@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/server-managed/repository-aliases.ts

@@ -0,0 +1,91 @@
+import { randomUUID } from 'node:crypto'
+import { reportRepoGithub } from '@preventive/report'
+import { type RepositoryAliasInput, matchRepositoryAlias, repositoryAliasNeedsFilePrefix } from '../common/managed/repository-alias.ts'
+import type { ManagedDb } from './db.ts'
+import { ManagedMutationError } from './management.ts'
+import { normalizeTeamPath } from './repo-path.ts'
+import type { ManagedSql } from './sql.ts'
+
+export const REPOSITORY_ALIAS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_repository_alias (
+  id TEXT PRIMARY KEY,
+  old_repo TEXT NOT NULL,
+  old_path TEXT NOT NULL DEFAULT '',
+  repo_id INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  new_path TEXT NOT NULL DEFAULT '',
+  UNIQUE(old_repo, old_path)
+) STRICT;
+`
+export interface RepositoryAlias extends RepositoryAliasInput { id: string }
+export interface RepositoryAliasStore {
+  listRepositoryAliases(): Promise<RepositoryAlias[]>
+  saveRepositoryAlias(sessionId: string, id: string | null, input: unknown): Promise<RepositoryAlias>
+  deleteRepositoryAlias(sessionId: string, id: string): Promise<void>
+  getRepositoryImportLocation(github: string, directory: string, filePrefix?: string): Promise<{ repoId: number | null; directory: string }>
+}
+
+// Keep expensive inventory reads outside database transactions and skip them
+// unless a currently connected alias can use the bundle's existing paths.
+export async function resolveRepositoryImportLocation(db: ManagedDb, github: string, directory: string, loadFilePrefix: () => Promise<string>) {
+  const aliases = await db.listRepositoryAliases()
+  let filePrefix = ''
+  if (repositoryAliasNeedsFilePrefix(github, directory, aliases)) {
+    const active = new Set((await db.listSelectedRepos()).map(repo => repo.repoId))
+    if (repositoryAliasNeedsFilePrefix(github, directory, aliases.filter(alias => active.has(alias.repoId)))) filePrefix = await loadFilePrefix()
+  }
+  return db.getRepositoryImportLocation(github, directory, filePrefix)
+}
+
+function parseAlias(input: unknown): RepositoryAliasInput {
+  if (!input || typeof input !== 'object') throw new ManagedMutationError(400, 'bad-alias')
+  const { oldRepo, oldPath, repoId, newPath } = input as RepositoryAliasInput
+  const github = typeof oldRepo === 'string' ? reportRepoGithub({ repo: { github: oldRepo.trim() } }) : null
+  if (!github) throw new ManagedMutationError(400, 'bad-old-repo')
+  if (typeof oldPath !== 'string' || typeof newPath !== 'string') throw new ManagedMutationError(400, 'bad-directory')
+  const old = normalizeTeamPath(oldPath), target = normalizeTeamPath(newPath)
+  if (!old.ok || !target.ok) throw new ManagedMutationError(400, 'bad-directory')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) throw new ManagedMutationError(400, 'bad-repo')
+  return { oldRepo: github.toLowerCase(), oldPath: old.path ?? '', repoId, newPath: target.path ?? '' }
+}
+
+export function repositoryAliasMethods(db: ManagedSql): RepositoryAliasStore {
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+  }
+  async function listRepositoryAliases() {
+    return await db.prepare(`SELECT id, old_repo AS oldRepo, old_path AS oldPath, repo_id AS repoId, new_path AS newPath
+      FROM managed_repository_alias ORDER BY old_repo, old_path, id`).all() as RepositoryAlias[]
+  }
+  return {
+    listRepositoryAliases,
+    async saveRepositoryAlias(sessionId, id, input) {
+      await authorize(sessionId)
+      const alias = parseAlias(input)
+      if (!await db.prepare('SELECT repo_id FROM managed_selected_repo WHERE repo_id = ? AND active = 1').get(alias.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+      if (id && !await db.prepare('SELECT id FROM managed_repository_alias WHERE id = ?').get(id)) throw new ManagedMutationError(404, 'no-alias')
+      const duplicate = await db.prepare('SELECT id FROM managed_repository_alias WHERE old_repo = ? AND old_path = ?').get(alias.oldRepo, alias.oldPath) as { id: string } | undefined
+      if (duplicate && duplicate.id !== id) throw new ManagedMutationError(409, 'alias-exists')
+      const key = id ?? randomUUID()
+      await db.prepare(`INSERT INTO managed_repository_alias (id, old_repo, old_path, repo_id, new_path) VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET old_repo = excluded.old_repo, old_path = excluded.old_path, repo_id = excluded.repo_id, new_path = excluded.new_path`)
+        .run(key, alias.oldRepo, alias.oldPath, alias.repoId, alias.newPath)
+      return { id: key, ...alias }
+    },
+    async deleteRepositoryAlias(sessionId, id) {
+      await authorize(sessionId)
+      if (!(await db.prepare('DELETE FROM managed_repository_alias WHERE id = ?').run(id)).changes) throw new ManagedMutationError(404, 'no-alias')
+    },
+    async getRepositoryImportLocation(github, directory, filePrefix = '') {
+      const alias = matchRepositoryAlias(github, directory, await listRepositoryAliases(), filePrefix)
+      const normalized = normalizeTeamPath(alias?.directory ?? directory)
+      if (!normalized.ok) throw new ManagedMutationError(400, 'bad-directory')
+      const repo = await (alias
+        ? db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND repo_id = ?').get(alias.repoId)
+        : db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND LOWER(full_name) = ?').get(github.toLowerCase())) as { repoId: number } | undefined
+      return { repoId: repo?.repoId ?? null, directory: normalized.path ?? '' }
+    },
+  }
+}

