@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.39

package/server-managed/dependency-reviews.ts

@@ -0,0 +1,248 @@
+import { randomUUID } from 'node:crypto'
+import { ManagedMutationError } from './management.ts'
+import type { ManagedSql } from './sql.ts'
+import { REVIEW_VERDICTS, type ReviewSummary, type ReviewVerdict, allowedReviewVerdicts, needsPackageJsonReview, summarizeReview } from '../common/dependency-reviews.js'
+
+export interface ReviewContext {
+  ecosystem: 'npm'; package: string; version: string; integrity: string
+  basePackage: string | null; baseVersion: string | null; baseIntegrity: string | null
+}
+export interface ReviewInput { file: string; comment: string; status: ReviewVerdict | null }
+export interface ReviewEntry extends ReviewInput { id: string; time: number }
+export interface ReviewTeam { id: string; name: string }
+export interface DependencyReview extends ReviewContext, ReviewSummary {
+  id: string; user: string | null; userLogin: string; time: number; revision: number
+  publishedAt: number | null; revokedAt: number | null; entries: ReviewEntry[]; teams: ReviewTeam[]; files: string[] | null
+  nonTextFiles: string[] | null
+  status: ReviewVerdict | null; comment: string
+}
+export type ReviewChange = { action: 'save'; reviewId: string | null; revision: number | null; entryId: string | null; entry: ReviewInput }
+  | { action: 'start'; reviewId: null; revision: null }
+  | { action: 'publish'; reviewId: string; revision: number; teamIds: string[]; files: string[]; nonTextFiles: string[]; final: { status: ReviewVerdict; comment: string } | null }
+  | { action: 'continue'; reviewId: string; revision: number }
+  | { action: 'revoke'; reviewId: string; revision: number }
+export interface DependencyReviewStore {
+  listDependencyReviews(context: ReviewContext, user: string, allBases?: boolean): Promise<DependencyReview[]>
+  getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity'>): Promise<DependencyReview | null>
+  listOwnDependencyReviews(user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null }>
+  listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
+  listDependencyReviewEnabledTeams(): Promise<string[]>
+  setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
+  discardDependencyReview(sessionId: string, reviewId: string, revision: number): Promise<void>
+  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number): Promise<DependencyReview>
+}
+
+// An unpublished review belongs only to its author. Publication freezes all
+// entries together and attaches that snapshot to its selected teams. Continuing
+// makes a new review; published entries and their timestamps never change.
+export const DEPENDENCY_REVIEW_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_dependency_review (
+  id TEXT PRIMARY KEY,
+  user_id TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  user_login TEXT NOT NULL, ecosystem TEXT NOT NULL,
+  package TEXT NOT NULL, version TEXT NOT NULL, integrity TEXT NOT NULL,
+  base_package TEXT NOT NULL, base_version TEXT NOT NULL, base_integrity TEXT NOT NULL,
+  time INTEGER NOT NULL, revision INTEGER NOT NULL, published_at INTEGER, revoked_at INTEGER, files TEXT,
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT ''
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_context_idx
+  ON managed_dependency_review(ecosystem, package, version, integrity, base_package, base_version, base_integrity, time);
+CREATE UNIQUE INDEX IF NOT EXISTS managed_dependency_review_unpublished_idx
+  ON managed_dependency_review(user_id, ecosystem, package, version, integrity, base_package, base_version, base_integrity)
+  WHERE published_at IS NULL;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_author_idx ON managed_dependency_review(user_id, time, id);
+CREATE TABLE IF NOT EXISTS managed_dependency_file_review (
+  id TEXT PRIMARY KEY, review_id TEXT NOT NULL REFERENCES managed_dependency_review(id) ON DELETE CASCADE,
+  file TEXT NOT NULL, comment TEXT NOT NULL,
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), time INTEGER NOT NULL
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_file_review_idx ON managed_dependency_file_review(review_id);
+CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
+  review_id TEXT NOT NULL REFERENCES managed_dependency_review(id) ON DELETE CASCADE,
+  team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  PRIMARY KEY (review_id, team_id)
+) STRICT;
+`
+const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
+const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
+const contextWhere = `${targetWhere} AND base_package = ? AND base_version = ? AND base_integrity = ?`
+const columns = `id, user_id AS user, user_login AS userLogin, ecosystem, package, version, integrity,
+  NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
+  time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
+const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
+
+// Fold legacy multi-note files into one text field without changing a frozen
+// snapshot's stored rows. Continuing or saving uses one row per file.
+function fileEntries(entries: ReviewEntry[]): ReviewEntry[] {
+  const files = new Map<string, ReviewEntry>(), verdicts = Object.keys(REVIEW_VERDICTS)
+  for (const entry of entries) {
+    if (entry.status === null) continue
+    const current = files.get(entry.file)
+    if (!current) { files.set(entry.file, { ...entry }); continue }
