@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.39

package/server-managed/bundle-commits.ts

@@ -0,0 +1,140 @@
+import { setImmediate } from 'node:timers/promises'
+import { bundleCommitHash } from '../common/bundle-commit.js'
+import type { BundleSummary } from './bundle-cache.ts'
+import type { ManagedDb } from './db.ts'
+import { type GithubCommit, githubCommitKey } from './github-metadata.ts'
+
+const MAX_MESSAGE_LENGTH = 65_536
+const MAX_NAME_LENGTH = 256
+// GitHub logins, and the `[bot]` accounts apps commit as.
+const GITHUB_LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+const BACKFILL_LIMIT = 4
+const RETRY_MS = 5 * 60_000
+
+export type CommitDetails = Omit<GithubCommit, 'key' | 'fetchedAt'>
+// What viewers see of a cached commit: its subject in place of the message.
+export type CatalogCommitDetails = Omit<CommitDetails, 'message'> & { subject: string }
+// What a catalog sends with a bundle whose summary records a commit, when
+// the cache holds its details, tags pointing to it, or both. `github` is the
+// repository they were cached for: the one the bundle is stored at.
+export interface BundleCommitInfo { sha: string; github: string; tags: string[]; details: CatalogCommitDetails | null }
+interface CatalogBundle { integrity: string; repoId: number | null; repoFullName: string | null }
+type Summaries = ReadonlyMap<string, { summary: BundleSummary | null }>
+export interface CatalogCommit { repoId: number; sha: string; key: string }
+export interface CommitReader { commitDetails(sha: string): Promise<CommitDetails | null> }
+
+function truncate(value: string, max: number): string {
+  if (value.length <= max) return value
+  // Never leave half of a surrogate pair at the end.
+  return value.slice(0, /[\uD800-\uDBFF]/u.test(value[max - 1]!) ? max - 1 : max)
+}
+
+function name(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? truncate(value.trim(), MAX_NAME_LENGTH) : null
+}
+
+function date(value: unknown): number | null {
+  const time = typeof value === 'string' ? Date.parse(value) : NaN
+  return Number.isSafeInteger(time) ? time : null
+}
+
+// `body` is a GitHub list-commits page that starts at `sha`, so its first
+// commit is that one, without the files GET /commits/:sha would add.
+export function parseGithubCommit(sha: string, body: unknown): CommitDetails | null {
+  const item = Array.isArray(body) ? body[0] as {
+    sha?: unknown; author?: { login?: unknown } | null
+    commit?: { message?: unknown; author?: { name?: unknown; date?: unknown } | null; committer?: { date?: unknown } | null }
+  } | null : null
+  if (item?.sha !== sha || typeof item.commit?.message !== 'string') return null
+  const login = item.author?.login
+  return {
+    message: truncate(item.commit.message, MAX_MESSAGE_LENGTH),
+    authorName: name(item.commit.author?.name),
+    authorLogin: typeof login === 'string' && GITHUB_LOGIN.test(login) ? login : null,
+    authoredAt: date(item.commit.author?.date),
+    committedAt: date(item.commit.committer?.date),
+  }
+}
+
+// A commit's subject, as `git log --format=%s` gives it: the message's first
+// paragraph on one line, here without the Claude-Session lines Claude Code
+// adds. Viewers see no more of the message, so catalogs send no more.
+export function commitSubject(message: string): string {
+  const paragraph = message.replaceAll('\r\n', '\n').trim().split(/\n[ \t]*\n/u, 1)[0] ?? ''
+  return paragraph.split('\n').map(line => line.trim()).filter(line => line && !/^Claude-Session:/iu.test(line)).join(' ')
+}
+
+// The commit a bundle's own summary records, in the repository it is stored at.
+function catalogCommit(bundle: CatalogBundle, summaries: Summaries): CatalogCommit | null {
+  const sha = bundleCommitHash(summaries.get(bundle.integrity)?.summary?.commit)