package/server-managed/repository-browser.ts

@@ -0,0 +1,153 @@
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { readSolidityEntryPoints } from './solidity-entry-points.ts'
+import { parseGithubCommit } from './bundle-commits.ts'
+
+const REFS_PAGE = 100
+
+export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
+
+// Restricted managers can walk the ancestors of their grants, without seeing
+// sibling names or files outside those grants. null means the entire repo.
+export function scopedDirectory(path: string, scopes: (string | null)[]): RepositoryEntry[] | null {
+  if (scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))) return null
+  const prefix = path ? path + '/' : ''
+  const names = new Set(scopes.filter((scope): scope is string => !!scope && scope.startsWith(prefix)).map(scope => scope.slice(prefix.length).split('/')[0]!))
+  return [...names].toSorted().map(name => ({ name, path: prefix + name, type: 'dir' }))
+}
+
+export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
+type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
+
+function credentialFailure(err: unknown): err is GithubApiError {
+  return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
+}
+
+// Create once per HTTP request. Coalesce concurrent credential lookups without
+// caching repository visibility or permissions, or sharing credentials across users.
+export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
+  const tokens = new Map<number, Promise<string | null>>()
+  let identity: Promise<GithubIdentity> | undefined
+  const getIdentity = (fresh = false): Promise<GithubIdentity> => {
+    if (!user.token || user.githubUserId == null) return Promise.reject(new GithubApiError(404, 'no-repository'))
+    if (!identity || fresh) {
+      identity = githubUserIdentity(user.token, fetchImpl).then(value => {
+        if (value.id !== user.githubUserId) throw new GithubApiError(404, 'no-repository')
+        return value
+      })
+    }
+    return identity
+  }
+  return {
+    reader(repo: SelectedRepo) {
+      const installationToken = () => {
+        if (repo.installationId == null) return Promise.resolve(null)
+        const cached = tokens.get(repo.installationId)
+        const token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
+          if (!credentialFailure(err)) throw err
+          // Stale installations cannot prevent verified public access.
+          return null
+        })
+        if (!cached) tokens.set(repo.installationId, token)
+        return token
+      }
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
+    },
+  }
+}
+
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+  const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate.
+  let token = userToken ?? await installationToken()
+  const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
+  const metadata = async () => {
+    try { return await read('') }
+    catch (err) {
+      if (!token || !credentialFailure(err)) throw err
+      const fallback = await installationToken()
+      if (fallback && fallback !== token) {
+        token = fallback
+        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+      }
+      // Anonymous fallback is only for unavailable credentials, never rate
+      // limits, network errors, or GitHub outages.
+      token = null
+      return read('')
+    }
+  }
+  const checkAccess = async (freshIdentity = false) => {
+    // Stored visibility can be stale (or internal with private=false). Require
+    // current, explicit public visibility or the caller's effective permission.
+    const data = await metadata() as { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; default_branch?: unknown }