+    current.comment = [current.comment, entry.comment].filter(Boolean).join('\n\n')
+    if (verdicts.indexOf(entry.status ?? '') > verdicts.indexOf(current.status ?? '')) current.status = entry.status
+    current.time = Math.max(current.time, entry.time)
+  }
+  return [...files.values()]
+}
+
+async function actor(db: ManagedSql, sessionId: string, admin = false) {
+  const user = await db.prepare(`SELECT u.id, u.login, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+    WHERE s.id = ? AND s.expires_at > ? AND s.viewer_session IS NULL`).get(sessionId, Date.now()) as { id: string; login: string; role: string } | undefined
+  if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+  if (!(admin ? ['admin'] : ['triage', 'manage', 'admin']).includes(user.role)) throw new ManagedMutationError(403, 'forbidden')
+  return user
+}
+async function teams(db: ManagedSql, user: string): Promise<ReviewTeam[]> {
+  return await db.prepare(`SELECT t.id, t.name FROM managed_team t
+    JOIN managed_team_user m ON m.team_id = t.id AND m.user_id = ?
+    WHERE t.hidden = 0 AND t.dependency_review = 1 ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+}
+async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
+  const reviews = rows as (Omit<DependencyReview, 'files'> & { files: string | null })[]
+  if (reviews.length === 0) return []
+  const ids = reviews.map(review => review.id), placeholders = ids.map(() => '?').join(',')
+  const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
+    FROM managed_dependency_file_review WHERE review_id IN (${placeholders}) ORDER BY time, id`).all(...ids) as (ReviewEntry & { reviewId: string })[]
+  const linked = await db.prepare(`SELECT rt.review_id AS reviewId, t.id, t.name FROM managed_dependency_review_team rt
+    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id
+    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = ? OR (t.hidden = 0 AND EXISTS (
+      SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = ?)))
+    ORDER BY t.name, t.id`).all(...ids, user, user) as (ReviewTeam & { reviewId: string })[]
+  return reviews.map(review => {
+    const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+    const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+    const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+    const ownEntries = fileEntries(entries.filter(entry => entry.reviewId === review.id).map(({ reviewId: _reviewId, ...entry }) => entry))
+    return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles),
+      teams: linked.filter(team => team.reviewId === review.id).map(({ reviewId: _reviewId, ...team }) => team) }
+  })
+}
+
+async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number) {
+  if (!current || current.revokedAt !== null) return conflict()
+  const allowed = new Set((await teams(db, user)).map(team => team.id))
+  const selected = [...new Set(change.teamIds)]
+  if (selected.length === 0 || selected.some(team => !allowed.has(team))) throw new ManagedMutationError(400, 'bad-review-teams')
+  const entries = await db.prepare('SELECT file, status FROM managed_dependency_file_review WHERE review_id = ?').all(current.id) as ReviewInput[]
+  if (current.publishedAt === null) {
+    if (!summarizeReview(entries, change.files, change.nonTextFiles).checkedFiles) throw new ManagedMutationError(400, 'no-reviewed-files')
+    if (!change.final || !allowedReviewVerdicts(entries.filter(entry => !change.nonTextFiles.includes(entry.file))).includes(change.final.status)) throw new ManagedMutationError(400, 'bad-final-verdict')
+    if (needsPackageJsonReview(entries, change.files, change.nonTextFiles)) throw new ManagedMutationError(400, 'package-json-not-reviewed')
+    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, revision = revision + 1 WHERE id = ?`)
+      .run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }), change.final.status, change.final.comment, current.id)
+  } else {
+    if (change.final) return conflict()
+    await db.prepare('UPDATE managed_dependency_review SET revision = revision + 1 WHERE id = ?').run(current.id)
+  }
+  for (const team of selected) await db.prepare('INSERT INTO managed_dependency_review_team (review_id, team_id) VALUES (?, ?) ON CONFLICT DO NOTHING').run(current.id, team)
+}
+
+async function listOwn(db: ManagedSql, user: string, before: { time: number; id: string } | null) {
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE user_id = ?
+    ${before ? 'AND (time < ? OR (time = ? AND id < ?))' : ''} ORDER BY time DESC, id DESC LIMIT 51`)
+    .all(user, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
+  const page = rows.slice(0, 50)
+  const last = page.at(-1)
+  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: last.time, id: last.id } : null }
+}
+
+async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
+  const existing = await db.prepare(`SELECT id FROM managed_dependency_file_review
+    WHERE review_id = ? AND file = ? ORDER BY time, id`).all(reviewId, entry.file) as { id: string }[]
+  if (requestedId && !existing.some(row => row.id === requestedId)) return conflict()
+  if (entry.status === null) {
+    await db.prepare('DELETE FROM managed_dependency_file_review WHERE review_id = ? AND file = ?').run(reviewId, entry.file)
+  } else if (existing.length > 0) {
+    const entryId = existing[0]!.id
+    await db.prepare('UPDATE managed_dependency_file_review SET comment = ?, status = ?, time = ? WHERE id = ?')