+  return sha && bundle.repoId != null ? { repoId: bundle.repoId, sha, key: githubCommitKey(bundle.repoId, sha) } : null
+}
+
+// Reads only the cache: viewing a bundle never requests its commit's tags,
+// and a commit missing from the cache is left for backfillBundleCommits.
+// Call it before the catalog's final access check: `commitInfo` answers for
+// the bundles of that last snapshot without another await, and has nothing
+// for a commit or repository this read did not cover.
+export async function bundleCommits(db: ManagedDb, bundles: readonly CatalogBundle[], summaries: Summaries) {
+  const wanted = new Map<string, CatalogCommit>()
+  for (const bundle of bundles) {
+    const commit = catalogCommit(bundle, summaries)
+    if (commit) wanted.set(commit.key, commit)
+  }
+  const keys = [...wanted.keys()]
+  const details = new Map<string, CatalogCommitDetails>()
+  const tags = new Map<string, string[]>()
+  if (keys.length > 0) {
+    for (const { key, fetchedAt: _fetchedAt, message, ...commit } of await db.listGithubCommits(keys)) {
+      details.set(key, { subject: commitSubject(message), ...commit })
+    }
+    for (const tag of await db.listGithubCommitTags(keys)) tags.set(tag.key, [...tags.get(tag.key) ?? [], tag.name])
+  }
+  return {
+    commitInfo(bundle: CatalogBundle): BundleCommitInfo | null {
+      const commit = catalogCommit(bundle, summaries)
+      if (!commit || !bundle.repoFullName || (!details.has(commit.key) && !tags.has(commit.key))) return null
+      return { sha: commit.sha, github: bundle.repoFullName, tags: tags.get(commit.key) ?? [], details: details.get(commit.key) ?? null }
+    },
+    missing: [...wanted.values()].filter(commit => !details.has(commit.key)),
+  }
+}
+
+// Store the details of a commit, read with the reader's verified repository
+// access, unless the cache already has them. Best effort: true once cached.
+export async function cacheCommitDetails(db: ManagedDb, reader: CommitReader, repoId: number, sha: string): Promise<boolean> {
+  const key = githubCommitKey(repoId, sha)
+  try {
+    if ((await db.listGithubCommits([key])).length > 0) return true
+    const details = await reader.commitDetails(sha)
+    if (details) await db.setGithubCommits([{ key, ...details, fetchedAt: Date.now() }])
+    return details !== null
+  } catch { return false }
+}
+
+const active = new Set<string>()
+const retries = new Map<string, number>()
+
+// Called after the catalog response is sent: the next one has the details.
+// Reads each commit with the viewer's own repository access, so a viewer who
+// cannot read it on GitHub leaves it for another (retried after a delay for
+// them). Commits never change, so each is stored once and kept.
+export async function backfillBundleCommits(db: ManagedDb, userId: string, missing: readonly CatalogCommit[],
+  readerFor: (repoId: number) => Promise<CommitReader | null>): Promise<void> {
+  if (missing.length === 0) return
+  await setImmediate()
+  const now = Date.now()
+  for (const [key, retryAt] of retries) if (retryAt <= now) retries.delete(key)
+  const batch = missing.filter(commit => !active.has(commit.key) && !retries.has(`${userId}\n${commit.key}`)).slice(0, BACKFILL_LIMIT)
+  for (const commit of batch) active.add(commit.key)
+  try {
+    for (const repoId of new Set(batch.map(commit => commit.repoId))) {
+      const reader = await readerFor(repoId).catch(() => null)
+      for (const commit of batch.filter(entry => entry.repoId === repoId)) {
+        if (!reader || !await cacheCommitDetails(db, reader, repoId, commit.sha)) retries.set(`${userId}\n${commit.key}`, Date.now() + RETRY_MS)
+      }
+    }
+  } finally {
+    for (const commit of batch) active.delete(commit.key)
+  }
+}