+    if (data?.id !== repo.repoId || typeof data.full_name !== 'string' || data.full_name.toLowerCase() !== repo.fullName.toLowerCase()) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    if (data.private === false && data.visibility === 'public') return data
+    if (!token) throw new GithubApiError(404, 'no-repository')
+    const appToken = await installationToken()
+    if (!appToken) throw new GithubApiError(404, 'no-repository')
+    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    token = appToken
+    return data
+  }
+  const current = await checkAccess()
+  const defaultBranch = typeof current.default_branch === 'string' ? current.default_branch : ''
+  return {
+    recheckAccess: () => checkAccess(true),
+    // Server-only credential, selected by the same live visibility/permission
+    // gate as directory browsing. Never included in an HTTP response.
+    readToken: () => token,
+    async refs() {
+      // Suggestions are bounded; the input also accepts any branch or tag name.
+      const list = async (kind: string) => {
+        const data = await read(`/${kind}?per_page=${REFS_PAGE}`)
+        if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+        return data
+      }
+      const [branches, tags] = await Promise.all([list('branches'), list('tags')])
+      const names = (items: { name?: unknown }[]) => items.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
+      // Each tag's commit, for the tag cache. A full page may leave tags
+      // out; only a shorter one lists every tag.
+      const tagCommits = tags.flatMap(item => typeof item?.name === 'string' && item.name && typeof item.commit?.sha === 'string'
+        && /^[a-f\d]{40}$/u.test(item.commit.sha) ? [{ name: item.name, sha: item.commit.sha }] : [])
+      return { defaultBranch, branches: names(branches), tags: names(tags), tagCommits, tagsComplete: tags.length < REFS_PAGE }
+    },
+    async commit(ref: string) {
+      if (/^[a-f\d]{40}$/iu.test(ref)) return ref
+      const data = await read(`/commits/${encodeURIComponent(ref || (defaultBranch ? `heads/${defaultBranch}` : 'HEAD'))}`) as { sha?: unknown }
+      if (typeof data?.sha !== 'string' || !/^[a-f\d]{40}$/iu.test(data.sha)) throw new GithubApiError(502, 'github-malformed')
+      return data.sha
+    },
+    // The first commit a listing from `sha` returns is that commit, without
+    // the files GET /commits/:sha adds.
+    async commitDetails(sha: string) {
+      return /^[a-f\d]{40}$/u.test(sha) ? parseGithubCommit(sha, await read(`/commits?sha=${sha}&per_page=1`)) : null
+    },
+    async directory(path: string, commit: string) {
+      const data = await read(`/contents/${path.split('/').map(encodeURIComponent).join('/')}?ref=${encodeURIComponent(commit)}`)
+      if (!Array.isArray(data)) throw new GithubApiError(400, 'not-a-directory')
+      const entries: RepositoryEntry[] = []
+      for (const item of data) {
+        if (typeof item?.name !== 'string' || item.name.includes('/') || item.name === '.' || item.name === '..') continue
+        const expectedPath = path ? `${path}/${item.name}` : item.name
+        if (item.path !== expectedPath) continue
+        const type = item.submodule_git_url ? 'submodule' : item.type
+        if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
+      }
+      const manifestPath = path ? `${path}/package.json` : 'package.json'
+      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
+        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
+      const solidity = await readSolidityEntryPoints(path, data, read)
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
+        ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
+      }
+    },
+  }
+}

