@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.34

package/server-managed/team-reports.ts

@@ -1,5 +1,6 @@
 // Team content is filtered as one workspace, with separate report envelopes.
 // Bounded snapshots retain filtered content and visibility for repeated reads.
+import { mergeLinkGroups } from './link-reports.ts'
 import { Buffer } from 'node:buffer'
 import { backfillFindingIds, reportEntries, stampSecurityGroups } from '@preventive/report'
 import { managedFindingSourcePaths, readManagedReport } from '../common/managed/report-content.ts'
@@ -7,6 +8,7 @@ import { filterReportData, projectFinding } from '../common/managed/report-filte
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
 import { triageWireEntry } from './triage-response.ts'
+import { visibleManagedIssues } from './managed-issues.ts'
 import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 
 type Finding = Record<string, unknown>
@@ -54,16 +56,17 @@ export class TeamReportsError extends Error {
   constructor(status: number, error: string) { super(error); this.status = status }
 }
 export function teamSnapshotKey(snapshot: TeamReportAccessSnapshot): string {
-  return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.reports, snapshot.repositories])
+  return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
 }
-export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string): Promise<TeamReportAccessSnapshot> {
-  const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string, reportId: string | null = null): Promise<TeamReportAccessSnapshot> {
+  const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, reportId)
   if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
   if (!snapshot.teamId) throw new TeamReportsError(404, 'no-team')
+  if (reportId !== null && !snapshot.reports.some(report => report.id === reportId)) throw new TeamReportsError(404, 'no-report')
   return snapshot
 }
 export async function recheckTeam(db: ManagedDb, sessionId: string, snapshot: TeamReportAccessSnapshot): Promise<void> {
-  if (teamSnapshotKey(await teamSnapshot(db, sessionId, snapshot.teamId!)) !== teamSnapshotKey(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
+  if (teamSnapshotKey(await teamSnapshot(db, sessionId, snapshot.teamId!, snapshot.reportId)) !== teamSnapshotKey(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
 }
 function groupsOf(data: unknown): Finding[][] {
   return (reportEntries(data) ?? []).map(entry => (Array.isArray(entry) ? entry : [entry]).filter(
@@ -100,6 +103,7 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
     }
   }))
   for (const result of results) if (result.status === 'rejected') throw result.reason
+  const globalLinks = snapshot.linkRevision ? await db.getEnabledLinkGroups(snapshot.linkRevision) : []
   const edges = new Map<string, Set<string>>()
   const connect = (a: string, b: string) => {
     if (!edges.has(a)) edges.set(a, new Set())
@@ -107,10 +111,8 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   // A star is enough for transitive security propagation, without a quadratic
   // expansion for large links. Unknown IDs can connect known findings.
-  for (const report of reports) {
-    for (const ids of linksOf(report.data) ?? []) {
-      for (const id of ids.slice(1)) { connect(ids[0]!, id); connect(id, ids[0]!) }
-    }
+  for (const ids of globalLinks.concat(reports.flatMap(report => linksOf(report.data) ?? []))) {
+    for (const id of ids.slice(1)) { connect(ids[0]!, id); connect(id, ids[0]!) }
   }
   const groups = reports.flatMap(report => groupsOf(report.data).map(group => group.map(f => projectFinding(f, report.data as Finding)!)))
   stampSecurityGroups(groups, { linkedIds: id => edges.get(id) ?? [] })
@@ -130,7 +132,9 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   for (const report of reports) {
     const links = linksOf(report.data)
-    if (links) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
+    // Hidden previews are independently authorized; preserve a hidden links
+    // document even though its referenced findings are outside this response.
+    if (links && !snapshot.hiddenReportId) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
   }
   let outputBytes = 14
   const parts = [Buffer.from('{"reports":[')]
@@ -141,7 +145,10 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
     if (index) parts.push(Buffer.from(','))
     parts.push(bytes)
   }
-  parts.push(Buffer.from(']}'))
+  const links = mergeLinkGroups(globalLinks, allIds)
+  const suffix = Buffer.from(links.length > 0 ? `],"links":${JSON.stringify(links)}}` : ']}')
+  if (outputBytes + suffix.length > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+  parts.push(suffix)
   const body = Buffer.concat(parts)
   retainVisibility(db, teamSnapshotKey(snapshot), visible)
   retainReports(db, teamSnapshotKey(snapshot), body)
@@ -190,13 +197,13 @@ export async function teamReportVisibility(db: ManagedDb, store: BlobStore, snap
   return visible.get(reportId)!
 }
 export async function teamFindingIds(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
-  const snapshot = await teamSnapshot(db, sessionId, teamId)
+  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
   const visible = await teamReportVisibility(db, store, snapshot, reportId)
   await recheckTeam(db, sessionId, snapshot)
   return visible.ids
 }
 export async function teamSourcePaths(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
-  const snapshot = await teamSnapshot(db, sessionId, teamId)
+  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
   const visible = await teamReportVisibility(db, store, snapshot, reportId)
   await recheckTeam(db, sessionId, snapshot)
   return visible.sourcePaths
@@ -211,9 +218,11 @@ export async function loadTeamAnnotations(db: ManagedDb, store: BlobStore, snaps
     : new Map([[reportId, await teamReportVisibility(db, store, snapshot, reportId)]])
   const ids = new Set<string>()
   for (const report of visible.values()) for (const id of report.ids) ids.add(id)
-  const { triage, comments } = await db.getAnnotations([...ids])
+  const { triage, comments, issues: savedIssues } = await db.getAnnotations([...ids])
+  const issues = Object.fromEntries(visibleManagedIssues(savedIssues, snapshot)
+    .map(issue => [issue.findingId, { url: issue.issueUrl!, autoFix: issue.autoFixUrl }]))
   const entries = Object.fromEntries(triage.map(row => [row.findingId, triageWireEntry(row)]))
-  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId)])
+  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId), ...Object.keys(issues)])
   const reports = Object.fromEntries([...visible].map(([id, report]) => [id, [...report.ids].filter(finding => annotated.has(finding))]))
-  return { reports, entries, comments }
+  return { reports, entries, comments, issues }
 }

