@preventive/triage 1.0.0-alpha.42 → 1.0.0-alpha.44

package/server-managed/http.ts

@@ -3,7 +3,8 @@
 // server doesn't speak the e2e sync protocol yet). Every handler is async; the
 // boot's `track()` keeps in-flight requests drainable on shutdown.
 //
-//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName } }  (public)
+//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName }, session }  (public;
+//        `session` is /api/auth/session's answer, null signed out, absent when it could not be read)
 //   GET  /api/oauth/github/login → 302 to GitHub (+ state cookie)
 //   GET  /api/oauth/github/callback → the OAuth hook (see github-oauth.ts)
 //   GET  /api/auth/session       → { user, csrfToken } | 401
@@ -89,7 +90,7 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { npmVersionStore, riskLineStore } from './npm-kept.ts'
+import { npmVersionStore, riskLineStore, scanReadStore } from './npm-kept.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
 import { auditCache, auditedRepos, lastListing } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
@@ -120,7 +121,7 @@ import { findingsRepository, loadManagedFindings, ownFileDirectory, readManagedR
 import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
-import { CONFIG_PATH, type ServerInfo } from '../common/server-info.ts'
+import { CONFIG_PATH, type ManagedSessionInfo, type ServerInfo } from '../common/server-info.ts'
 import { bundleCommitHash } from '../common/bundle-commit.js'
 import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName, repositoryInstallation } from './github-app.ts'
 import { upstreamGithub } from './github-errors.ts'
@@ -128,7 +129,7 @@ import { createClient } from '@preventive/upstream/github.js'
 import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
-import { RISK_KEPT_MS, repositoryRiskLines } from './repository-risk.ts'
+import { RISK_KEPT_MS, SCAN_READ_KEPT_MS, type ScanProgress, repositoryRiskLines } from './repository-risk.ts'
 import { type RepositoryEntry, createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
 import { clearCookie, endSession, readSession } from './session.ts'
@@ -146,23 +147,24 @@ import { attachmentDisposition, sendJson, sendLines, writeResponse } from './htt
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
-import { teamAppKey, teamAppStates } from './team-app.ts'
+import { teamAppKey, teamAppStates, withWorkspaceSummary } from './team-app.ts'
 import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
-import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
 import { computeBundleDiff } from '../common/bundle-compare-diff.js'
 import type { ReviewChange, ReviewContext, ReviewInput } from './dependency-reviews.ts'
 import { allowedReviewVerdicts, isReviewableFile, npmReviewVerdictLimit, npmTakenDown } from '../common/dependency-reviews.js'
 import { type NpmAdvisoryOptions, npmAdvisories, npmCommitTags, npmDownloads, npmGithubStats, npmKnown, npmLatestRepo, npmSocketReport } from './npm-insights.ts'
 import { npmProvenance } from './npm-provenance.ts'
-import { npmRisk, npmRiskRemoved } from './npm-risk.ts'
+import { npmReadyScanDownload, npmReadyScanDownloads, npmRisk, npmRiskRemoved } from './npm-risk.ts'
 import { NpmRiskError } from '../risk/index.js'
 import { type PrettyCache, PrettyError, type PrettyRequest, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
 import { typeOnlyFiles } from './type-only.ts'
+import { comparisonBody, emptySide, npmComparedSide } from './comparison.ts'
 import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 
 const SESSION_PATH = '/api/auth/session'
@@ -216,6 +218,7 @@ const NPM_PROVENANCE_PATH = '/api/npm/provenance'
 const NPM_PRETTY_PATH = '/api/npm/pretty'
 const NPM_RENAME_DIFF_PATH = '/api/npm/rename-diff'
 const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
+const NPM_COMPARISON_PATH = '/api/npm/comparison'
 const NPM_RISK_PATH = '/api/npm/risk'
 // What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
 // having no such package or version, or a tarball unpacking past risk's
@@ -229,7 +232,7 @@ function sendRiskError(res: ServerResponse, err: NpmRiskError) {
   sendJson(res, status, { error: err.code })
 }
 const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
-  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH])
+  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH, NPM_COMPARISON_PATH])
 // How long an npm response may go unread before its connection is dropped.
 const NPM_RESPONSE_IDLE_MS = 60_000
 const MAX_TEAM_NAME = 100
@@ -581,6 +584,24 @@ async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps,
   return s
 }
 
