibility(repoIds) {
+      if (repoIds.length === 0) return []
+      const rows = await visibility.all(JSON.stringify(repoIds)) as (Omit<GithubRepositoryVisibility, 'public'> & { public: number })[]
+      return rows.map(row => ({ ...row, public: row.public === 1 }))
+    },
+    async setGithubRepositoryVisibility(entries) {
+      if (entries.length > 0) await setVisibility.run({ contexts: JSON.stringify(entries.map(entry => ({ ...entry, public: entry.public ? 1 : 0 }))) })
+    },
+  }
+}

package/server-managed/github-oauth.ts

@@ -0,0 +1,199 @@
+// GitHub App user authorization for managed sign-in. Configure no additional
+// account permissions on the App. Repository permissions are granted separately
+// at installation; login does not install the App or request OAuth scopes.
+import { Buffer } from 'node:buffer'
+import type { AvatarStore } from './avatar-store.ts'
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedUser, UserTokens } from './db.ts'
+import { randomToken, safeEqual } from './crypto.ts'
+import { STATE_COOKIE, buildCookie, clearCookie, cookieName, createSession, parseCookies } from './session.ts'
+
+const GITHUB_AUTHORIZE_URL = 'https://github.com/login/oauth/authorize'
+const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token'
+const GITHUB_USER_URL = 'https://api.github.com/user'
+const STATE_TTL_S = 600
+
+export const LOGIN_PATH = '/api/oauth/github/login'
+export const CALLBACK_PATH = '/api/oauth/github/callback'
+
+// A failure with the HTTP status the router should surface.
+export class OAuthError extends Error {
+  status: number
+  constructor(status: number, message: string) {
+    super(message)
+    this.name = 'OAuthError'
+    this.status = status
+  }
+}
+
+export interface CallbackResult { location: string; setCookies: string[] }
+export interface CallbackDeps { config: ManagedConfig; db: ManagedDb; avatarStore?: AvatarStore; now?: number; fetchImpl?: typeof fetch }
+
+// GET /api/oauth/github/login — redirect to GitHub, stashing the CSRF state. No
+// `scope` is sent: as the GitHub App user-authorization flow, the App's own
+// permission set governs access. Keep account permissions minimal; repository
+// grants are approved separately when installing the App.
+export function buildLoginRedirect(config: ManagedConfig): { location: string; setCookie: string } {
+  const state = randomToken()
+  const u = new URL(GITHUB_AUTHORIZE_URL)
+  u.searchParams.set('client_id', config.githubClientId)
+  u.searchParams.set('redirect_uri', config.oauthCallbackUrl)
+  u.searchParams.set('state', state)
+  u.searchParams.set('allow_signup', 'false')
+  const setCookie = buildCookie(cookieName(config, STATE_COOKIE), state, {
+    maxAgeS: STATE_TTL_S, secure: config.cookieSecure, sameSite: 'Lax',
+  })
+  return { location: u.toString(), setCookie }
+}
+
+// GET /api/oauth/github/callback?code&state — the GitHub OAuth hook.
+export async function handleCallback(
+  query: URLSearchParams, cookieHeader: string | undefined, deps: CallbackDeps,
+): Promise<CallbackResult> {
+  const { config, db } = deps
+  const now = deps.now ?? Date.now()
+  const fetchImpl = deps.fetchImpl ?? globalThis.fetch
+  const code = query.get('code')
+  const state = query.get('state')
+  const stateCookie = parseCookies(cookieHeader).get(cookieName(config, STATE_COOKIE))
+  // CSRF: the `state` GitHub echoes back must match the one we set at /login.
+  if (!code || !state || !stateCookie || !safeEqual(state, stateCookie)) {
+    throw new OAuthError(400, 'invalid-oauth-state')
+  }
+  const tokens = await exchangeCode(config, code, now, fetchImpl)
+  const user = await fetchIdentity(tokens.accessToken, fetchImpl)
+  const { setCookie, userId } = await createSession(config, db, user, now)
+  // Persist the user token so the repositories page can list repos on demand.
+  await db.setUserTokens(userId, tokens)
+  // Cache the avatar for same-origin serving (the page's CSP forbids loading
+  // github's CDN directly). Best-effort: a fetch/store failure must not break
+  // login, and the avatar endpoint just 404s until a later login fills it.