package/server-managed/bundle-summary-cache.ts

@@ -5,14 +5,27 @@ import { decodeUtf8 } from '../common/utf8.js'
 import { bundleCommitHash } from '../common/bundle-commit.js'
 import type { BundleCacheRecord, BundleCacheStorage, BundleSummary } from './bundle-cache.ts'
 
-// Version 3 adds the optional source commit; older bundles use bounded backfill.
-export const SUMMARY_FILENAME = 'v3-summary.json'
+// Version 3 adds the optional source commit; version 4 counts lines of code
+// without blank lines; version 5 adds a Stasis bundle's format version and
+// versioned package count. Older bundles use bounded backfill; until it
+// reaches one, catalogs serve its version 4 summary, which lacks only those.
+export const SUMMARY_FILENAME = 'v5-summary.json'
+const PREVIOUS_SUMMARY_FILENAME = 'v4-summary.json'
 const RETRY_MS = 5 * 60_000
 const BACKFILL_LIMIT = 4
-type CachedSummary = BundleSummary | { retryAt: number }
+type CachedSummary = BundleSummary | { retryAt: number } | { previous: BundleSummary }
 
-async function readSummary(storage: BundleCacheStorage, id: string): Promise<CachedSummary> {
-  const cached = await storage.open(id, SUMMARY_FILENAME)
+async function readCurrentSummary(storage: BundleCacheStorage, id: string): Promise<CachedSummary> {
+  try { return await readSummary(storage, id, SUMMARY_FILENAME) }
+  catch (error) {
+    if (!(error instanceof CacheMissError)) throw error
+    const previous = await readSummary(storage, id, PREVIOUS_SUMMARY_FILENAME)
+    return 'retryAt' in previous ? previous : { previous }
+  }
+}
+
+async function readSummary(storage: BundleCacheStorage, id: string, file: string): Promise<BundleSummary | { retryAt: number }> {
+  const cached = await storage.open(id, file)
   try {
     const chunks: Buffer[] = []
     let size = 0
@@ -21,11 +34,12 @@ async function readSummary(storage: BundleCacheStorage, id: string): Promise<Cac
       if (size > 1024) throw new Error('Invalid bundle summary')
       chunks.push(Buffer.from(chunk))
     }
-    const summary = JSON.parse(decodeUtf8(Buffer.concat(chunks))) as CachedSummary
+    const summary = JSON.parse(decodeUtf8(Buffer.concat(chunks))) as BundleSummary | { retryAt: number }
     if (summary && 'retryAt' in summary && Number.isSafeInteger(summary.retryAt) && summary.retryAt > 0) return summary
     const counts = summary as BundleSummary
     if (!counts || ![counts.files, counts.codeFiles, counts.lines].every(value => Number.isSafeInteger(value) && value >= 0)
-        || counts.codeFiles > counts.files || (counts.commit !== undefined && !bundleCommitHash(counts.commit))) throw new Error('Invalid bundle summary')
+        || counts.codeFiles > counts.files || (counts.commit !== undefined && !bundleCommitHash(counts.commit))
+        || [counts.stasisVersion, counts.versionedPackages].some(value => value !== undefined && !(Number.isSafeInteger(value) && value >= 0))) throw new Error('Invalid bundle summary')
     return counts
   } finally { cached.stream.destroy() }
 }
@@ -50,7 +64,7 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
     if (existing) return existing.job
     // Concurrent catalogs share the decoded summary, never the response stream.
     // Only in-flight work is shared: misses and failures remain retryable.
-    const job: Promise<CachedSummary | null> = readSummary(storage, record.id).then(value => {
+    const job: Promise<CachedSummary | null> = readCurrentSummary(storage, record.id).then(value => {
       if (reads.get(record.integrity)?.job === job) remember(record, value)
       return entries.get(record.integrity)?.value ?? value
     }).catch(error => {
@@ -72,7 +86,7 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
   }
   async function summaryStatus(record: BundleCacheRecord) {
     const value = ['stasis', 'sourcemap'].includes(record.kind ?? '') ? await read(record) : null
-    return { summary: value && !('retryAt' in value) ? value : null,
+    return { summary: !value || 'retryAt' in value ? null : 'previous' in value ? value.previous : value,
       summaryRetryAt: value && 'retryAt' in value ? value.retryAt : null }
   }
   async function backfill(records: readonly BundleCacheRecord[]) {
@@ -83,7 +97,7 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
     for (const record of records) {
       if (!['stasis', 'sourcemap'].includes(record.kind ?? '')) continue
       const cached = await read(record).catch(() => null)
-      if (cached && (!('retryAt' in cached) || cached.retryAt > Date.now())) continue
+      if (cached && !('previous' in cached) && (!('retryAt' in cached) || cached.retryAt > Date.now())) continue
       if (!await exists(record.id)) continue
       if (attempts++ >= BACKFILL_LIMIT) break
       const job = buildOne(record)