+// Who am I? While an admin views as another user, that user, plus the admin
+// as `viewer`. A view that has ended (with the admin's session or role, or the
+// viewed account) is cleared, returning to the own session. Null signed out.
+async function currentSession(config: ManagedConfig, db: ManagedDb, cookie: string | undefined): Promise<{ body: ManagedSessionInfo | null; headers: Record<string, string> }> {
+  const now = Date.now()
+  let s = await readSession(config, db, cookie, now)
+  const ended = s == null && viewToken(config, cookie) != null
+  if (ended) s = await readSession(config, db, cookie, now, { own: true })
+  return {
+    body: s && {
+      user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
+      csrfToken: s.session.csrfToken,
+      ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
+    },
+    headers: ended ? { 'set-cookie': clearViewCookie(config) } : {},
+  }
+}
+
 // GET /api/admin/scan/models — the server's canonical scan model ids and effort
 // levels. Names are intentionally absent; the client derives them from ids.
 async function handleListModels(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -1351,6 +1372,10 @@ async function sendEncoded(req: IncomingMessage, res: ServerResponse, blob: Open
 // go idle, unread or with no line to send, before the scan is stopped.
 const REPO_RISK_RECHECK_MS = 10_000
 const REPO_RISK_IDLE_MS = 5 * 60_000
+// A scan's part on a serverless deployment, within its function's 300s
+// (vercel.managed.json): past it the scan stops, its last line `continue`,
+// and the page asks again, from where it stopped (repository-risk.ts).
+const REPO_RISK_PART_MS = 270_000
 
 // The repositories a scan of risk reads, by its query: every connected one;
 // a team's (`team`, its id), each in the team's directories of it; or one
@@ -1379,6 +1404,14 @@ async function riskRepositories(db: ManagedDb, query: URLSearchParams): Promise<
   })
 }
 
