@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.44

package/server-managed/team-app.ts

@@ -4,6 +4,11 @@
 // loads. Results are keyed by the catalog's own content keys: an unchanged
 // catalog reuses them, and every change that can move a result also changes
 // the catalog revision that clients refresh on.
+//
+// The same read names the reports a restricted reader would find nothing in:
+// under -deps or -security the catalog leaves those out of the team's list.
+// Readers with both permissions keep every report, empty or not.
+import { reportEntries } from '@preventive/report'
 import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot, UserTeam } from './db.ts'
@@ -11,12 +16,14 @@ import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { TeamReportsError, loadTeamReportsResponse } from './team-reports.ts'
 
 export type { TeamAppMetadata }
+export interface TeamWorkspaceSummary { app: TeamAppMetadata; empty: readonly string[] }
+const NO_APP: TeamWorkspaceSummary = { app: { appMode: false }, empty: [] }
 
 const CACHE_MAX_ENTRIES = 4096
 // Each workspace build already reads four reports at a time.
 const CLASSIFY_CONCURRENCY = 2
-const caches = new WeakMap<ManagedDb, Map<string, TeamAppMetadata>>()
-const pendingJobs = new WeakMap<ManagedDb, Map<string, Promise<TeamAppMetadata | null>>>()
+const caches = new WeakMap<ManagedDb, Map<string, TeamWorkspaceSummary>>()
+const pendingJobs = new WeakMap<ManagedDb, Map<string, Promise<TeamWorkspaceSummary | null>>>()
 
 // Published reports with their content keys, and the team's own key (access,
 // scopes and links). Equal keys describe the same filtered workspace, whoever
@@ -29,28 +36,36 @@ function published(team: UserTeam) {
   return team.reports.filter(report => report.visible !== false)
 }
 
-function remember(db: ManagedDb, key: string, app: TeamAppMetadata): TeamAppMetadata {
+function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): TeamWorkspaceSummary {
   let cache = caches.get(db)
   if (!cache) { cache = new Map(); caches.set(db, cache) }
   cache.delete(key)
-  cache.set(key, app)
+  cache.set(key, summary)
   for (const oldest of cache.keys()) {
     if (cache.size <= CACHE_MAX_ENTRIES) break
     cache.delete(oldest)
   }
-  return app
+  return summary
+}
+
+// A links document counts by its links, every other report by its findings.
+function hasContent(data: unknown): boolean {
+  const record = data as { source?: unknown; links?: unknown } | null
+  if (record?.source === 'links' && Array.isArray(record.links)) return record.links.length > 0
+  return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
 }
 
 // Null when the team cannot be classified right now: its catalog went stale,
 // the access snapshot is gone, or storage failed. The sidebar then keeps the
-// team expanded, and a later catalog asks again. Oversized and unreadable
-// workspaces never have an App view, so they are remembered as such.
+// team expanded and lists every report, and a later catalog asks again.
+// Oversized and unreadable workspaces never have an App view, so they are
+// remembered as such, hiding nothing.
 async function classify(db: ManagedDb, store: BlobStore, key: string, team: UserTeam,
-  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamAppMetadata | null> {
+  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamWorkspaceSummary | null> {
   const cached = caches.get(db)?.get(key)
   if (cached) return remember(db, key, cached)
   const ids = new Set(published(team).map(report => report.id))
-  if (ids.size === 0) return remember(db, key, { appMode: false })
+  if (ids.size === 0) return remember(db, key, NO_APP)
   let jobs = pendingJobs.get(db)
   if (!jobs) { jobs = new Map(); pendingJobs.set(db, jobs) }
   const existing = jobs.get(key)
@@ -60,11 +75,13 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
     // A catalog read before a concurrent publication names another report set.
     if (!access?.teamId || access.reports.length !== ids.size || access.reports.some(report => !ids.has(report.id))) return null
     const body = JSON.parse((await loadTeamReportsResponse(db, store, access)).toString('utf8')) as {
-      reports: { filename: string; data: unknown }[]; links?: string[][]
+      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]
     }
-    return remember(db, key, managedTeamAppMetadata(Object.assign(body.reports, { links: body.links ?? [] })))
+    const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
+    const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
+    return remember(db, key, { app: managedTeamAppMetadata(Object.assign(body.reports, { links: body.links ?? [] })), empty })
   })().catch((error: unknown) => {
-    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, { appMode: false })
+    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
     if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)
     return null
   })
@@ -72,10 +89,17 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
   try { return await job } finally { jobs.delete(key) }
 }
 
+// The catalog's view of a classified team: its App classification, and its
+// reports without the ones its restricted reader would find empty.
+export function withWorkspaceSummary<T extends { reports: readonly { id: string }[] }>(team: T, summary: TeamWorkspaceSummary | null | undefined) {
+  const empty = new Set(summary?.empty)
+  return { ...team, app: summary?.app ?? null, reports: team.reports.filter(report => !empty.has(report.id)) }
+}
+
 // Classify a user's catalog, keyed by teamAppKey. `known` carries results from
 // an earlier read of the same request, so only changed teams are classified.
 export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId: string, teams: readonly UserTeam[],
-  known: ReadonlyMap<string, TeamAppMetadata | null> = new Map()): Promise<Map<string, TeamAppMetadata | null>> {
+  known: ReadonlyMap<string, TeamWorkspaceSummary | null> = new Map()): Promise<Map<string, TeamWorkspaceSummary | null>> {
   const states = new Map(known)
   const missing = [...new Map(teams.map(team => [teamAppKey(team), team])).entries()].filter(([key]) => !states.has(key))
   let next = 0
@@ -89,6 +113,6 @@ export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId:
 }
 
 // A public link's workspace is its own access snapshot.
-export function sharedTeamApp(db: ManagedDb, store: BlobStore, snapshot: WorkspaceShareSnapshot): Promise<TeamAppMetadata | null> {
+export function sharedTeamApp(db: ManagedDb, store: BlobStore, snapshot: WorkspaceShareSnapshot): Promise<TeamWorkspaceSummary | null> {
   return classify(db, store, JSON.stringify(['share', teamAppKey(snapshot.team)]), snapshot.team, () => Promise.resolve(snapshot))
 }