+      .run(entry.comment, entry.status, now, entryId)
+    if (existing.length > 1) {
+      await db.prepare(`DELETE FROM managed_dependency_file_review
+        WHERE review_id = ? AND file = ? AND id <> ?`).run(reviewId, entry.file, entryId)
+    }
+  } else {
+    await db.prepare('INSERT INTO managed_dependency_file_review (id, review_id, file, comment, status, time) VALUES (?, ?, ?, ?, ?, ?)')
+      .run(randomUUID(), reviewId, entry.file, entry.comment, entry.status, now)
+  }
+}
+
+export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
+  const read = (id: string) => db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ?`).get(id)
+  return {
+    listOwnDependencyReviews: (user, before) => listOwn(db, user, before),
+    async getLatestOwnDependencyReview(user, target) {
+      const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
+        WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
+        .get(user, target.ecosystem, target.package, target.version, target.integrity)
+      return row ? (await expandReviews(db, [row], user))[0]! : null
+    },
+    async discardDependencyReview(sessionId, reviewId, revision) {
+      const user = await actor(db, sessionId)
+      const { changes } = await db.prepare(`DELETE FROM managed_dependency_review
+        WHERE id = ? AND user_id = ? AND revision = ? AND published_at IS NULL`).run(reviewId, user.id, revision)
+      if (Number(changes) !== 1) conflict()
+    },
+    listDependencyReviewEnabledTeams: async () => (await db.prepare('SELECT id FROM managed_team WHERE dependency_review = 1 ORDER BY id').all() as { id: string }[]).map(row => row.id),
+    async setTeamDependencyReview(sessionId, teamId, enabled) {
+      await actor(db, sessionId, true)
+      if (!await db.prepare('SELECT id FROM managed_team WHERE id = ?').get(teamId)) return false
+      await db.prepare('UPDATE managed_team SET dependency_review = ? WHERE id = ?').run(enabled ? 1 : 0, teamId)
+      return true
+    },
+    listDependencyReviewTeams: user => teams(db, user),
+    async listDependencyReviews(context, user, allBases = false) {
+      const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
+        AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
+          SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id AND t.hidden = 0
+          JOIN managed_team_user m ON m.team_id = rt.team_id WHERE rt.review_id = r.id AND m.user_id = ?)))
+        ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
+      return expandReviews(db, rows, user)
+    },
+    async changeDependencyReview(context, sessionId, change, now) {
+      const user = await actor(db, sessionId)
+      let id = change.reviewId
+      let current: DependencyReview | undefined
+      if (id) {
+        current = await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ? AND user_id = ? AND ${contextWhere}`)
+          .get(id, user.id, ...values(context)) as DependencyReview | undefined
+        if (!current || current.revision !== change.revision) return conflict()
+      }
+      const unpublished = () => db.prepare(`SELECT id FROM managed_dependency_review WHERE user_id = ? AND ${contextWhere} AND published_at IS NULL`)
+        .get(user.id, ...values(context)) as Promise<{ id: string } | undefined>
+      const create = async () => {
+        if (await unpublished()) return conflict()
+        const next = randomUUID()
+        await db.prepare(`INSERT INTO managed_dependency_review
+          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, time, revision)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), now)
+        return next
+      }
+      if (change.action === 'start') {
+        id = await create()
+      } else if (change.action === 'continue') {
+        if (!current?.publishedAt) return conflict()
+        id = await create()
+        await db.prepare('UPDATE managed_dependency_review SET comment = ? WHERE id = ?').run(current.comment, id)
+        const entries = await db.prepare('SELECT id, file, comment, status, time FROM managed_dependency_file_review WHERE review_id = ? ORDER BY time, id').all(current.id) as ReviewEntry[]
+        for (const entry of fileEntries(entries)) {
+          await db.prepare(`INSERT INTO managed_dependency_file_review
+          (id, review_id, file, comment, status, time) VALUES (?, ?, ?, ?, ?, ?)`)
+          .run(randomUUID(), id, entry.file, entry.comment, entry.status, entry.time)
+        }
+      } else if (change.action === 'revoke') {
+        if (!current || current.publishedAt === null || current.revokedAt !== null) return conflict()
+        await db.prepare('UPDATE managed_dependency_review SET revoked_at = ?, revision = revision + 1 WHERE id = ?').run(now, id)
+      } else if (change.action === 'publish') {
+        await publish(db, current, user.id, change, now)
+      } else {
+        if (current?.publishedAt != null) return conflict()
+        if (change.entry.status === null && !change.entryId) throw new ManagedMutationError(400, 'bad-review')
+        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, revision = revision + 1 WHERE id = ?').run(now, id)
+        else { if (change.entryId) return conflict(); id = await create() }
+        await saveFile(db, id, change.entry, change.entryId, now)
+      }
+      return (await expandReviews(db, [await read(id!)], user.id))[0]!
+    },
+  }
+}