+// Where a scan in parts keeps its progress (repository-risk.ts
+// ScanProgress) under `key`, for a day; none where the page gave no scan id.
+function scanProgress(deps: ManagedHttpDeps, key: string, scan: string | null) {
+  if (scan === null || !/^[\w-]{1,64}$/u.test(scan)) return undefined
+  const kept = scanReadStore<ScanProgress>(deps.db, 'progress', SCAN_READ_KEPT_MS, deps.config.debug)
+  return { read: () => kept.read(key), write: (progress: ScanProgress) => kept.write(key, progress, Date.now()) }
+}
+
 // GET /api/admin/repositories/risk: every connected repository's npm
 // packages, or a team's or one repository's (riskRepositories), as its
 // lockfiles lock them at its default branch's head, each assessed by risk
@@ -1404,8 +1437,19 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
   res.setTimeout(REPO_RISK_IDLE_MS, () => res.destroy())
   const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, s.user.id))
   const scopes = new Map<string, Promise<boolean>>()
+  const teamScoped = (name: string) => {
+    const scope = npmPackageScope(name)
+    if (scope === null) return Promise.resolve(false)
+    if (!scopes.has(scope)) scopes.set(scope, deps.db.hasTeamNpmScope(scope))
+    return scopes.get(scope)!
+  }
   const versions = npmVersionStore(deps.db, deps.config.debug)
+  const stores = { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug }
   const lines = repositoryRiskLines({
+    // Which repositories a scan in parts told whole, by the admin, the id the
+    // page gives the scan (`scan`) and its scope, for the next part to go on
+    // past them.
+    progress: scanProgress(deps, `${s.user.id}\0${query.get('scan')}\0${query.get('team') ?? ''}\0${query.get('repo') ?? ''}`, query.get('scan')),
     repos: () => Promise.resolve(repos),
     async open(repo) {
       const reader = await browser.reader(repo)
@@ -1418,21 +1462,32 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
         recheck: async () => { await reader.recheckAccess() },
       }
     },
-    teamScoped(name) {
-      const scope = npmPackageScope(name)
-      if (scope === null) return Promise.resolve(false)
-      if (!scopes.has(scope)) scopes.set(scope, deps.db.hasTeamNpmScope(scope))
-      return scopes.get(scope)!
+    teamScoped,
+    // Each package's downloads readied before it is assessed
+    // (scan-downloads.ts), so that none waits on npm's downloads API; a
+    // team's own not asked, as risk asks none of theirs.
+    downloads: {
+      async atOnce(names, ready, signal) {
+        const asked: string[] = []
+        for (const name of names) if (await teamScoped(name)) ready(name); else asked.push(name)
+        await npmReadyScanDownloads(asked, ready, stores, signal)
+      },
+      one: (name, signal) => npmReadyScanDownload(name, stores, signal),
     },
     // Public versions' documents kept in the database (npm-kept.ts), as the
     // viewer keeps them: whether npm still has one, its whole document tells
     // risk.
     version: async (name, version, signal) => found(await readNpmVersion(name, version, true, signal, versions)),
-    assess: (doc, teamScoped, signal) => npmRisk(doc, 'pick', { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug,
-      teamScoped, privileged: true, signal, spare: true }),
-    removed: (name, version, teamScoped, signal) => npmRiskRemoved(name, version, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug,
-      teamScoped, privileged: true, signal }),
-    risks: riskLineStore(deps.db, RISK_KEPT_MS, deps.config.debug),
+    assess: (doc, ownScope, signal) => npmRisk(doc, 'pick', { ...stores, teamScoped: ownScope, privileged: true, signal, spare: true }),
+    removed: (name, version, ownScope, signal) => npmRiskRemoved(name, version, { ...stores, teamScoped: ownScope, privileged: true, signal }),
+    // Kept for good, a scan telling one past RISK_KEPT_MS at once, as stale.
+    risks: riskLineStore(deps.db, Infinity, deps.config.debug),
+    // What it read of GitHub kept a day, for a scan answered in parts to go
+    // on from where the last stopped, on whichever instance answers the next.
+    listings: scanReadStore(deps.db, 'listings', SCAN_READ_KEPT_MS, deps.config.debug),
+    lockfiles: scanReadStore(deps.db, 'lockfiles', SCAN_READ_KEPT_MS, deps.config.debug),
+    // And each lockfile's advisories, for as long as a scan tells them.
+    audits: scanReadStore(deps.db, 'advisories', RISK_KEPT_MS, deps.config.debug),
     // As a bundle's advisories are asked (bundle-advisories.ts), npm's registry
     // and, for packages anyone may read, OSV: no repository's. Each lockfile's
     // audit is bounded on its own, for one npm doesn't answer to fail alone and
@@ -1444,7 +1499,7 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
       if (audited.status !== 200) throw new NpmPackageError(502, audited.body.error)
       return audited.body
     },
-  }, controller.signal)
+  }, controller.signal, undefined, { partMs: deps.config.serverless ? REPO_RISK_PART_MS : null })
   let checked = Date.now()
   await sendLines(res, lines, async () => {
     if (deps.isShuttingDown()) return false
@@ -1481,18 +1536,25 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
   await sendEncoded(req, res, cached, contentType, headers)
 }
 
+// Two bundles a reader asks about together, where they may read both, else
+// null, told as 401 or 404: asked before what is worked out of them and
+// again before it is sent.
+function bothBundles(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, otherId: string) {
+  return async () => {
+    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
+    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
+    return [base.bundle, other.bundle] as const
+  }
+}
+
 // GET /api/bundles/:id/rename-diff: one of its JavaScript files diffed with
 // one of the `other` bundle's, both pretty-printed, renamed names hidden
 // (rename-diff.ts), for a reader of both, checked again once it is worked out.
 async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
   const otherId = params.get('other') ?? '', request = renameDiffRequest(params)
   if (!request || !/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const readable = async () => {
-    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
-    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
-    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
-    return [base.bundle, other.bundle] as const
-  }
+  const readable = bothBundles(res, deps, session, id, otherId)
   const records = await readable()
   if (!records) return
   const { prettyCache } = deps
@@ -1508,6 +1570,25 @@ async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse,
   else diff.stream.destroy()
 }
 