+  if (deps.avatarStore != null && user.avatarUrl != null) {
+    await cacheAvatar(deps.avatarStore, userId, user.avatarUrl, fetchImpl).catch((err) => {
+      console.warn('managed: avatar cache failed:', err)
+    })
+  }
+  // Clear the spent state cookie, set the session cookie, land on the app.
+  return {
+    location: '/',
+    setCookies: [clearCookie(cookieName(config, STATE_COOKIE), config.cookieSecure), setCookie],
+  }
+}
+
+// Exchange the authorization code for a user-to-server token set.
+export function exchangeCode(config: ManagedConfig, code: string, now: number, fetchImpl: typeof fetch): Promise<UserTokens> {
+  return postToken({
+    client_id: config.githubClientId, client_secret: config.githubClientSecret,
+    code, redirect_uri: config.oauthCallbackUrl,
+  }, now, fetchImpl)
+}
+
+// Refresh an expiring user-to-server token (GitHub Apps with expiring tokens
+// enabled). Returns the fresh token set; OAuthError(502) on any failure.
+export function refreshUserToken(config: ManagedConfig, refreshToken: string, now: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<UserTokens> {
+  return postToken({
+    client_id: config.githubClientId, client_secret: config.githubClientSecret,
+    grant_type: 'refresh_token', refresh_token: refreshToken,
+  }, now, fetchImpl)
+}
+
+// POST the GitHub token endpoint and parse the {access_token, refresh_token?,
+// expires_in?} body into a UserTokens (expiry resolved to an absolute ms time).
+async function postToken(payload: Record<string, string>, now: number, fetchImpl: typeof fetch): Promise<UserTokens> {
+  let res: Response
+  try {
+    res = await fetchImpl(GITHUB_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'accept': 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify(payload),
+    })
+  } catch { throw new OAuthError(502, 'github-token-unreachable') }
+  if (!res.ok) throw new OAuthError(502, `github-token-status-${res.status}`)
+  let body: unknown
+  try { body = await res.json() } catch { throw new OAuthError(502, 'github-token-malformed') }
+  const tok = (body as { access_token?: unknown }).access_token
+  if (typeof tok !== 'string' || tok === '') throw new OAuthError(502, 'github-token-denied')
+  const refresh = (body as { refresh_token?: unknown }).refresh_token
+  const expiresIn = (body as { expires_in?: unknown }).expires_in
+  return {
+    accessToken: tok,
+    refreshToken: typeof refresh === 'string' && refresh !== '' ? refresh : null,
+    expiresAt: typeof expiresIn === 'number' && expiresIn > 0 ? now + expiresIn * 1000 : null,
+  }
+}
+
+// Resolve a usable access token for a user: the stored one if still valid, else
+// refreshed (when a refresh token is on file) and re-persisted. Null when there
+// is no token or it's expired and unrefreshable — the caller prompts re-login.
+// A 60s skew margin avoids handing back a token about to expire mid-request.
+export async function ensureUserAccessToken(
+  config: ManagedConfig, db: ManagedDb, userId: string, now: number, fetchImpl: typeof fetch = globalThis.fetch,
+): Promise<string | null> {
+  const tokens = await db.getUserTokens(userId)
+  if (tokens == null) return null
+  if (tokens.expiresAt == null || tokens.expiresAt > now + 60_000) return tokens.accessToken
+  if (tokens.refreshToken == null) return null
+  try {
+    const fresh = await refreshUserToken(config, tokens.refreshToken, now, fetchImpl)
+    await db.setUserTokens(userId, fresh)
+    return fresh.accessToken
+  } catch (err) {
+    console.warn('managed: token refresh failed:', err)
+    return null
+  }
+}
+
+// Read the authenticated user's identity (`GET /user`).
+export async function fetchIdentity(token: string, fetchImpl: typeof fetch): Promise<ManagedUser> {
+  let res: Response
+  try {
+    res = await fetchImpl(GITHUB_USER_URL, {
+      headers: {
+        'authorization': `Bearer ${token}`, 'accept': 'application/vnd.github+json',
+        'user-agent': 'deepview-triage', 'x-github-api-version': '2022-11-28',
+      },
+    })
+  } catch { throw new OAuthError(502, 'github-user-unreachable') }
+  if (!res.ok) throw new OAuthError(502, `github-user-status-${res.status}`)
+  let body: unknown
+  try { body = await res.json() } catch { throw new OAuthError(502, 'github-user-malformed') }
+  const user = parseGithubUser(body)
+  if (user == null) throw new OAuthError(502, 'github-user-invalid')
+  return user
+}
+
+// Validate GitHub's `GET /user` payload into a ManagedUser (or null).