package/server-managed/github-app.ts

@@ -6,7 +6,7 @@ import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
 import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
-import { GithubApiError, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
+import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 
 export { GithubApiError } from './github-errors.ts'
 
@@ -71,6 +71,7 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 // fold into a GithubApiError (401 passes through for the caller to handle).
 export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET'): Promise<unknown> {
   let res: Response
+  const started = Date.now()
   try {
     res = await fetchImpl(url, {
       method,
@@ -81,10 +82,15 @@ export async function githubJson(url: string, token: string | null, fetchImpl: t
         'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
       },
     })
-  } catch { throw new GithubApiError(502, 'github-unreachable') }
+  } catch (error) { throw githubUnreachable(error, started) }
   if (res.status === 401) discardInstallationToken(token, fetchImpl)
   if (!res.ok) await throwGithubResponseError(res)
-  try { return await res.json() } catch { throw new GithubApiError(502, 'github-malformed') }
+  // The answer's body is read within the same timeout: one not read whole is
+  // GitHub not reached, as one not answered is; only one that isn't JSON is
+  // malformed.
+  try { return await res.json() } catch (error) {
+    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+  }
 }
 
 // Validate one repo object into a ConnectedRepo (or null to skip), tagging it

package/server-managed/github-errors.ts

@@ -5,14 +5,32 @@ import { HttpError } from '@preventive/upstream/github.js'
 export class GithubApiError extends Error {
   status: number
   retryAfter: number | null
-  constructor(status: number, message: string, retryAfter: number | null = null) {
+  // What failed, where GitHub wasn't reached (githubUnreachable).
+  detail: string | null
+  constructor(status: number, message: string, retryAfter: number | null = null, detail: string | null = null) {
     super(message)
     this.name = 'GithubApiError'
     this.status = status
     this.retryAfter = retryAfter
+    this.detail = detail
   }
 }
 
+// GitHub not reached, or its answer not read whole, `started` ms since the
+// epoch: as `github-unreachable`, with what failed as the error and its causes
+// tell it (a timeout, a connection closed, an answer too large) and after how
+// long, for an admin's page to show (repository-risk.ts). Only the errors'
+// names, codes and messages, never GitHub's text nor a request's headers.
+export function githubUnreachable(error: unknown, started: number): GithubApiError {
+  const told: string[] = []
+  for (let at = error, depth = 0; at instanceof Error && depth < 4; at = at.cause, depth++) {
+    const code = 'code' in at && typeof at.code === 'string' && at.code !== at.name ? ` ${at.code}` : ''
+    told.push(`${at.name}${code}${at.message ? `: ${at.message.slice(0, 200)}` : ''}`)
+  }
+  const failed = told.length > 0 ? told.join('; ') : String(error).slice(0, 200)
+  return new GithubApiError(502, 'github-unreachable', null, `${failed}, after ${((Date.now() - started) / 1000).toFixed(1)}s`)
+}
+
 export async function throwGithubResponseError(res: Response): Promise<never> {
   if (res.status === 403 || res.status === 429) {
     const body = await res.json().catch(() => null) as { message?: unknown } | null
@@ -30,6 +48,7 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
 }
 