package/server-managed/config.ts

@@ -6,6 +6,7 @@ import { databaseUrls } from '../server-common/database-config.ts'
 import { MAX_UPLOAD_BYTES } from './uploads.ts'
 import { parseStorageKey } from '../server-common/storage-crypto.ts'
 import { defaultCacheDir } from '@preventive/upstream/npm.js'
+import { RESERVED_COOKIES } from './session.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
 
@@ -117,6 +118,9 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
   if (sessionCookieName.startsWith('__Host-') && !cookieSecure) {
     fail(`SESSION_COOKIE_NAME=${sessionCookieName} uses the __Host- prefix but the callback is not https. Use a non-prefixed name for loopback http dev.`)
   }
+  if (RESERVED_COOKIES.includes(sessionCookieName.replace(/^__Host-/u, ''))) {
+    fail(`SESSION_COOKIE_NAME=${sessionCookieName} is reserved for another managed cookie. Choose a different name.`)
+  }
   return {
     neonUrl, blobToken, serverless, storageEncryptionKey, storageEncryptionMigrate,
     storageEncryptionMigrateMaxMs: intEnv('MANAGED_STORAGE_ENCRYPTION_MIGRATE_MAX_MS', 150_000, 1, serverless ? 240_000 : 3_600_000),

package/server-managed/db-methods.ts

@@ -1,5 +1,7 @@
 import { type LinkReportStore, linkReportMethods, linkRevision } from './link-reports.ts'
 import { type RepositoryAliasStore, repositoryAliasMethods } from './repository-aliases.ts'
+import { type DependencyReviewStore, dependencyReviewMethods } from './dependency-reviews.ts'
+import { type TeamNpmScopeStore, teamNpmScopeMethods } from './team-npm-scopes.ts'
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
 import { type Role, roleAtLeast } from '../common/managed/roles.ts'
@@ -8,7 +10,7 @@ import type { TriageEntryPatch } from '../common/managed/triage.ts'
 import { preferredSlug } from './slugs.ts'
 import { type CommentStore, commentMethods } from './comments.ts'
 import { type ActivityStore, activityMethods } from './activity.ts'
-import { type GithubMetadataStore, githubMetadataMethods } from './github-metadata.ts'
+import { type GithubCommitStore, type GithubMetadataStore, githubCommitMethods, githubMetadataMethods } from './github-metadata.ts'
 import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts'
 import type { IssueFixUpdate } from './github-issue-links.ts'
 import { type BundleBuildLeaseStore, bundleBuildLeaseMethods } from './bundle-build-leases.ts'
@@ -65,6 +67,16 @@ export interface ManagedSession {
   userId: string
   csrfToken: string
   expiresAt: number
+  // Private JWK for sealed uploads; null until the session first asks for it.
+  uploadKey?: string | null
+  // Set on an administrator's read-only view as `userId` (see view-as.ts).
+  viewer?: ManagedViewer
+}
+
+export interface ManagedViewer {
+  id: string
+  login: string
+  name: string | null
 }
 