+function parseGithubUser(body: unknown): ManagedUser | null {
+  if (body == null || typeof body !== 'object') return null
+  const id = (body as { id?: unknown }).id
+  const login = (body as { login?: unknown }).login
+  if (typeof id !== 'number' || !Number.isSafeInteger(id) || typeof login !== 'string' || login === '') return null
+  const name = (body as { name?: unknown }).name
+  const avatar = (body as { avatar_url?: unknown }).avatar_url
+  return {
+    githubUserId: id, login,
+    name: typeof name === 'string' ? name : null,
+    avatarUrl: typeof avatar === 'string' ? avatar : null,
+  }
+}
+
+// Fetch the user's GitHub avatar and cache it for same-origin serving. The host
+// is validated (githubusercontent.com over https) as SSRF defence-in-depth,
+// even though the URL comes from GitHub's own /user response.
+async function cacheAvatar(store: AvatarStore, id: string, avatarUrl: string, fetchImpl: typeof fetch): Promise<void> {
+  if (!isGithubAvatarUrl(avatarUrl)) return
+  // `redirect: 'manual'` so a 3xx off the (validated) avatars host can't bounce
+  // the fetch to an internal address — an opaque-redirect / 3xx fails the
+  // `res.ok` + image check below and is skipped (SSRF defence-in-depth).
+  const res = await fetchImpl(avatarUrl, { redirect: 'manual' })
+  const contentType = res.headers.get('content-type') ?? ''
+  if (!res.ok || !contentType.startsWith('image/')) return
+  await store.put(id, contentType, Buffer.from(await res.arrayBuffer()))
+}
+
+function isGithubAvatarUrl(raw: string): boolean {
+  let url: URL
+  try { url = new URL(raw) } catch { return false }
+  return url.protocol === 'https:'
+    && (url.hostname === 'avatars.githubusercontent.com' || url.hostname.endsWith('.githubusercontent.com'))
+}

package/server-managed/github-pulls.ts

@@ -0,0 +1,227 @@
+import { type GithubFixRef, type GithubFixResult, type GithubFixStatus, githubIssueClosedReason, isGithubRepoName, parseGithubFixUrl } from '../common/github-pr.ts'
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
+import type { GithubMetadata, GithubRepositoryVisibility } from './github-metadata.ts'
+import { ensureUserAccessToken } from './github-oauth.ts'
+
+type Metadata = Pick<GithubMetadata, 'title' | 'description' | 'status' | 'stateReason'>
+const MAX_GITHUB_LOOKUPS = 200
+const GITHUB_LOOKUP_TIMEOUT_MS = 10_000
+const GITHUB_METADATA_TTL_MS = 60_000
+const GITHUB_PUBLIC_VISIBILITY_TTL_MS = 60_000
+const GITHUB_PRIVATE_REPOSITORIES_URL = 'https://api.github.com/user/repos?visibility=private&per_page=100&page=1'
+
+type Repository = TeamReportAccessSnapshot['repositories'][number]
+type RepositoryPayload = { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; permissions?: { pull?: unknown } }
+type RepositoryChecks = { remaining: number; verified: Set<string> }
+type RepositoryAccessContext = {
+  db: ManagedDb
+  visibility: GithubRepositoryVisibility[]
+  publicRepos: Set<string>
+  token: string | null
+  signal: AbortSignal
+  fetchImpl: typeof fetch
+  checks: RepositoryChecks
+  includePrivateList?: boolean
+}
+
+function githubRequest(token: string | null): RequestInit {
+  return {
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}), accept: 'application/vnd.github+json',
+      'user-agent': 'deepview-triage', 'x-github-api-version': '2022-11-28',
+    },
+    redirect: 'error',
+  }
+}
+
+function repositoryMatches(repo: Repository, body: RepositoryPayload | null): boolean {
+  return body?.id === repo.repoId && typeof body.full_name === 'string' && body.full_name.toLowerCase() === repo.github.toLowerCase()
+}
+
+async function listPrivateRepositories(token: string, signal: AbortSignal, fetchImpl: typeof fetch): Promise<(RepositoryPayload | null)[]> {
+  try {
+    const response = await fetchImpl(GITHUB_PRIVATE_REPOSITORIES_URL, githubRequest(token))
+    if (!response.ok) return []
+    const body = await response.json() as (RepositoryPayload | null)[] | null
+    return Array.isArray(body) && body.length <= 100 && !signal.aborted ? body : []
+  } catch { return [] } // A failed list is unknown access; direct checks can still verify it.