 export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
+  const started = Date.now()
   try { return await request() } catch (error) {
     if (error instanceof HttpError) {
       // The upstream error includes GitHub's response text. Retain managed
@@ -44,6 +63,6 @@ export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
     if (error instanceof Error && (error.name === 'AssertionError' || error.cause instanceof SyntaxError)) {
       throw new GithubApiError(502, 'github-malformed')
     }
-    throw new GithubApiError(502, 'github-unreachable')
+    throw githubUnreachable(error, started)
   }
 }

package/server-managed/github-issue-oauth.ts

@@ -1,14 +1,13 @@
 import type { ManagedConfig } from './config.ts'
 import type { ManagedDb, ManagedSession } from './db.ts'
 import { randomToken, safeEqual } from './crypto.ts'
-import { buildCookie, clearCookie, cookieName, parseCookies } from './session.ts'
+import { ISSUE_STATE_COOKIE, buildCookie, clearCookie, cookieName, parseCookies } from './session.ts'
 import { OAuthError, ensureUserAccessToken, exchangeCode, fetchIdentity } from './github-oauth.ts'
 
 export const ISSUE_LOGIN_PATH = '/api/oauth/github/issues/login'
-const COOKIE = 'dvissuestate'
 
 export function isIssueOAuthCallback(config: ManagedConfig, query: URLSearchParams, cookie: string | undefined): boolean {
-  const expected = parseCookies(cookie).get(cookieName(config, COOKIE))?.split('.')[0]
+  const expected = parseCookies(cookie).get(cookieName(config, ISSUE_STATE_COOKIE))?.split('.')[0]
   return !!expected && safeEqual(query.get('state') ?? '', expected)
 }
 
@@ -22,13 +21,13 @@ export function issueLoginRedirect(config: ManagedConfig, session: ManagedSessio
   // Reauthorize the same app for the current account, without replacing the
   // DeepView session or permitting an OAuth account switch during creation.
   const value = `${state}.${session.id}.${now}`
-  return { location: url.href, setCookie: buildCookie(cookieName(config, COOKIE), value,
+  return { location: url.href, setCookie: buildCookie(cookieName(config, ISSUE_STATE_COOKIE), value,
     { secure: config.cookieSecure, maxAgeS: 600, sameSite: 'Lax' }) }
 }
 
 export async function issueOAuthCallback(config: ManagedConfig, db: ManagedDb, session: ManagedSession,
   query: URLSearchParams, cookie: string | undefined, fetchImpl: typeof fetch = fetch, now = Date.now()) {
-  const [expected, sessionId, timestamp] = (parseCookies(cookie).get(cookieName(config, COOKIE)) ?? '').split('.')
+  const [expected, sessionId, timestamp] = (parseCookies(cookie).get(cookieName(config, ISSUE_STATE_COOKIE)) ?? '').split('.')
   const code = query.get('code'), state = query.get('state')
   if (!code || !state || !expected || !safeEqual(state, expected) || sessionId !== session.id
     || !timestamp || !Number.isFinite(Number(timestamp)) || now < Number(timestamp) || now - Number(timestamp) > 600_000) {
@@ -40,7 +39,7 @@ export async function issueOAuthCallback(config: ManagedConfig, db: ManagedDb, s
   const current = await db.sessionWithUser(session.id, Date.now())
   if (!current || current.user.role === 'none' || current.session.userId !== session.userId) throw new OAuthError(401, 'unauthenticated')
   await db.setUserTokens(session.userId, tokens)
-  return { location: '/github-issue-authorized.html', setCookie: clearCookie(cookieName(config, COOKIE), config.cookieSecure) }
+  return { location: '/github-issue-authorized.html', setCookie: clearCookie(cookieName(config, ISSUE_STATE_COOKIE), config.cookieSecure) }
 }
 
 export function issueUserToken(config: ManagedConfig, db: ManagedDb, userId: string, fetchImpl: typeof fetch = fetch) {