 // A repository selected for the workspace to operate on, with the context to
@@ -343,6 +355,7 @@ export interface UserTeam {
   id: string
   slug: string
   name: string
+  dependencyReview?: boolean
   permissions: TeamUserPermissions
   cacheKey?: string
   reports: UserTeamReport[]
@@ -350,7 +363,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore {
+export interface ManagedDb extends DependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore {
   claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
   finishMaintenanceLease(owner: string, until: number): Promise<void>
   getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
@@ -361,7 +374,20 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // promotes a matching No access identity only while it is the sole user.
   upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string>
   createSession(session: ManagedSession, now: number): Promise<void>
+  // A sign-in session; never a view session, so a view token in the session
+  // cookie authenticates nothing.
   sessionWithUser(id: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  // Replace the view opened by an admin's session with a view as `userId`.
+  // False, keeping any earlier view, unless that session is current, its user
+  // is still an admin, and `userId` is another existing account. The view
+  // expires with that session.
+  createViewSession(view: { id: string; viewerSessionId: string; userId: string; csrfToken: string }, now: number): Promise<boolean>
+  // A view session opened by `viewerSessionId`, while that session is current
+  // and its user is still an admin. Presence is the admin's, not the viewed user's.
+  viewSessionWithUser(id: string, viewerSessionId: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  // Store `candidate` unless the session already has an upload key; returns
+  // the stored key, or null when the session no longer exists.
+  ensureSessionUploadKey(id: string, candidate: string): Promise<string | null>
   deleteSession(id: string): Promise<void>
   deleteExpiredSessions(now: number): Promise<number>
   listUsers(): Promise<AdminUser[]>
@@ -506,9 +532,10 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
 }
 
 type SessionRow = {
-  id: string; csrf: string; exp: number
+  id: string; csrf: string; exp: number; uploadKey: string | null
   uid: string; login: string; name: string | null; avatar: string | null; role: Role
 }
+type ViewSessionRow = SessionRow & { viewerId: string; viewerLogin: string; viewerName: string | null }
 
 type UserRow = { id: string; login: string; name: string | null; role: Role; created: number; lastSeen: number | null; lastActivity: number | null }
 