package/server-managed/repository-discovery.ts

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto'
+import type { ManagedConfig } from './config.ts'
+import { GithubApiError, filterInstalledRepos, listInstalledRepos, listUserRepos } from './github-app.ts'
+import type { ConnectedRepo, RepoListing } from './github-app.ts'
+
+const CACHE_MS = 60_000
+const MAX_ENTRIES = 100
+interface Entry {
+  expires: number
+  pending: boolean
+  value: Promise<ConnectedRepo[]>
+}
+
+// One directory per HTTP handler. Searches/pages reuse discovery, but selected
+// flags still come from the database on every request. User results are scoped
+// to both the managed identity and its current GitHub credential. This cache is
+// only for discovery; connecting a repo still verifies fresh installation access.
+export class RepositoryDiscovery {
+  private readonly cache = new Map<string, Entry>()
+  private readonly config: ManagedConfig
+  private readonly fetchImpl: typeof fetch
+  private readonly now: () => number
+
+  constructor(config: ManagedConfig, fetchImpl: typeof fetch = (...args) => globalThis.fetch(...args), now: () => number = Date.now) {
+    this.config = config
+    this.fetchImpl = fetchImpl
+    this.now = now
+  }
+
+  private read(key: string, load: () => Promise<ConnectedRepo[]>): Promise<ConnectedRepo[]> {
+    const cached = this.cache.get(key)
+    if (cached && (cached.pending || cached.expires > this.now())) return cached.value
+    this.cache.delete(key)
+    while (this.cache.size >= MAX_ENTRIES) this.cache.delete(this.cache.keys().next().value!)
+    const entry: Entry = { expires: 0, pending: true, value: Promise.resolve([]) }
+    entry.value = load().then(repos => {
+      entry.expires = this.now() + CACHE_MS
+      entry.pending = false
+      return repos
+    }, (err: unknown) => {
+      if (this.cache.get(key) === entry) this.cache.delete(key)
+      throw err
+    })
+    this.cache.set(key, entry)
+    return entry.value
+  }
+
+  async list(scope: 'installed' | 'public', userId: string, token: string | null, showAll = false, refresh = false): Promise<RepoListing> {
+    // Invalidate derived user results along with the installation catalogue.
+    // An older in-flight read cannot repopulate this map after refresh.
+    if (refresh) this.cache.clear()
+    const installed = () => this.read('installed', () => listInstalledRepos(this.config, this.fetchImpl))
+    if (scope === 'installed' && showAll) return { repositories: await installed(), tokenMissing: false }
+    const publicInstalled = async (): Promise<ConnectedRepo[]> => (await installed()).filter(repo => repo.visibility === 'public')
+    if (token == null) return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    const credential = createHash('sha256').update(token).digest('hex')
+    const key = JSON.stringify([scope, userId, credential])
+    try {
+      if (scope === 'installed') {
+        const repositories = await this.read(key, async () => filterInstalledRepos(this.config, await installed(), token, this.fetchImpl))
+        return { repositories, tokenMissing: false }
+      }
+      // Installations only deduplicate the public picker. Their failure must
+      // not block otherwise readable public repos or look like a stale login.
+      // Cache the two sources separately so failed installation discovery is
+      // retried without caching a degraded combined list for another minute.
+      const [userRepos, installedRepos] = await Promise.all([
+        this.read(key, () => listUserRepos(token)),
+        installed().catch((err: unknown) => {
+          console.warn('managed: installed repo deduplication failed:', err)
+          return []
+        }),
+      ])
+      const installedIds = new Set(installedRepos.map(repo => repo.id))
+      const repositories = userRepos.filter(repo => repo.visibility === 'public' && !installedIds.has(repo.id))
+      return { repositories, tokenMissing: false }
+    } catch (err) {
+      if (!(err instanceof GithubApiError) || err.status !== 401) throw err
+      return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    }
+  }
+}

package/server-managed/repository-policy.ts

@@ -0,0 +1,27 @@
+import type { StoredUser } from './db.ts'
+
+const WHITEHAT = [
+  291301, // ChALkeR
+  259122746, // exo-nikita
+  247161625, // ex0sec
+]
+const whitehatIds = new Set(WHITEHAT)
+
+// (1) Server permission to add repositories. Keep this independent of GitHub
+// identity and ecosystem exceptions if other install modes broaden it later.
+export function canAddRepositories(user: StoredUser): boolean {
+  return user.role === 'admin'
+}
+
+// (3b) Only the ecosystem safeguard for public repositories is bypassed by
+// WHITEHAT. Callers must separately establish (0) server readability, (1) add
+// permission, and (2) server admin or GitHub access to this repository.
+export function passesPublicRepositorySafeguard(githubUserId: number | null, involved: boolean): boolean {
+  return involved || (githubUserId != null && whitehatIds.has(githubUserId))
+}
+
+// Arbitrary public repositories have no involvement evidence, so (2) requires
+// admin even if (1) expands in the future. This capability is also the UI gate.
+export function canAddAnyPublicRepository(user: StoredUser, githubUserId: number | null): boolean {
+  return canAddRepositories(user) && user.role === 'admin' && passesPublicRepositorySafeguard(githubUserId, false)
+}