package/server-managed/github-metadata.ts

@@ -18,6 +18,18 @@ export interface GithubRepositoryVisibility {
   public: boolean
   checkedAt: number
 }
+// A commit's details, keyed by githubCommitKey. Commits never change, so an
+// entry is never refreshed or evicted.
+export interface GithubCommit {
+  key: string
+  message: string
+  authorName: string | null
+  authorLogin: string | null
+  authoredAt: number | null
+  committedAt: number | null
+  fetchedAt: number
+}
+export interface GithubTag { name: string; sha: string }
 export interface GithubMetadataStore {
   listGithubMetadata(keys: readonly string[]): Promise<GithubMetadata[]>
   setGithubMetadata(entries: readonly Omit<GithubMetadata, 'attemptedAt'>[]): Promise<void>
@@ -25,6 +37,21 @@ export interface GithubMetadataStore {
   listGithubRepositoryVisibility(repoIds: readonly number[]): Promise<GithubRepositoryVisibility[]>
   setGithubRepositoryVisibility(entries: readonly GithubRepositoryVisibility[]): Promise<void>
 }
+export interface GithubCommitStore {
+  listGithubCommits(keys: readonly string[]): Promise<GithubCommit[]>
+  setGithubCommits(entries: readonly GithubCommit[]): Promise<void>
+  // The cached tags that point to each commit, by githubCommitKey.
+  listGithubCommitTags(keys: readonly string[]): Promise<{ key: string; name: string }[]>
+  // `complete` is a listing of every tag the repository has: tags it leaves
+  // out were deleted. Otherwise only the listed tags are updated. `observedUs`
+  // orders overlapping refreshes (see githubCommitMethods).
+  refreshGithubTags(repoId: number, tags: readonly GithubTag[], complete: boolean, observedUs: number): Promise<void>
+}
+
+// A stable repository ID survives renames, as in the PR metadata keys.
+export function githubCommitKey(repoId: number, sha: string): string {
+  return `${repoId}:${sha}`
+}
 
 // Successful GitHub reads are shared and retained without eviction. The stable
 // repository ID in the key survives renames, but is never an access grant.
@@ -48,6 +75,33 @@ CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
   checked_at INTEGER NOT NULL
 ) STRICT;
 `
+// Bundles show their commit's details and tags from these tables. Readers rely
+// on bundle access alone; only a GitHub read made with access fills them.
+// Commits are retained without eviction. Create a bundle refreshes a
+// repository's tags, which go with the repository.
+export const GITHUB_COMMIT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_github_commit (
+  cache_key TEXT PRIMARY KEY,
+  message TEXT NOT NULL,
+  author_name TEXT,
+  author_login TEXT,
+  authored_at INTEGER,
+  committed_at INTEGER,
+  fetched_at INTEGER NOT NULL
+) STRICT;
+CREATE TABLE IF NOT EXISTS managed_github_tag (
+  repo_id INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  commit_key TEXT NOT NULL,
+  observed_us INTEGER NOT NULL,
+  PRIMARY KEY (repo_id, name)
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_github_tag_commit_idx ON managed_github_tag(commit_key);
+CREATE TABLE IF NOT EXISTS managed_github_tag_listing (
+  repo_id INTEGER PRIMARY KEY REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  observed_us INTEGER NOT NULL
+) STRICT;
+`
 