@@ -552,12 +579,43 @@ function prepareStatements(db: ManagedSql) {
       `INSERT INTO managed_session (id, user_id, csrf_token, created_at, expires_at) VALUES (?, ?, ?, ?, ?)`,
     ),
     selectSessionStmt: db.prepare(
-      `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp,
+      `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp, s.upload_key AS uploadKey,
               u.id AS uid, u.login AS login, u.name AS name, u.avatar_url AS avatar, u.role AS role
          FROM managed_session s
          JOIN managed_user u ON u.id = s.user_id
         WHERE s.id = ? AND s.expires_at > ?`,
     ),
+    selectOwnSessionStmt: db.prepare(
+      `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp, s.upload_key AS uploadKey,
+              u.id AS uid, u.login AS login, u.name AS name, u.avatar_url AS avatar, u.role AS role
+         FROM managed_session s
+         JOIN managed_user u ON u.id = s.user_id
+        WHERE s.id = ? AND s.expires_at > ? AND s.viewer_session IS NULL`,
+    ),
+    selectViewSessionStmt: db.prepare(
+      `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp, s.upload_key AS uploadKey,
+              u.id AS uid, u.login AS login, u.name AS name, u.avatar_url AS avatar, u.role AS role,
+              a.id AS viewerId, a.login AS viewerLogin, a.name AS viewerName
+         FROM managed_session s
+         JOIN managed_user u ON u.id = s.user_id
+         JOIN managed_session p ON p.id = s.viewer_session
+         JOIN managed_user a ON a.id = p.user_id
+        WHERE s.id = ? AND s.viewer_session = ? AND s.expires_at > ?
+          AND p.expires_at > ? AND p.viewer_session IS NULL AND a.role = 'admin'`,
+    ),
+    deleteOtherViewsStmt: db.prepare(`DELETE FROM managed_session WHERE viewer_session = ? AND id <> ?`),
+    insertViewSessionStmt: db.prepare(
+      `INSERT INTO managed_session (id, user_id, csrf_token, created_at, expires_at, viewer_session)
+       SELECT ?, u.id, ?, ?, p.expires_at, p.id
+         FROM managed_session p
+         JOIN managed_user a ON a.id = p.user_id
+         JOIN managed_user u ON u.id = ?
+        WHERE p.id = ? AND p.expires_at > ? AND p.viewer_session IS NULL AND a.role = 'admin' AND u.id <> a.id`,
+    ),
+    // A former admin's views end with the role, even if it is granted again.
+    deleteDemotedViewsStmt: db.prepare(
+      `DELETE FROM managed_session WHERE viewer_session IN (SELECT id FROM managed_session WHERE user_id = ?)`,
+    ),
     selectUsersStmt: db.prepare(
       `SELECT u.id, u.login, u.name, u.role, u.created_at AS created, u.last_seen_at AS lastSeen,
               (SELECT MAX(at) FROM (
@@ -580,6 +638,10 @@ function prepareStatements(db: ManagedSql) {
       `SELECT gh_access_token AS access, gh_refresh_token AS refresh, gh_token_expires_at AS exp, gh_tokens_encrypted AS encrypted
          FROM managed_user WHERE id = ?`,
     ),
+    // Concurrent first requests keep whichever key was stored first.
+    ensureUploadKeyStmt: db.prepare(
+      `UPDATE managed_session SET upload_key = COALESCE(upload_key, ?) WHERE id = ? RETURNING upload_key AS uploadKey`,
+    ),
     deleteSessionStmt: db.prepare(`DELETE FROM managed_session WHERE id = ?`),
     deleteExpiredStmt: db.prepare(`DELETE FROM managed_session WHERE expires_at <= ?`),
     upsertRepoStmt: db.prepare(
@@ -849,7 +911,7 @@ function prepareStatements(db: ManagedSql) {
     setTeamHiddenStmt: db.prepare(`UPDATE managed_team SET hidden = ?, updated_at = ? WHERE id = ?`),
     selectTeamsStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team ORDER BY name ASC`),
     selectTeamsForUserStmt: db.prepare(
-      `SELECT t.id AS id, t.slug AS slug, t.name AS name,
+      `SELECT t.id AS id, t.slug AS slug, t.name AS name, t.dependency_review AS dependencyReview,
               tu.view_dependencies AS dependencies, tu.view_security AS security
          FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
         WHERE tu.user_id = ? AND t.hidden = 0 ORDER BY t.name ASC, t.id ASC`,
@@ -1033,7 +1095,7 @@ type ReportRow = {
 async function authorizeUpload(stmts: ReturnType<typeof prepareStatements>, sessionId: string | undefined,
   item: { uploadedBy: string | null; repoId: number | null; repoDirectory?: string }) {
   if (sessionId === undefined) return // Trusted imports and fixtures use the raw store API.
-  const user = await stmts.selectSessionStmt.get(sessionId, Date.now()) as SessionRow | undefined
+  const user = await stmts.selectOwnSessionStmt.get(sessionId, Date.now()) as SessionRow | undefined
   if (!user) throw new ManagedMutationError(401, 'unauthenticated')
   if (user.uid !== item.uploadedBy || !roleAtLeast(user.role, 'manage')) throw new ManagedMutationError(403, 'forbidden')
   if (item.repoId === null) return
@@ -1422,7 +1484,7 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
       return (await selectUserRepoScopesStmt.all(userId)) as { repoId: number; path: string | null }[]
     },
     async listTeamsForUser(userId: string): Promise<UserTeam[]> {
-      const teams = (await selectTeamsForUserStmt.all(userId)) as { id: string; slug: string; name: string; dependencies: number; security: number }[]
+      const teams = (await selectTeamsForUserStmt.all(userId)) as { id: string; slug: string; name: string; dependencyReview: number; dependencies: number; security: number }[]
       const scopes = await stmts.selectUserTeamScopesStmt.all(userId) as { teamId: string; repoId: number; path: string; fullName: string }[]
       const links = await linkRevision(db)
       const reportsByTeam = new Map<string, UserTeamReport[]>()
@@ -1446,6 +1508,7 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
       }
       return teams.map((t) => ({
         id: t.id, slug: t.slug, name: t.name,
+        ...(t.dependencyReview === 1 ? { dependencyReview: true } : {}),
         permissions: { dependencies: t.dependencies === 1, security: t.security === 1 },
         cacheKey: createHash('sha256').update(JSON.stringify([
           t.dependencies, t.security, links, scopes.filter(scope => scope.teamId === t.id),
@@ -1534,14 +1597,17 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
-    upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
-    touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, deleteSessionStmt, deleteExpiredStmt,
+    upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
+    touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, ensureUploadKeyStmt, deleteSessionStmt, deleteExpiredStmt,
+    selectViewSessionStmt, deleteOtherViewsStmt, insertViewSessionStmt, deleteDemotedViewsStmt,
   } = stmts
 