+// GET /api/bundles/:id/comparison?other=: its files paired with the `other`
+// bundle's as Compare pairs them, with what its Overview reads beside them
+// (comparison.ts), within a reason `scope` where given; for a reader of
+// both, checked again once it is worked out.
+async function handleBundleComparison(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
+  const otherId = params.get('other') ?? ''
+  if (!/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-bundle' }); return }
+  const readable = bothBundles(res, deps, session, id, otherId)
+  const records = await readable()
+  if (!records) return
+  const { prettyCache } = deps
+  if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(records[0]), await prettyCache.bundleDetails(records[1]), params.get('scope') ?? '') }
+  catch (err) { sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return }
+  if (await readable()) await sendEncoded(req, res, body, 'application/json')
+  else body.stream.destroy()
+}
+
 // GET /api/bundles/:id/pretty?other=: the files that changed between it and
 // the `other` bundle, both sides' pretty-printed (pretty-print.ts compared), a
 // line each as it is found kept or formatted; GET
@@ -1864,7 +1945,7 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
   // The revision sent is the reloaded catalog's, so classify what changed now.
   const apps = await teamAppStates(deps.db, deps.reportStore, session.id, teams, classified)
   sendJson(res, 200, {
-    teams: teams.map(team => ({ ...team, app: apps.get(teamAppKey(team)) ?? null,
+    teams: teams.map(team => ({ ...withWorkspaceSummary(team, apps.get(teamAppKey(team))),
       bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
         commitInfo: commits.commitInfo(bundle) })) })),
     revision,
@@ -2614,12 +2695,15 @@ async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true, scopes: (await deps.db.listTeamNpmScopes())[teamId] ?? [] })
 }
 
-// Who reads npm packages now: a session with workspace access, its role and
-// the npm scopes of its visible teams. Null for none.
-async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined): Promise<NpmReader | null> {
+// Who reads npm packages now: a session with workspace access, its role and,
+// where they count for any of `names` it is asked about (npmScopesCount), the
+// npm scopes of its visible teams, else none: none are read for an unscoped
+// package, an admin or a manager, or an answer checked again that is public.
+// Null for none.
+async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[]): Promise<NpmReader | null> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
   if (s == null || !roleAtLeast(s.user.role, 'view')) return null
-  return { role: s.user.role, scopes: new Set(await deps.db.listUserNpmScopes(s.user.id)), userId: s.user.id }
+  return { role: s.user.role, scopes: new Set(npmScopesCount(s.user.role, names) ? await deps.db.listUserNpmScopes(s.user.id) : []), userId: s.user.id }
 }
 
 // What a registry read found, or a 404 for the package (handleNpm's catch
@@ -2636,7 +2720,7 @@ async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse,
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
   try {
-    const reader = await npmReader(deps, cookie)
+    const reader = await npmReader(deps, cookie, reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []]))
     if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     const documents = new Map<string, Promise<NpmVersionDocument | null>>()
     // Public versions' documents as the viewer keeps them (npm-kept.ts), a
@@ -2650,7 +2734,7 @@ async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse,
     const packages = await Promise.all(reviews.map(review => Promise.all([
       read(review.package, review.version), ...(review.basePackage ? [read(review.basePackage, review.baseVersion!)] : []),
     ])))
-    const current = await npmReader(deps, cookie)
+    const current = await npmReader(deps, cookie, packages.flat().flatMap(doc => doc?.private ? [doc.name] : []))
     if (!current || current.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     return reviews.filter((_, index) => packages[index]!.every(doc => doc && (!doc.private || canReadPrivateNpm(current, doc.name))))
   } catch (error) {
@@ -2760,7 +2844,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
   try {
-    const reader = await npmReader(deps, cookie)
+    const reader = await npmReader(deps, cookie, [context.package, ...context.basePackage ? [context.basePackage] : []])
     if (!reader || reader.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
     const kept = npmVersionStore(deps.db, deps.config.debug)
     const read = (pkg: string, spec: string) => readNpmVersion(pkg, spec, canReadPrivateNpm(reader, pkg), controller.signal, kept)
@@ -2791,7 +2875,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
     }
     const limit = change?.action === 'publish' && change.final && change.final.status !== 'reject'
       ? await npmReviewPublicationLimit(deps, reader, doc, controller.signal) : 'accept'
-    const current = await npmReader(deps, cookie)
+    const current = await npmReader(deps, cookie, [doc, base].flatMap(item => item?.private ? [item.name] : []))
     if (!current || current.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
     if ([doc, base].some(item => item?.private && !canReadPrivateNpm(current, item.name))) { sendJson(res, 404, { error: 'package-not-found' }); return }
     if (!change) {
@@ -2817,7 +2901,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   } finally { res.off('close', onClose) }
 }
 
-// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only}. Only readers with private access
+// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only,risk,comparison}. Only readers with private access
 // (canReadPrivateNpm) can be answered from the server's npm token; the rest get
 // what the registry answers anonymously, every time (see npm-packages.ts).
 // Access is checked again after the registry's answer.
@@ -2827,14 +2911,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   // All but the package's own (its versions, figures and advisories) are a version's.
   const versioned = path !== NPM_VERSIONS_PATH && path !== NPM_STATS_PATH && path !== NPM_ADVISORIES_PATH
   const otherSpec = params.get('otherVersion') ?? ''
-  if (!isNpmPackageName(name) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
+  // The package a comparison's other side is a version of, another where Review compares a dependency replaced.
+  const otherName = path === NPM_COMPARISON_PATH ? params.get('otherName') ?? name : name
+  if (!isNpmPackageName(name) || !isNpmPackageName(otherName) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
     || (path === NPM_PRETTY_PATH && otherSpec !== '' && !isNpmPackageSpec(otherSpec))
-    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
+    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))
+    || (path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
     sendJson(res, 400, { error: 'bad-package' }); return
   }
   const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
   if (path === NPM_RENAME_DIFF_PATH && params.has('path') && !diffed) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const reader = await npmReader(deps, cookie)
+  const reader = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
   if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
@@ -2842,7 +2929,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   // A reader who lost their session, or their private access to an answer
   // that needed it, while the registry was asked gets nothing.
   const recheck = async (isPrivate: boolean) => {
-    const current = await npmReader(deps, cookie)
+    const current = await npmReader(deps, cookie, isPrivate ? [name] : [])
     if (current == null) { sendJson(res, 401, { error: 'unauthenticated' }); return false }
     if (isPrivate && !canReadPrivateNpm(current, name)) { sendJson(res, 404, { error: 'package-not-found' }); return false }
     return !res.destroyed
@@ -2933,6 +3020,28 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       return
     }
     if (path === NPM_PROVENANCE_PATH) { await reply(doc.private, { name, version: doc.version, provenance: await provenanceOf() }); return }
+    // Its files paired with those of `otherVersion` (of `otherName`, else the
+    // same package), as Compare and Review pair them, with what their
+    // Overview reads beside them (comparison.ts): the version shown against
+    // the one compared with, or `(empty)`, none, as Review reads a first
+    // version. Read of both, each package's access checked again once worked out.
+    if (path === NPM_COMPARISON_PATH) {
+      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
+      let body
+      try {
+        const [files, oldFiles] = await Promise.all(loads.map(load => load.result))
+        body = await comparisonBody(old ? npmComparedSide(old.dist.integrity, oldFiles!) : emptySide(), npmComparedSide(doc.dist.integrity, files!))
+      } finally { for (const load of loads) load.release() }
+      const current = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
+      if (current == null) { body.stream.destroy(); sendJson(res, 401, { error: 'unauthenticated' }); return }
+      if ((doc.private && !canReadPrivateNpm(current, name)) || (old?.private && !canReadPrivateNpm(current, otherName))) {
+        body.stream.destroy(); sendJson(res, 404, { error: 'package-not-found' }); return
+      }
+      if (!res.destroyed) await sendEncoded(req, res, body, 'application/json')
+      return
+    }
     // Every one of its files that needs it pretty-printed (pretty-print.ts
     // npmAll), or, against another version, the files that changed between
     // them, both sides' (compared), a line each as it is formatted, or found
@@ -2963,7 +3072,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       if (!(await recheck(isPrivate))) return
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       await sendLines(res, lines, async () => {
-        const current = await npmReader(deps, cookie)
+        const current = await npmReader(deps, cookie, isPrivate ? [name] : [])
         return current != null && (!isPrivate || canReadPrivateNpm(current, name))
       })
       return
@@ -3073,13 +3182,16 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
 
