@preventive/triage 1.0.0-alpha.35 → 1.0.0-alpha.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.35",
+  "version": "1.0.0-alpha.37",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -211,6 +211,8 @@
     "common/scan-server.ts",
     "common/utf8.d.ts",
     "common/utf8.js",
+    "client/dependency-paths.d.ts",
+    "client/dependency-paths.js",
     "client/finding-link.js",
     "client/linked-findings.d.ts",
     "client/linked-findings.js",

package/server-managed/bundle-build-worker.js

@@ -32,6 +32,21 @@ async function packageName(input, github, project, bundle, client) {
   return typeof name === 'string' ? name : null
 }
 
+// Prisma Client is what `prisma generate` writes, not what the repo holds: for
+// a JS project whose package.json depends on a @prisma/ package, Stasis
+// generates it before the scan (generate: ['prisma']).
+async function prismaGenerate(input, github, project, client) {
+  if (input.entries[0].endsWith('.sol')) return []
+  const listing = await client.listRepoDir({ repo: github, sha: input.commit, directory: project || undefined })
+  if (!listing.some(entry => entry.path === 'package.json' && regularFile(entry))) return []
+  const text = await client.getRepoFile({ repo: github, path: posix.join(project, 'package.json'), ref: input.commit })
+  let manifest
+  try { manifest = JSON.parse(text) } catch { return [] }
+  const named = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+    .flatMap(field => manifest?.[field] !== null && typeof manifest?.[field] === 'object' ? Object.keys(manifest[field]) : [])
+  return named.some(name => name.startsWith('@prisma/')) ? ['prisma'] : []
+}
+
 export async function buildStasisBundle({ input, github, token, maxBytes, scopes, cacheDir = null }, client = createClient({ token }), progress = () => {}) {
   const allowed = path => scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))
   // Reuse these immutable listings when Stasis discovers the lockfile root.
@@ -43,15 +58,16 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
   } }
   // Upstream's disk cache keeps the npm tarballs and version documents, and
   // the repo's tree, in `cacheDir`; without one (Vercel), nothing is kept on
-  // disk. This fresh worker inherits no application credentials.
+  // disk. This fresh worker inherits no application credentials but NPM_TOKEN.
   setCacheDir(cacheDir ?? false)
   progress('build')
   const project = await projectDirectory(input, github, buildClient)
   if (!allowed(project)) throw new Error('build-scope')
+  const generate = await prismaGenerate(input, github, project, buildClient)
   const { bundle } = await buildGitHubBundle({
     github, sha: input.commit, directory: project || undefined,
     entries: input.entries.map(entry => posix.relative(project || '.', entry)),
-    ...input.options, client: buildClient, ...(cacheDir === null && { cache: false }),
+    ...input.options, client: buildClient, ...(cacheDir === null && { cache: false }), ...(generate.length > 0 && { generate }),
   })
   const directory = bundle.repo?.directory ?? ''
   progress('scope')
@@ -68,6 +84,15 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
   return { bytes, directory, filename: githubBundleFilename(github, project, input.commit, name) }
 }
 
+// The code a failed build answers with. Never upstream bodies or paths outside
+// the caller's grants: those stay in the diagnostic. A missing or ambiguous
+// lockfile, or the named one missing, is the lockfile's.
+export function buildErrorCode(error, message) {
+  if (['build-scope', 'too-large'].includes(message)) return message
+  if (error instanceof HttpError) return error.status === 429 ? 'github-rate-limited' : 'github-build-failed'
+  return /no packageManager given|lockfile installs|no (?:pnpm-lock\.yaml|yarn\.lock|package-lock\.json|soldeer\.lock) found in /u.test(message) ? 'build-lockfile' : 'build-failed'
+}
+
 if (parentPort && workerData?.type === 'managed-bundle-build') {
   // Send diagnostics to the request's parent thread, which writes them before
   // returning the HTTP response. Worker stdout can be lost on termination.
@@ -80,11 +105,7 @@ if (parentPort && workerData?.type === 'managed-bundle-build') {
     send(await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage })))
   } catch (error) {
     const diagnostic = bundleBuildDiagnostic(error, workerData.token)
-    // Do not return upstream bodies or paths outside the caller's grants.
-    const code = ['build-scope', 'too-large'].includes(diagnostic.message) ? diagnostic.message
-      : error instanceof HttpError ? (error.status === 429 ? 'github-rate-limited' : 'github-build-failed')
-        : /no packageManager given|lockfile installs/u.test(diagnostic.message) ? 'build-lockfile'
-          : 'build-failed'
+    const code = buildErrorCode(error, diagnostic.message)
     send({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : 422, diagnostic })
   }
 }