+}
+
+// Public visibility can be reused briefly across users. Private access stays
+// request-local: one page of the viewer's own repo list grants matching repos,
+// then direct checks cover omissions, pagination and failed list requests.
+async function readableRepositories(repositories: Repository[], { db, visibility, publicRepos, token, signal, fetchImpl, checks, includePrivateList = true }: RepositoryAccessContext): Promise<Set<string>> {
+  const readable = new Set(publicRepos)
+  const byId = new Map(repositories.map(repo => [repo.repoId, repo]))
+  const unverified = repositories.filter(repo => !readable.has(repo.github))
+  const updates = new Map<number, GithubRepositoryVisibility>()
+  const grant = (repo: Repository, body: RepositoryPayload, checkedAt: number) => {
+    const isPublic = body.private === false && body.visibility === 'public'
+    readable.add(repo.github)
+    checks.verified.add(repo.github)
+    if (isPublic) publicRepos.add(repo.github)
+    updates.set(repo.repoId, { repoId: repo.repoId, github: repo.github, public: isPublic, checkedAt })
+  }
+  if (includePrivateList && token && unverified.length > 0 && !signal.aborted) {
+    const checkedAt = Date.now()
+    for (const entry of await listPrivateRepositories(token, signal, fetchImpl)) {
+      const repo = typeof entry?.id === 'number' ? byId.get(entry.id) : undefined
+      if (repo && !readable.has(repo.github) && repositoryMatches(repo, entry) && entry?.permissions?.pull === true) grant(repo, entry, checkedAt)
+    }
+  }
+  const formerlyPublic = new Set(visibility.filter(entry => entry.public
+    && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => entry.repoId))
+  const pending = unverified.filter(repo => !readable.has(repo.github) && (token || formerlyPublic.has(repo.repoId))).slice(0, checks.remaining)
+  checks.remaining -= pending.length
+  for (let i = 0; i < pending.length && !signal.aborted; i += 4) {
+    await Promise.all(pending.slice(i, i + 4).map(async repo => {
+      if (signal.aborted) return
+      const checkedAt = Date.now()
+      try {
+        const response = await fetchImpl(`https://api.github.com/repos/${repo.github}`, githubRequest(token))
+        if (!response.ok) return
+        const body = await response.json() as RepositoryPayload | null
+        if (!signal.aborted && body && repositoryMatches(repo, body)
+          && (token || (body.private === false && body.visibility === 'public'))) grant(repo, body, checkedAt)
+      } catch { /* Unverified access must never expose cached metadata. */ }
+    }))
+  }
+  if (updates.size > 0) await db.setGithubRepositoryVisibility([...updates.values()])
+  return readable
+}
+
+async function verifyPublicRefreshes(config: ManagedConfig, userId: string, repositories: Repository[], context: RepositoryAccessContext): Promise<string | null> {
+  // Cached public metadata needs no credentials. New content uses a viewer
+  // token only after a live check, so privatization cannot publish private data
+  // under an old public grant. Anonymous reads remain available without a token.
+  const { db, publicRepos } = context
+  const token = context.token ?? await ensureUserAccessToken(config, db, userId, Date.now(), context.fetchImpl)
+  if (token) {
+    const currentPublic = new Set<string>()
+    const readable = await readableRepositories(repositories, { ...context, publicRepos: currentPublic, token, includePrivateList: false })
+    for (const repo of repositories) if (readable.has(repo.github) && !currentPublic.has(repo.github)) publicRepos.delete(repo.github)
+  }
+  return token
+}
+
+// ref.repo is always the canonical name from managed_selected_repo, never an
+// owner/repo/path taken from a Fix URL. Redirects cannot move the user token.
