@preventive/triage 1.0.0-alpha.41 → 1.0.0-alpha.43

package/common/managed/report-filter.ts

@@ -3,6 +3,7 @@
 // access is per finding: App, own source, and the own-source organizations stay.
 import { inheritReportMeta, isAppFinding, reportRepoGithub, stampSecurityGroups } from '@preventive/report'
 import { readManagedReport } from './report-content.ts'
+import { revalidationLinks, securityLinks } from '../security-links.js'
 
 export interface ViewerPermissions {
   dependencies: boolean
@@ -80,7 +81,7 @@ export function filterReportData(data: unknown, perms: ViewerPermissions, repo?:
     entry, members: (Array.isArray(entry) ? entry : [entry]).map(original => ({ original, finding: projectFinding(original, report) })),
   }))
   const groups = entries.map(({ members }) => members.flatMap(({ finding }) => finding ? [finding] : []))
-  if (!perms.security) stampSecurityGroups(groups)
+  if (!perms.security) stampSecurityGroups(groups, { linkedIds: securityLinks(revalidationLinks(groups.flat())).linkedIds })
   const githubOrgs = new Set<string>(), npmScopes = new Set<string>()
   const addOrgs = (finding: Finding) => {
     const github = githubOrg(finding), npm = npmScope(finding)

package/common/security-links.d.ts

@@ -0,0 +1,5 @@
+export function securityLinks(links?: Iterable<readonly string[]>): {
+  add(ids: readonly string[]): void
+  linkedIds(id: string): Iterable<string>
+}
+export function revalidationLinks(findings: Iterable<unknown>): string[][]

package/common/security-links.js

@@ -0,0 +1,33 @@
+// Links as stampSecurityGroups reads them, shared by the managed server's
+// permission filter and the view's security lens. A star per link is enough
+// for transitive propagation, without a quadratic expansion for large links.
+// `add` extends the lookup while a stamp is running: rows the finding index
+// returns can carry links of their own.
+export function securityLinks(links = []) {
+  const edges = new Map()
+  const connect = (a, b) => {
+    if (!edges.has(a)) edges.set(a, new Set())
+    edges.get(a).add(b)
+  }
+  const add = (ids) => {
+    for (const id of ids.slice(1)) { connect(ids[0], id); connect(id, ids[0]) }
+  }
+  for (const ids of links) add(ids)
+  return { add, linkedIds: (id) => edges.get(id) ?? [] }
+}
+
+// An App finding can name the source findings it revalidated only by ID, in
+// another row or report. The App view counts those as represented by it, so
+// they are one issue for security too: hiding one side alone would leave the
+// App answer to a hidden security finding, or a source row without its App row.
+// Only App findings: the view ignores inputs on any other finding
+// (finding-filters.js confirmedCoverage, revalidation-input-groups.js).
+export function revalidationLinks(findings) {
+  const links = []
+  for (const finding of findings) {
+    const inputs = finding?.revalidateInputs
+    if (finding?.isApp !== true || typeof finding.id !== 'string' || !Array.isArray(inputs)) continue
+    links.push([finding.id, ...inputs.filter((id) => typeof id === 'string' && id !== '')])
+  }
+  return links
+}