package/server-managed/bundle-build.ts

@@ -17,7 +17,7 @@ export interface BundleBuildInput {
   commit: string
   entries: string[]
   directory: string
-  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; jsx?: boolean }
+  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; jsx?: boolean; packageManager?: 'soldeer' }
   // What the stored bundle records; null for Solidity, which takes no conditions.
   conditions: BundleBuildConditions | null
 }
@@ -42,7 +42,9 @@ export function parseBundleBuild(value: unknown): BundleBuildInput {
     const parent = posix.dirname(entry).split('/')
     while (parts.some((part, i) => parent[i] !== part)) parts.pop()
   }
-  const options: BundleBuildInput['options'] = {}
+  // Stasis builds Solidity with Soldeer alone. Named, a JS lockfile beside or
+  // above the project no longer leaves it unable to tell which one installs it.
+  const options: BundleBuildInput['options'] = scripts ? {} : { packageManager: 'soldeer' }
   let recorded: BundleBuildConditions | null = null
   if (scripts) {
     if (conditions == null || typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
@@ -97,7 +99,7 @@ export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: s
 export interface BuildRequest {
   input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
   // Upstream's disk cache for what a build fetches (setCacheDir), or null for
-  // none, as on Vercel. Resolved here: the worker runs with an empty env.
+  // none, as on Vercel. Resolved here: the worker's env holds NPM_TOKEN alone.
   cacheDir: string | null
 }
 // An extra per-process ceiling; admission must also hold the shared DB lease.
@@ -150,8 +152,12 @@ export async function buildRepositoryBundle(userId: string, request: BuildReques
   try {
     workerUrl = new URL('./bundle-build-worker.js', import.meta.url)
     log('started')
+    // Upstream reads NPM_TOKEN from the env for scoped packages, which npm
+    // answers with 404 when private and asked without it. Nothing else passes.
+    const npmToken = process.env['NPM_TOKEN']
+    const env = npmToken ? { NPM_TOKEN: npmToken } : {}
     worker = new Worker(workerUrl, {
-      workerData: { ...request, type: 'managed-bundle-build' }, env: {}, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
+      workerData: { ...request, type: 'managed-bundle-build' }, env, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
     })
     const running = worker
     return await new Promise((resolve, reject) => {

package/server-managed/http.ts

@@ -30,6 +30,7 @@
 //   GET  /api/admin/reports/<id> → admin|manage downloads a stored report | 401/403/404
 //   DELETE /api/admin/reports/<id> → admin|manage deletes a report | 401/403/404
 //   POST /api/admin/reports/set-repo → admin|manage attaches/detaches a report's repo | 401/403/404
+//   GET  /api/admin/reports/<id>/location → admin|manage live location suggestion | 401/403/404/503
 //   GET  /api/bundles/<id>/{metadata,contents} → authorized encoded bytes | 401/404/422
 //   GET  /api/bundles/<id>/advisories → published dependency advisories (security access) | 401/403/404
 //   GET  /api/bundles/<id>/download → authorized original upload | 401/404
@@ -73,7 +74,7 @@ import { filterReportData } from '../common/managed/report-filter.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
 import { MAX_FINDING_ID, MAX_TRIAGE_BODY_BYTES, MAX_TRIAGE_ENTRIES, MAX_TRIAGE_HISTORY, parseTriageEntryPatch } from '../common/managed/triage.ts'
 import { reportRepoGithub } from '@preventive/report'
-import { loadManagedFindings, readManagedReport } from '../common/managed/report-content.ts'
+import { findingsRepository, loadManagedFindings, ownFileDirectory, readManagedReport } from '../common/managed/report-content.ts'
 import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
@@ -877,7 +878,8 @@ async function sendUploadedReport(req: IncomingMessage, res: ServerResponse, dep
 // markdown / CSV — archived as-is, like the e2e objstore; the server parses them
 // downstream). Display name rides X-Report-Filename; the repository and
 // directory come from the report header, or from optional repository/directory
-// headers when the report has no repository metadata. The bundle link is
+// headers when the report has no repository metadata, else from the repository
+// its findings name when that resolves within the uploader's access. The bundle link is
 // auto-resolved from the report's bundleHashes. New reports start hidden until
 // published. Identical content reuses its stored identity and metadata. Bytes
 // are written first (keyed by a fresh uuid) then the metadata row. A definite
@@ -944,6 +946,19 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
     const legacyRepo = await resolveUploadRepoId(req, res, deps)
     if (!legacyRepo.ok) return
     repoId = legacyRepo.repoId
+    // Otherwise the repository its findings name assigns a new report, like
+    // embedded metadata, when it resolves to a connected destination within
+    // the uploader's access. X-Repo-Directory still overrides the directory.
+    if (repoId == null && !existing) {
+      const suggestion = await suggestReportLocation(deps, s.user, parsed.data)
+      if (suggestion?.repoId != null) {
+        const inferred = req.headers['x-repo-directory'] == null ? suggestion.directory ?? '' : directory
+        if (s.user.role === 'admin' || await deps.db.userCanReadRepoPath(s.user.id, suggestion.repoId, inferred)) {
+          repoId = suggestion.repoId
+          directory = inferred
+        }
+      }
+    }
   }
   if (repoId != null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId, directory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
   if (existing) { await sendUploadedReport(req, res, deps, cookie, existing, true); return }
@@ -1604,6 +1619,44 @@ async function handleRepositorySuggestion(req: IncomingMessage, res: ServerRespo
     mapped: github.toLowerCase() !== repo.fullName.toLowerCase() || (directory.path ?? '') !== location.directory } : null })
 }
 