   const methods: Omit<ManagedDb, keyof ManagementStore | keyof ManagementCatalogStore> = {
     ...storageMethods(db, key),
     ...linkReportMethods(db, key),
     ...repositoryAliasMethods(db),
+    ...teamNpmScopeMethods(db),
+    ...dependencyReviewMethods(db),
     ...bundleBuildLeaseMethods(db),
     ...upstreamCacheMethods(db),
     async claimMaintenanceLease(owner, now, until, migration = false) {
@@ -1570,14 +1636,33 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       await touchUserSeenStmt.run(now, session.userId, now)
     },
     async sessionWithUser(id, now) {
-      const row = (await selectSessionStmt.get(id, now)) as SessionRow | undefined
+      const row = (await selectOwnSessionStmt.get(id, now)) as SessionRow | undefined
       if (row == null) return null
       await touchUserSeenStmt.run(now, row.uid, now)
       return {
-        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp },
+        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey },
         user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
       }
     },
+    async createViewSession(view, now) {
+      if (Number((await insertViewSessionStmt.run(view.id, view.csrfToken, now, view.userId, view.viewerSessionId, now)).changes) === 0) return false
+      await deleteOtherViewsStmt.run(view.viewerSessionId, view.id)
+      return true
+    },
+    async viewSessionWithUser(id, viewerSessionId, now) {
+      const row = (await selectViewSessionStmt.get(id, viewerSessionId, now, now)) as ViewSessionRow | undefined
+      if (row == null) return null
+      await touchUserSeenStmt.run(now, row.viewerId, now)
+      return {
+        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey,
+          viewer: { id: row.viewerId, login: row.viewerLogin, name: row.viewerName } },
+        user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
+      }
+    },
+    async ensureSessionUploadKey(id, candidate) {
+      const row = (await ensureUploadKeyStmt.get(candidate, id)) as { uploadKey: string } | undefined
+      return row?.uploadKey ?? null
+    },
     async deleteSession(id) {
       await deleteSessionStmt.run(id)
     },
@@ -1589,6 +1674,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       return rows.map((r) => ({ id: r.id, login: r.login, name: r.name, role: r.role, createdAt: r.created, lastSeenAt: r.lastSeen, lastActivityAt: r.lastActivity }))
     },
     async setUserRole(id, role) {
+      if (role !== 'admin') await deleteDemotedViewsStmt.run(id)
       return Number((await updateRoleStmt.run(role, Date.now(), id)).changes) > 0
     },
     async setUserTokens(id, tokens) {
@@ -1610,6 +1696,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       return row?.githubId ?? null
     },
     ...githubMetadataMethods(db),
+    ...githubCommitMethods(db),
     ...managedIssueMethods(db),
     ...selectedRepoMethods(stmts),
     ...activity,

package/server-managed/db-neon.ts

@@ -1,12 +1,14 @@
+import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA } from './db-schema.ts'
+import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
-import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
+import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
@@ -34,7 +36,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 22 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 27 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -107,6 +109,39 @@ async function migrateBundleBuildConditions(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (22)')
 }
 