package/server-managed/upstream-cache.ts

@@ -0,0 +1,73 @@
+import type { CacheStore } from '@preventive/upstream/advisories.js'
+import type { ManagedSql } from './sql.ts'
+
+// Records @preventive/upstream would otherwise keep in its disk cache, shared
+// by every instance: each repository's published advisory listing, written by
+// dependency audits that ask repositories, keyed `github/advisories/owner/name`.
+// Upstream stamps, validates and expires each value (90 minutes for a listing);
+// a refresh replaces the row, and there is one row per repository, so rows are
+// not evicted. Only public repositories publish advisories: rows are shared
+// across viewers.
+export const UPSTREAM_CACHE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_upstream_cache (
+  cache_key TEXT PRIMARY KEY,
+  value     TEXT NOT NULL,
+  cached_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface UpstreamCacheStore {
+  getUpstreamCacheEntry(key: string): Promise<string | null>
+  setUpstreamCacheEntry(key: string, value: string, cachedAt: number): Promise<void>
+}
+
+export function upstreamCacheMethods(db: ManagedSql): UpstreamCacheStore {
+  const get = db.prepare('SELECT value FROM managed_upstream_cache WHERE cache_key = ?')
+  // A slower concurrent audit cannot replace a newer listing with an older one.
+  const set = db.prepare(`INSERT INTO managed_upstream_cache (cache_key, value, cached_at) VALUES (?, ?, ?)
+    ON CONFLICT (cache_key) DO UPDATE SET value = excluded.value, cached_at = excluded.cached_at
+    WHERE managed_upstream_cache.cached_at <= excluded.cached_at`)
+  return {
+    async getUpstreamCacheEntry(key) {
+      const row = await get.get(key) as { value: string } | undefined
+      return row?.value ?? null
+    },
+    async setUpstreamCacheEntry(key, value, cachedAt) {
+      await set.run(key, value, cachedAt)
+    },
+  }
+}
+
+// An audit's `cache`: where the server has an upstream disk cache (off Vercel,
+// set at startup), that keeps everything; else this store keeps listings.
+export function auditCache(cacheDir: string | null | undefined, db: UpstreamCacheStore, signal: AbortSignal, debug = false): CacheStore | undefined {
+  return cacheDir ? undefined : upstreamCache(db, signal, debug)
+}
+
+// Only listings are kept: upstream's other records (npm version documents,
+// registries' repository lookups) read as misses and are not written.
+const CACHED_TYPE = 'github/advisories'
+
+// The cache is an optimization: a database failure is a miss, never a failed
+// audit. Upstream keeps listing after an abandoned audit; once `signal` aborts,
+// the request's database work is over and the store is left alone.
+export function upstreamCache(db: UpstreamCacheStore, signal: AbortSignal, debug = false): CacheStore {
+  return {
+    async read(type, key) {
+      if (type !== CACHED_TYPE || signal.aborted) return null
+      try {
+        const value = await db.getUpstreamCacheEntry(`${type}/${key}`)
+        return value === null ? null : JSON.parse(value) as unknown
+      } catch (error) {
+        if (debug) console.warn('managed: upstream cache read failed:', error)
+        return null
+      }
+    },
+    async write(type, key, value) {
+      if (type !== CACHED_TYPE || signal.aborted) return
+      try { await db.setUpstreamCacheEntry(`${type}/${key}`, JSON.stringify(value), Date.now()) } catch (error) {
+        if (debug) console.warn('managed: upstream cache write failed:', error)
+      }
+    },
+  }
+}

package/server-managed/workspace-shares.ts

@@ -1,5 +1,6 @@
+import { linkRevision } from './link-reports.ts'
 import type { ManagedSql } from './sql.ts'
-import type { ManagedBundle, TeamReportAccessSnapshot, UserTeam } from './db.ts'
+import type { BundleBuildConditions, ManagedBundle, TeamReportAccessSnapshot, UserTeam } from './db.ts'
 import { type TeamUserPermissions, parseTeamUserPermissions } from '../common/managed/permissions.ts'
 