     // Public mode probe — lets a client detect the managed protocol up front.
+    // It also sends the session, sparing the client's GET /api/auth/session;
+    // a failed read leaves that request to the client, never failing the probe.
     if (path === CONFIG_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
+      const current = await currentSession(config, db, cookie).catch((err) => { console.warn('managed: config session read failed:', err); return null })
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
         managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
           uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
-        } : {}) } })
+        } : {}) }, ...(current ? { session: current.body } : {}) }, current?.headers)
       return
     }
     if (viewing && underPrefix(path, VIEW_PREFIXES) && !viewAllows(method, path)) { sendViewOnly(res); return }
@@ -3122,22 +3234,11 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
       res.end(); return
     }
-    // Who am I? While an admin views as another user, that user, plus the
-    // admin as `viewer`. A view that has ended (with the admin's session or
-    // role, or the viewed account) is cleared, returning to the own session.
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const now = Date.now()
-      let s = await readSession(config, db, cookie, now)
-      const ended = s == null && viewing
-      if (ended) s = await readSession(config, db, cookie, now, { own: true })
-      const headers: Record<string, string> = ended ? { 'set-cookie': clearViewCookie(config) } : {}
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
-      sendJson(res, 200, {
-        user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
-        csrfToken: s.session.csrfToken,
-        ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
-      }, headers)
+      const { body, headers } = await currentSession(config, db, cookie)
+      if (body == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
+      sendJson(res, 200, body, headers)
       return
     }
     if (path === VIEW_AS_PATH) { await handleViewAs(req, res, deps, cookie); return }
@@ -3265,9 +3366,13 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true', url.searchParams.get('details') === 'true')
       return
     }
-    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only)$/iu.exec(path)
+    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only|comparison)$/iu.exec(path)
     if (bundleRead) {
       const id = bundleRead[1]!, part = bundleRead[2]!, { session } = workspaceSession!, { bundleCache, prettyCache } = deps
+      if (part === 'comparison') {
+        if (method !== 'GET') { send405(res, 'GET'); return }
+        await handleBundleComparison(req, res, deps, session, id, url.searchParams); return
+      }
       if (part === 'rename-diff' || part === 'type-only' || (part === 'pretty' && url.searchParams.has('other'))) {
         if (method !== 'GET') { send405(res, 'GET'); return }
         if (part === 'rename-diff' && url.searchParams.has('path')) { await handleBundleRenameDiff(req, res, deps, session, id, url.searchParams); return }

package/server-managed/locked-packages.ts

@@ -1,7 +1,8 @@
 // The packages a lockfile of npm's ecosystem locks, as @preventive/lockfile
 // reads package-lock.json and npm-shrinkwrap.json of `lockfileVersion: 3`,
 // pnpm-lock.yaml of pnpm 9 to 12 and Yarn 1's yarn.lock, each with where it
-// is installed from (repository-risk.ts).
+// is installed from and whether only devDependencies need it
+// (repository-risk.ts).
 import { LockfileError, parseNpmLockfile } from '@preventive/lockfile/npm.js'
 import { parsePnpmLockfile } from '@preventive/lockfile/pnpm.js'
 import { parseYarn1Lockfile } from '@preventive/lockfile/yarn1.js'
@@ -21,6 +22,11 @@ export interface LockedPackage {
   // A mirror's tarball's, as the lockfile has it: npm's package of its name
   // and version only where npm's integrity is among it.
   integrity?: string
+  // Where only the importers' devDependencies reach it, as npm's `dev` flag
+  // says, and an install of no devDependencies leaves it out: in npm's and
+  // pnpm's lockfiles. Yarn 1's says nothing of it, which only the
+  // package.json files do, and none of its are.
+  dev?: true
 }
 
 // A package as each reader resolves one, its name the one it is published
@@ -29,7 +35,7 @@ type Resolution =
   | { type: 'tarball'; tarball: string | undefined; integrity: string | undefined; gitHosted?: boolean }
   | { type: 'git'; repo: string }
   | { type: 'directory' }
-interface ReadPackage { name: string; version: string | undefined; resolution: Resolution | undefined }
+interface ReadPackage { name: string; version: string | undefined; resolution: Resolution | undefined; dev?: boolean | undefined }
 