+async function fetchMetadata(ref: GithubFixRef, token: string | null, fetchImpl: typeof fetch): Promise<Metadata | null> {
+  try {
+    const response = await fetchImpl(`https://api.github.com/repos/${ref.repo}/${ref.kind === 'pull' ? 'pulls' : 'issues'}/${ref.number}`, githubRequest(token))
+    if (!response.ok) return null
+    const body = await response.json() as { number?: unknown; title?: unknown; body?: unknown; state?: unknown; merged?: unknown;
+      draft?: unknown; base?: { repo?: { full_name?: unknown } }; repository_url?: unknown; pull_request?: unknown; state_reason?: unknown } | null
+    if (body?.number !== ref.number || typeof body.title !== 'string' || !body.title.trim() || body.title.length > 1024
+      || !['open', 'closed'].includes(String(body.state)) || (body.body != null && typeof body.body !== 'string')) return null
+    let status: GithubFixStatus
+    if (ref.kind === 'pull') {
+      if (typeof body.merged !== 'boolean' || typeof body.base?.repo?.full_name !== 'string'
+        || body.base.repo.full_name.toLowerCase() !== ref.repo.toLowerCase()) return null
+      status = body.merged ? 'merged' : body.state === 'closed' ? 'closed' : body.draft === true ? 'draft' : 'open'
+    } else {
+      // The issues API also accepts PR numbers. Do not cache a PR as a closed
+      // ordinary issue: only the pulls API can establish its merged state.
+      if (body.pull_request != null || typeof body.repository_url !== 'string'
+        || body.repository_url.toLowerCase() !== `https://api.github.com/repos/${ref.repo}`.toLowerCase()) return null
+      status = body.state === 'closed' ? 'closed' : 'open'
+    }
+    const stateReason = ref.kind === 'issue' && status === 'closed' ? githubIssueClosedReason(body.state_reason) : null
+    return { title: body.title, description: body.body ?? null, status, stateReason }
+  } catch { return null }
+}
+
+// The workspace handler checks user -> team membership and finding visibility.
+// Shared private metadata also requires this viewer's live GitHub access,
+// including for admins. Only recently verified public repos skip that check.
+export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot: TeamReportAccessSnapshot, urls: string[], fetchImpl: typeof fetch = globalThis.fetch): Promise<GithubFixResult[]> {
+  const allowed = new Map(snapshot.repositories.filter(repo => isGithubRepoName(repo.github)).map(repo => [repo.github.toLowerCase(), repo]))
+  const parsed = urls.map(parseGithubFixUrl)
+  const jobs = new Map<string, GithubFixRef>()
+  const keys = parsed.map(ref => {
+    const repo = ref && allowed.get(ref.repo.toLowerCase())
+    if (!ref || !repo) return null
+    const key = `${repo.repoId}:${ref.kind}:${ref.number}`
+    jobs.set(key, { ...ref, repo: repo.github })
+    return key
+  })
+  if (jobs.size === 0) return []
+  const now = Date.now()
+  const signal = AbortSignal.timeout(GITHUB_LOOKUP_TIMEOUT_MS)
+  const fetchWithinDeadline: typeof fetch = (input, init) => {
+    signal.throwIfAborted()
+    return fetchImpl(input, { ...init, signal })
+  }
+  const repositories = [...new Map([...jobs.values()].map(ref => {
+    const repo = allowed.get(ref.repo.toLowerCase())!
+    return [repo.repoId, repo] as const
+  })).values()]
+  const visibility = await db.listGithubRepositoryVisibility(repositories.map(repo => repo.repoId))
+  const byId = new Map(repositories.map(repo => [repo.repoId, repo]))
+  const publicRepos = new Set(visibility.filter(entry => entry.public && entry.checkedAt <= now
+    && entry.checkedAt + GITHUB_PUBLIC_VISIBILITY_TTL_MS > now
+    && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => byId.get(entry.repoId)!.github))
+  let token = repositories.some(repo => !publicRepos.has(repo.github))
+    ? await ensureUserAccessToken(config, db, snapshot.user.id, now, fetchWithinDeadline) : null
+  const checks: RepositoryChecks = { remaining: MAX_GITHUB_LOOKUPS, verified: new Set() }
+  const context = { db, visibility, publicRepos, token, signal, fetchImpl: fetchWithinDeadline, checks }
+  const readable = await readableRepositories(repositories, context)
+  const authorized = [...jobs.entries()].filter(([, ref]) => readable.has(ref.repo))
+  const metadata = new Map((await db.listGithubMetadata(authorized.map(([key]) => key))).map(entry => [entry.key, entry]))
+  const lastCheckedAt = (key: string) => {
+    const cached = metadata.get(key)
+    return Math.max(cached?.fetchedAt ?? 0, cached?.attemptedAt ?? 0)
+  }
+  const pending = authorized.filter(([key, ref]) => {
+    const cached = metadata.get(key)
+    // Backfill closed issues cached before closure reasons existed, within the
+    // same authorized/capped queue. Even an unknown reason completes backfill.