+// Where a report without an embedded repository suggests it belongs, resolved
+// through current connections and aliases like bundle metadata. `repoId` is
+// set only for an active destination within the user's grants; the named
+// repository itself is part of the report. `directory` is null when neither
+// the report nor an alias specifies one.
+async function suggestReportLocation(deps: ManagedHttpDeps, user: StoredUser, data: { repo?: { directory?: unknown } } | null | undefined) {
+  const github = findingsRepository(data)
+  if (github == null) return null
+  // An invalid optional directory is ignored, as for bundle metadata.
+  const declared = normalizeTeamPath(data?.repo?.directory)
+  const directory = declared.ok ? declared.path : null
+  const location = await deps.db.getRepositoryImportLocation(github, directory ?? '', ownFileDirectory(data))
+  const repo = location.repoId == null ? null : (await deps.db.listSelectedRepos()).find(row => row.repoId === location.repoId)
+  const allowed = repo && (user.role === 'admin' || await deps.db.userCanReadRepoPath(user.id, repo.repoId, location.directory))
+  if (!allowed) return { repoId: null, github, directory }
+  const mapped = github.toLowerCase() !== repo.fullName.toLowerCase() || (directory ?? '') !== location.directory
+  return { repoId: repo.repoId, github: repo.fullName, directory: mapped ? location.directory : directory }
+}
+
+// GET /api/admin/reports/<id>/location — the live suggestion for a report's
+// location editor. It never changes the stored assignment.
+async function handleReportLocationSuggestion(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
+  if (req.method !== 'GET') { send405(res, 'GET'); return }
+  const s = await readManageSession(res, deps, cookie)
+  if (!s) return
+  const report = await deps.db.getReport(id)
+  if (!report || !(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (report.repoEmbedded) { sendJson(res, 200, { location: null }); return }
+  const bytes = await deps.reportStore.get(id)
+  if (bytes == null) { sendJson(res, 503, { error: 'unavailable' }); return }
+  const { data } = readManagedReport(bytes.toString('utf8'), report.filename)
+  // Storage reads can outlast a session, role or grant change.
+  const current = await readManageSession(res, deps, cookie)
+  if (!current) return
+  if (!(await canViewReport(deps, current.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  sendJson(res, 200, { location: await suggestReportLocation(deps, current.user, data) })
+}
+
 // GET /api/reports/<id> — admin/manager preview, within management access.
 // Accept: application/json includes parsed, filtered data and the server's repo
 // assignment. Other callers retain the raw text/plain response. The
@@ -2365,6 +2418,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleImportTriage(req, res, deps, cookie, importTriage[1]!); return
     }
+    const reportLocation = /^\/api\/admin\/reports\/([a-f\d-]{36})\/location$/iu.exec(path)
+    if (reportLocation) { await handleReportLocationSuggestion(req, res, deps, cookie, reportLocation[1]!); return }
     if (path.startsWith(REPORT_PREFIX)) {
       const id = path.slice(REPORT_PREFIX.length)
       if (method === 'GET') { await handleGetReport(res, deps, cookie, id); return }