 // The packages of a lockfile of `format`, as its reader resolves them.
 // Versions go unchecked against ranges, as only what is locked is asked for.
@@ -72,14 +78,31 @@ function locked({ name, version, resolution }: ReadPackage): LockedPackage | nul
 }
 
 // The packages a lockfile of `format` (npm, pnpm or yarn, as
-// findRepoLockfiles names them) locks, each once, in the lockfile's order.
-// Throws the reader's LockfileError or YamlError for one it refuses.
+// findRepoLockfiles names them) locks, each once, in the lockfile's order:
+// `dev` only where it is wherever it is installed, at each path of npm's
+// tree, and with each of pnpm's peers. Throws the reader's LockfileError or
+// YamlError for one it refuses.
 export function lockedPackages(format: LockfileFormat, text: string): LockedPackage[] {
   const found = new Map<string, LockedPackage>()
   for (const pkg of packagesOf(format, text)) {
     const one = locked(pkg)
-    const key = one && `${one.source}\0${one.name}@${one.version ?? ''}\0${one.from ?? ''}\0${one.integrity ?? ''}`
-    if (one && key && !found.has(key)) found.set(key, one)
+    if (!one) continue
+    if (pkg.dev === true) one.dev = true
+    const key = `${one.source}\0${one.name}@${one.version ?? ''}\0${one.from ?? ''}\0${one.integrity ?? ''}`
+    const had = found.get(key)
+    if (!had) found.set(key, one)
+    else if (had.dev && !one.dev) delete had.dev
   }
   return [...found.values()]
 }
+
+// Whether a lockfile at `path` is a test's fixture or example: under a
+// directory of tests (`test`, `tests`, `__tests__` and such), in one of
+// fixtures or examples (`fixture`, `fixtures`, `example`, `examples`) inside
+// it, as a test may keep one its readers refuse on purpose.
+const FIXTURES_DIR = /^(?:fixture|example)s?$/u, TESTS_DIR = /^_*tests?_*$/u
+export function isTestFixture(path: string) {
+  const dirs = path.split('/').slice(0, -1)
+  const tests = dirs.findIndex(dir => TESTS_DIR.test(dir))
+  return tests !== -1 && dirs.slice(tests + 1).some(dir => FIXTURES_DIR.test(dir))
+}

package/server-managed/npm-kept.ts

@@ -5,9 +5,10 @@
 // (npm-manifest.ts npmVersionFields), for a day (readNpmVersion asks npm again
 // then, as a version can be deprecated, its package made private, or itself
 // removed); and, for scans, each package's risk line, for as long as a scan
-// keeps it (repository-risk.ts). Each store removes its own rows kept longer
-// than that as it writes, at most once an hour a database, so that rows no
-// read will take again don't pile up.
+// keeps it, and what a scan read of GitHub, for a day, and of npm's
+// advisories, for an hour (repository-risk.ts). Each store removes its own rows kept longer
+// than that as it writes, at most once an hour a database (pruneKept), so
+// that rows no read will take again don't pile up.
 // The database is an optimization: a failure reads as a miss, and writes
 // nothing.
 import { createHash } from 'node:crypto'
@@ -18,30 +19,45 @@ import type { UpstreamCacheStore } from './upstream-cache.ts'
 // A value kept by key, as JSON, `at` when it was.
 export interface KeptStore<T> {
   read(key: string): Promise<{ at: number; value: T } | null>
+  // Those of `keys` kept, by key, in one read of the database.
+  readMany(keys: string[]): Promise<Map<string, { at: number; value: T }>>
   write(key: string, value: T, at: number): Promise<void>
 }
 
-// When each database last had each type's old rows removed.
+// When each database last had the rows under each prefix removed.
 const PRUNE_EVERY_MS = 60 * 60_000
 const pruned = new WeakMap<UpstreamCacheStore, Map<string, number>>()
 