+    return !cached || (ref.kind === 'issue' && cached.status === 'closed' && cached.stateReason == null)
+      || (['open', 'draft'].includes(cached.status) && cached.fetchedAt + GITHUB_METADATA_TTL_MS <= now)
+  }).toSorted(([a], [b]) => lastCheckedAt(a) - lastCheckedAt(b)).slice(0, MAX_GITHUB_LOOKUPS)
+  // Only stale/missing, distinct, authorized entries consume the request budget.
+  // Prioritize missing/oldest entries so a large workspace makes progress.
+  if (pending.length > 0) {
+    const publicRefreshes = new Set(pending.filter(([, ref]) => publicRepos.has(ref.repo) && !checks.verified.has(ref.repo)).map(([, ref]) => ref.repo))
+    if (publicRefreshes.size > 0) token = await verifyPublicRefreshes(config, snapshot.user.id, repositories.filter(repo => publicRefreshes.has(repo.github)), context)
+    const fresh: Omit<GithubMetadata, 'attemptedAt'>[] = []
+    const attempted: string[] = []
+    // All waves and access checks share one deadline and four-call limit.
+    for (let i = 0; i < pending.length && !signal.aborted; i += 4) {
+      await Promise.all(pending.slice(i, i + 4).map(async ([key, ref]) => {
+        if (signal.aborted) return
+        if (metadata.has(key)) attempted.push(key)
+        const result = await fetchMetadata(ref, publicRepos.has(ref.repo) && !checks.verified.has(ref.repo) ? null : token, fetchWithinDeadline)
+        if (result) fresh.push({ key, ...result, fetchedAt: Date.now() })
+      }))
+    }
+    // Only started cached reads rotate. Missing entries retain priority, and
+    // jobs skipped by the cap, deadline or absent token keep their place.
+    if (attempted.length > 0) await db.recordGithubMetadataAttempts(attempted, Date.now())
+    if (fresh.length > 0) {
+      await db.setGithubMetadata(fresh)
+      // A concurrent merged result must win over a slower open/closed read.
+      for (const entry of await db.listGithubMetadata(fresh.map(row => row.key))) metadata.set(entry.key, entry)
+    }
+  }
+  if (publicRepos.size > 0) {
+    // Another request may already have discovered a public -> private change
+    // and written new private metadata. Honor that newer visibility observation.
+    const current = await db.listGithubRepositoryVisibility(repositories.filter(repo => publicRepos.has(repo.github)).map(repo => repo.repoId))
+    const stillPublic = new Set(current.filter(entry => entry.public
+      && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => byId.get(entry.repoId)!.github))
+    for (const [key, ref] of authorized) if (publicRepos.has(ref.repo) && !stillPublic.has(ref.repo)) metadata.delete(key)
+  }
+  // The handler rechecks workspace access and saved Fix links before returning.
+  return urls.flatMap((url, index): GithubFixResult[] => {
+    const key = keys[index]
+    if (!key) return []
+    const found = metadata.get(key)
+    return [found ? { url, title: found.title, description: found.description, status: found.status, stateReason: found.stateReason } : { url, error: 'unavailable' }]
+  })
+}
+
+export function storedFixUrls(entries: { fix: string | null }[]): string[] {
+  return [...new Set(entries.flatMap(entry => entry.fix && parseGithubFixUrl(entry.fix) ? [entry.fix] : []))].toSorted()
+}

package/server-managed/http-response.ts

@@ -0,0 +1,18 @@
+import type { ServerResponse } from 'node:http'
+import { Buffer } from 'node:buffer'
+import { UPLOAD_CHUNK_BYTES } from './uploads.ts'
+
+// Writing body chunks enables the function's streamed-response path. Data is
+// already materialized by the authorization/filtering layer before we get here.
+export function writeResponse(res: ServerResponse, body: string | Buffer): void {
+  const bytes = typeof body === 'string' ? Buffer.from(body) : body
+  if (bytes.length <= UPLOAD_CHUNK_BYTES) { res.end(body); return }
+  for (let offset = 0; offset < bytes.length; offset += 64 * 1024) res.write(bytes.subarray(offset, offset + 64 * 1024))
+  res.end()
+}
+
+export function sendJson(res: ServerResponse, status: number, body: unknown, headers: Record<string, string> = {}): void {
+  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers })
+  writeResponse(res, JSON.stringify(body))
+}
+