+// Existing sessions create their upload key on first use.
+async function migrateSessionUploadKeys(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 23')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS upload_key TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (23)')
+}
+
+async function migrateViewSessions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 24')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE')
+  await db.query(VIEW_SESSION_INDEX)
+  await db.query('INSERT INTO managed_schema_version VALUES (24)')
+}
+
+async function migrateGithubCommits(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 25')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_COMMIT_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (25)')
+}
+
+async function migrateTeamNpmScopes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 26')).rows.length > 0) return
+  await db.query(postgresSchema(TEAM_NPM_SCOPE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (26)')
+}
+
+async function migrateDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 27')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS dependency_review INTEGER NOT NULL DEFAULT 0')
+  await db.query(postgresSchema(DEPENDENCY_REVIEW_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (27)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -180,7 +215,7 @@ async function initialize(db: PgConnection): Promise<void> {
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions]) await migrate(db)
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')

package/server-managed/db-schema.ts

@@ -1,6 +1,11 @@
+import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+
+// Created after the column migration, which predates it on older databases.
+export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
 
 export const MANAGED_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_user (
@@ -28,7 +33,13 @@ CREATE TABLE IF NOT EXISTS managed_session (
   user_id    TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
   csrf_token TEXT NOT NULL,
   created_at INTEGER NOT NULL,
-  expires_at INTEGER NOT NULL
+  expires_at INTEGER NOT NULL,
+  -- Private X25519 JWK that this session's uploads are sealed to (see
+  -- common/managed/upload-seal.ts). Created on first use.
+  upload_key TEXT,
+  -- An administrator's read-only view as user_id: the admin's own session,
+  -- which must stay valid. Ending that session ends the view.
+  viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS managed_session_user_idx ON managed_session(user_id);
@@ -183,6 +194,7 @@ CREATE TABLE IF NOT EXISTS managed_team (
   slug        TEXT NOT NULL,
   name        TEXT NOT NULL UNIQUE,
   hidden      INTEGER NOT NULL DEFAULT 0,
+  dependency_review INTEGER NOT NULL DEFAULT 0,
   created_at  INTEGER NOT NULL,
   updated_at  INTEGER NOT NULL
 ) STRICT;
@@ -212,4 +224,4 @@ CREATE TABLE IF NOT EXISTS managed_team_user (
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
-` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA

package/server-managed/db-table-names.ts

@@ -1,6 +1,6 @@
 // Table identifiers are code constants. Renames retain rows and foreign keys;
 // an ambiguous old/new pair must be resolved before the server can start.
-export const MANAGED_TABLE_RENAMES = [
+const MANAGED_TABLE_RENAMES = [
   ['selected_repo', 'managed_selected_repo'],
   ['team_repo', 'managed_team_repo'],
   ['team_user', 'managed_team_user'],

package/server-managed/db.ts

@@ -7,9 +7,9 @@ import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA } from './db-schema.ts'
+import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
-import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
+import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
@@ -69,8 +69,11 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA + UPSTREAM_CACHE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + GITHUB_COMMIT_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA + UPSTREAM_CACHE_SCHEMA)
     ensureColumn(db, 'managed_selected_repo', 'cached_default_branch', 'TEXT')
+    ensureColumn(db, 'managed_session', 'upload_key', 'TEXT')
+    ensureColumn(db, 'managed_session', 'viewer_session', 'TEXT REFERENCES managed_session(id) ON DELETE CASCADE')
+    db.exec(VIEW_SESSION_INDEX)
     for (const table of ['managed_report', 'managed_bundle']) {
       ensureColumn(db, table, 'data_key', 'TEXT')
       ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
@@ -109,6 +112,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_bundle', 'provenance', 'TEXT')
     ensureColumn(db, 'managed_bundle', 'build_conditions', 'TEXT')
     ensureColumn(db, 'managed_team', 'hidden', 'INTEGER NOT NULL DEFAULT 0')
+    ensureColumn(db, 'managed_team', 'dependency_review', 'INTEGER NOT NULL DEFAULT 0')
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')