 export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
   const list = db.prepare(`SELECT cache_key AS key, title, description, status, state_reason AS stateReason, fetched_at AS fetchedAt, attempted_at AS attemptedAt
@@ -96,3 +150,64 @@ export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
     },
   }
 }
+
+export function githubCommitMethods(db: ManagedSql): GithubCommitStore {
+  const commits = db.prepare(`SELECT cache_key AS key, message, author_name AS authorName, author_login AS authorLogin,
+      authored_at AS authoredAt, committed_at AS committedAt, fetched_at AS fetchedAt
+    FROM managed_github_commit WHERE cache_key IN (SELECT value FROM json_each(?))`)
+  // Concurrent reads of one commit store the same details; the first stays.
+  const setCommits = db.prepare(`INSERT INTO managed_github_commit (cache_key, message, author_name, author_login, authored_at, committed_at, fetched_at)
+    SELECT json_extract(e.value, '$.key'), json_extract(e.value, '$.message'), json_extract(e.value, '$.authorName'),
+      json_extract(e.value, '$.authorLogin'), CAST(json_extract(e.value, '$.authoredAt') AS BIGINT),
+      CAST(json_extract(e.value, '$.committedAt') AS BIGINT), CAST(json_extract(e.value, '$.fetchedAt') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (cache_key) DO NOTHING`)
+  const commitTags = db.prepare(`SELECT commit_key AS key, name FROM managed_github_tag
+    WHERE commit_key IN (SELECT value FROM json_each(?)) ORDER BY commit_key, name`)
+  // Overlapping browses can finish out of order, so every refresh carries
+  // when it was observed (in microseconds). Each tag keeps the time it was
+  // last observed and only a later observation moves it; a complete listing
+  // deletes only the tags observed before it. The listing table holds the
+  // last complete listing applied: one observed no later knew whether every
+  // tag existed, so a refresh it supersedes is skipped (a tie keeps the first).
+  const lastListing = db.prepare('SELECT observed_us AS observedUs FROM managed_github_tag_listing WHERE repo_id = ?')
+  const setListing = db.prepare(`INSERT INTO managed_github_tag_listing (repo_id, observed_us) VALUES (?, ?)
+    ON CONFLICT (repo_id) DO UPDATE SET observed_us = excluded.observed_us`)
+  const deleteTags = db.prepare(`DELETE FROM managed_github_tag WHERE repo_id = ? AND observed_us < ?
+    AND name NOT IN (SELECT value FROM json_each(?))`)
+  const setTags = db.prepare(`INSERT INTO managed_github_tag (repo_id, name, commit_key, observed_us)
+    SELECT CAST(json_extract(e.value, '$.repoId') AS BIGINT), json_extract(e.value, '$.name'), json_extract(e.value, '$.key'),
+      CAST(json_extract(e.value, '$.observedUs') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (repo_id, name) DO UPDATE SET commit_key = excluded.commit_key, observed_us = excluded.observed_us
+    WHERE managed_github_tag.observed_us < excluded.observed_us`)
+  return {
+    async listGithubCommits(keys) {
+      if (keys.length === 0) return []
+      const rows = await commits.all(JSON.stringify(keys)) as GithubCommit[]
+      return rows.map(row => ({ ...row }))
+    },
+    async setGithubCommits(entries) {
+      if (entries.length > 0) await setCommits.run({ contexts: JSON.stringify(entries) })
+    },
+    async listGithubCommitTags(keys) {
+      if (keys.length === 0) return []
+      const rows = await commitTags.all(JSON.stringify(keys)) as { key: string; name: string }[]
+      return rows.map(row => ({ ...row }))
+    },
+    async refreshGithubTags(repoId, tags, complete, observedUs) {
+      // Writes hold the store's writer lock: the listing read stays current.
+      const last = (await lastListing.get(repoId) as { observedUs: number } | undefined)?.observedUs
+      if (last !== undefined && last >= observedUs) return
+      // Postgres refuses an upsert that names one row twice.
+      const unique = [...new Map(tags.map(tag => [tag.name, tag])).values()]
+      if (complete) {
+        await setListing.run(repoId, observedUs)
+        await deleteTags.run(repoId, observedUs, JSON.stringify(unique.map(tag => tag.name)))
+      }
+      if (unique.length > 0) {
+        await setTags.run({ contexts: JSON.stringify(unique.map(tag => ({ repoId, name: tag.name, key: githubCommitKey(repoId, tag.sha), observedUs }))) })
+      }
+    },
+  }
+}

package/server-managed/github-oauth.ts

@@ -7,6 +7,7 @@ import type { ManagedConfig } from './config.ts'
 import type { ManagedDb, ManagedUser, UserTokens } from './db.ts'
 import { randomToken, safeEqual } from './crypto.ts'
 import { STATE_COOKIE, buildCookie, clearCookie, cookieName, createSession, parseCookies } from './session.ts'
+import { isViewing } from './view-as.ts'
 
 const GITHUB_AUTHORIZE_URL = 'https://github.com/login/oauth/authorize'
 const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token'
@@ -122,22 +123,57 @@ async function postToken(payload: Record<string, string>, now: number, fetchImpl
   }
 }
 