 export const WORKSPACE_SHARE_SCHEMA = `
@@ -47,7 +48,7 @@ export interface WorkspaceShareStore {
 function shareQueries(db: ManagedSql) {
   const manager = db.prepare(`SELECT 1 FROM managed_session s
     JOIN managed_user u ON u.id = s.user_id
-    JOIN managed_team t ON t.id = ?
+    JOIN managed_team t ON t.id = ? AND t.hidden = 0
     WHERE s.id = ? AND s.expires_at > ? AND (u.role = 'admin' OR (u.role = 'manage'
       AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = t.id)))`)
   const insert = db.prepare(`INSERT INTO managed_workspace_share (token_hash, team_id, created_by, created_at, dependencies, security)
@@ -62,12 +63,12 @@ function shareQueries(db: ManagedSql) {
     WHERE s.id = ? AND s.expires_at > ? AND u.role IN ('manage', 'admin')`)
   const all = db.prepare(`SELECT s.token_hash AS id, s.created_at AS createdAt, u.login AS createdBy, s.dependencies, s.security,
     t.id AS teamId, t.slug AS teamSlug, t.name AS teamName FROM managed_workspace_share s
-    JOIN managed_user u ON u.id = s.created_by JOIN managed_team t ON t.id = s.team_id
+    JOIN managed_user u ON u.id = s.created_by JOIN managed_team t ON t.id = s.team_id AND t.hidden = 0
     WHERE ? = 'admin' OR EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = ? AND tu.team_id = s.team_id)
     ORDER BY t.name, t.id, s.created_at DESC, s.token_hash`)
   const shareGrant = `FROM managed_workspace_share s
     JOIN managed_user u ON u.id = s.created_by
-    JOIN managed_team t ON t.id = s.team_id
+    JOIN managed_team t ON t.id = s.team_id AND t.hidden = 0
     WHERE s.token_hash = ? AND (u.role = 'admin' OR (u.role = 'manage'
       AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = s.team_id)))`
   const share = db.prepare(`SELECT t.id, t.slug, t.name, s.dependencies, s.security ${shareGrant}`)
@@ -88,10 +89,10 @@ function shareQueries(db: ManagedSql) {
   // A raw bundle is visible only when its declared root is inside the team scope.
   // Root bundles remain hidden from directory-only grants.
   const bundles = db.prepare(`SELECT DISTINCT b.id, b.slug, b.integrity, b.filename, b.kind, b.byte_size AS byteSize,
-    b.uploaded_by AS uploadedBy, b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.uploaded_at AS uploadedAt, sr.full_name AS repoFullName
+    b.uploaded_by AS uploadedBy, b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.uploaded_at AS uploadedAt, b.provenance, b.build_conditions AS buildConditions, sr.full_name AS repoFullName
     FROM managed_team_repo tr JOIN managed_bundle b ON b.repo_id = tr.repo_id
     JOIN managed_selected_repo sr ON sr.repo_id = b.repo_id
-    WHERE tr.team_id = ? AND (tr.path = '' OR b.repo_directory = tr.path
+    WHERE tr.team_id = ? AND b.visible = 1 AND (tr.path = '' OR b.repo_directory = tr.path
       OR substr(b.repo_directory, 1, length(tr.path) + 1) = tr.path || '/') ORDER BY b.id`)
   return { manager, insert, remove, update, list, session, all, share, feed, repositories, reports, bundles }
 }
@@ -141,21 +142,24 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const { dependencies, security, ...team } = grant
       const permissions = { dependencies: dependencies === 1, security: security === 1 }
       const rows = await q.reports.all(team.id) as { id: string; slug: string; filename: string; analyzer: string | null; byteSize: number; sha256: string; directory: string; github: string }[]
-      const bundleRows = await q.bundles.all(team.id) as (ManagedBundle & { repoFullName: string })[]
+      const links = await linkRevision(db)
+      const bundleRows = (await q.bundles.all(team.id) as (Omit<ManagedBundle, 'buildConditions'> & { buildConditions: string | null; repoFullName: string })[])
+        .map(row => ({ ...row, buildConditions: row.buildConditions == null ? null : JSON.parse(row.buildConditions) as BundleBuildConditions }))
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
         teamId: team.id,
+        linkRevision: links,
         permissions,
         repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
-        team: { ...team, permissions,
-          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
-            cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
+        team: { ...team, permissions, cacheKey: links,
+          reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, visible: true, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
+            cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions, links]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,
-            filename: row.filename, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName })),
+            filename: row.filename, visible: true, kind: row.kind, byteSize: row.byteSize, repoId: row.repoId!, repoDirectory: row.repoDirectory, repoFullName: row.repoFullName, provenance: row.provenance })),
         },
-        bundles: bundleRows,
+        bundles: bundleRows.map(row => ({ ...row, visible: true })),
       }
     },
   }