+// Removes the rows under `prefix` kept `keptMs` before `at`, at most once an
+// hour a database, as rows under it are written: here, and risk's downloads
+// (npm-risk.ts). A failure is `warn`ed of, and removes nothing.
+export async function pruneKept(db: UpstreamCacheStore, prefix: string, keptMs: number, at: number, warn: (error: unknown) => void) {
+  const times = pruned.get(db) ?? pruned.set(db, new Map()).get(db)!
+  if (at - (times.get(prefix) ?? -Infinity) < PRUNE_EVERY_MS) return
+  times.set(prefix, at)
+  try { await db.deleteUpstreamCacheEntries(prefix, at - keptMs) } catch (error) { warn(error) }
+}
+
 // Values of `type`, each read for `keptMs` after it was kept.
 function keptStore<T>(db: UpstreamCacheStore, type: string, keptMs: number, debug: boolean): KeptStore<T> {
   const warn = (what: string, error: unknown) => { if (debug) console.warn(`managed: kept ${type} ${what} failed:`, error) }
-  const prune = async (at: number) => {
-    const times = pruned.get(db) ?? pruned.set(db, new Map()).get(db)!
-    if (at - (times.get(type) ?? -Infinity) < PRUNE_EVERY_MS) return
-    times.set(type, at)
-    try { await db.deleteUpstreamCacheEntries(`${type}/`, at - keptMs) } catch (error) { warn('prune', error) }
-  }
+  // Kept for good (Infinity): none removed.
+  const prune = (at: number) => keptMs === Infinity ? Promise.resolve() : pruneKept(db, `${type}/`, keptMs, at, error => { warn('prune', error) })
   // Keys of any length or character, as the database's: hashed.
   const keyOf = (key: string) => `${type}/${createHash('sha256').update(key).digest('hex')}`
+  const valueOf = (row: string | null | undefined) => {
+    const kept: unknown = JSON.parse(row ?? 'null')
+    return plainObject(kept) && typeof kept['at'] === 'number' && 'value' in kept ? { at: kept['at'], value: kept['value'] as T } : null
+  }
   return {
     async read(key) {
+      try { return valueOf(await db.getUpstreamCacheEntry(keyOf(key))) } catch (error) { warn('read', error); return null }
+    },
+    async readMany(keys) {
       try {
-        const kept: unknown = JSON.parse(await db.getUpstreamCacheEntry(keyOf(key)) ?? 'null')
-        return plainObject(kept) && typeof kept['at'] === 'number' && 'value' in kept ? { at: kept['at'], value: kept['value'] as T } : null
-      } catch (error) { warn('read', error); return null }
+        const rows = await db.getUpstreamCacheEntries(keys.map(keyOf))
+        return new Map(keys.flatMap(key => { const kept = valueOf(rows.get(keyOf(key))); return kept ? [[key, kept] as const] : [] }))
+      } catch (error) { warn('read', error); return new Map() }
     },
     async write(key, value, at) {
       try { await db.setUpstreamCacheEntry(keyOf(key), JSON.stringify({ at, value }), at) } catch (error) { warn('write', error) }
@@ -61,5 +77,13 @@ export function npmVersionStore(db: UpstreamCacheStore, debug = false): NpmVersi
   }
 }
 
-// Risk lines, each read for `keptMs`, as long as a scan keeps them.
+// Risk lines, each kept `keptMs`, for good where Infinity, a scan telling one
+// past RISK_KEPT_MS as stale (repository-risk.ts).
 export const riskLineStore = <T>(db: UpstreamCacheStore, keptMs: number, debug = false): KeptStore<T> => keptStore<T>(db, 'repository-risk/lines', keptMs, debug)
+// What a scan read, each read for keptMs (repository-risk.ts): of GitHub, a
+// repository's lockfiles as listed at a commit (`listings`) and a lockfile's
+// packages by its blob (`lockfiles`), for SCAN_READ_KEPT_MS; of npm, a
+// lockfile's advisories by its blob (`advisories`), for RISK_KEPT_MS; and the
+// repositories a scan in parts told whole (`progress`).
+export const scanReadStore = <T>(db: UpstreamCacheStore, type: 'listings' | 'lockfiles' | 'advisories' | 'progress', keptMs: number, debug = false): KeptStore<T> =>
+  keptStore<T>(db, `repository-risk/${type}`, keptMs, debug)