+// The refreshes in flight in this process, by user. GitHub rotates refresh
+// tokens and refuses a spent one (bad_refresh_token), so requests that find the
+// token expired together share one refresh rather than race on the same token.
+const refreshing = new Map<string, Promise<string | null>>()
+// After GitHub refuses a refresh token, how long to wait before each further
+// read for the pair another instance got with it: a second in all.
+const STORED_PAIR_WAITS_MS = [100, 200, 300, 400]
+
 // Resolve a usable access token for a user: the stored one if still valid, else
 // refreshed (when a refresh token is on file) and re-persisted. Null when there
 // is no token or it's expired and unrefreshable — the caller prompts re-login.
 // A 60s skew margin avoids handing back a token about to expire mid-request.
+// An admin viewing as another user never borrows that user's GitHub access.
 export async function ensureUserAccessToken(
   config: ManagedConfig, db: ManagedDb, userId: string, now: number, fetchImpl: typeof fetch = globalThis.fetch,
 ): Promise<string | null> {
+  if (isViewing()) return null
   const tokens = await db.getUserTokens(userId)
   if (tokens == null) return null
-  if (tokens.expiresAt == null || tokens.expiresAt > now + 60_000) return tokens.accessToken
+  if (usableAt(tokens, now)) return tokens.accessToken
   if (tokens.refreshToken == null) return null
+  let pending = refreshing.get(userId)
+  if (pending == null) {
+    pending = refreshStoredToken(config, db, userId, tokens.accessToken, tokens.refreshToken, now, fetchImpl)
+      .finally(() => refreshing.delete(userId))
+    refreshing.set(userId, pending)
+  }
+  return pending
+}
+
+function usableAt(tokens: UserTokens, now: number): boolean {
+  return tokens.expiresAt == null || tokens.expiresAt > now + 60_000
+}
+
+async function refreshStoredToken(
+  config: ManagedConfig, db: ManagedDb, userId: string, staleToken: string, refreshToken: string, now: number, fetchImpl: typeof fetch,
+): Promise<string | null> {
   try {
-    const fresh = await refreshUserToken(config, tokens.refreshToken, now, fetchImpl)
+    const fresh = await refreshUserToken(config, refreshToken, now, fetchImpl)
     await db.setUserTokens(userId, fresh)
     return fresh.accessToken
   } catch (err) {
+    // Another request or instance may have spent the refresh token first: use
+    // the pair it stored rather than leave this request to ask anonymously.
+    // Where GitHub refused the token, that pair may not be stored yet.
+    const waits = err instanceof OAuthError && err.message === 'github-token-denied' ? STORED_PAIR_WAITS_MS : []
+    for (const wait of [0, ...waits]) {
+      if (wait > 0) await new Promise(resolve => { setTimeout(resolve, wait) })
+      const stored = await db.getUserTokens(userId).catch(() => null)
+      if (stored != null && stored.accessToken !== staleToken && usableAt(stored, now)) return stored.accessToken
+    }
     console.warn('managed: token refresh failed:', err)
     return null
   }

package/server-managed/http-response.ts

@@ -1,5 +1,7 @@
 import type { ServerResponse } from 'node:http'
 import { Buffer } from 'node:buffer'
+import { pipeline } from 'node:stream/promises'
+import { createBrotliCompress, constants as zlibConstants } from 'node:zlib'
 import { UPLOAD_CHUNK_BYTES } from './uploads.ts'
 
 // Keep the header ASCII while filename* carries the original UTF-8 name.
@@ -22,3 +24,27 @@ export function sendJson(res: ServerResponse, status: number, body: unknown, hea
   res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers })
   writeResponse(res, JSON.stringify(body))
 }
+
+// Lines of JSON, Brotli-encoded and sent as each is written, so the reader
+// has each while the next is made. A reader gone, or no longer `allowed`
+// before a line, has the response cut short, as is one whose lines fail: a
+// response that ends is one with every line.
+export async function sendLines(res: ServerResponse, lines: AsyncIterable<unknown>, allowed: () => Promise<boolean>) {
+  res.writeHead(200, { 'content-type': 'application/x-ndjson', 'content-encoding': 'br', 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff' })
+  const encoder = createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } })
+  const sent = pipeline(encoder, res).catch(() => {})
+  const closed = new Promise(resolve => { res.once('close', resolve) })
+  try {
+    for await (const line of lines) {
+      if (res.destroyed || !await allowed()) { res.destroy(); return }
+      encoder.write(`${JSON.stringify(line)}\n`)
+      await Promise.race([new Promise<void>(resolve => { encoder.flush(() => { resolve() }) }), closed])
+    }
+  } catch (err) {
+    console.warn('managed: a streamed response failed:', err)
+    res.destroy()
+    return
+  }
+  encoder.end()
+  await sent
+}