@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/db-methods.ts

@@ -1,7 +1,9 @@
 import { type LinkReportStore, linkReportMethods, linkRevision } from './link-reports.ts'
 import { type RepositoryAliasStore, repositoryAliasMethods } from './repository-aliases.ts'
 import { type DependencyReviewStore, dependencyReviewMethods } from './dependency-reviews.ts'
+import { type RepositoryDependencyReviewStore, repositoryDependencyReviewMethods } from './repository-dependency-reviews.ts'
 import { type TeamNpmScopeStore, teamNpmScopeMethods } from './team-npm-scopes.ts'
+import { type GithubLinkStore, githubLinkMethods } from './github-links.ts'
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
 import { type Role, roleAtLeast } from '../common/managed/roles.ts'
@@ -358,21 +360,26 @@ export interface UserTeam {
   dependencyReview?: boolean
   permissions: TeamUserPermissions
   cacheKey?: string
+  // The team's repository links, by name: its Repositories, whether or not
+  // anything is attached to them yet.
+  repos: TeamRepoLink[]
   reports: UserTeamReport[]
   bundles: UserTeamBundle[]
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends DependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore {
+export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore, GithubLinkStore {
   claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
   finishMaintenanceLease(owner: string, until: number): Promise<void>
   getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
   // Reuse connections within a finite request or one feed polling iteration.
   withRequest?<T>(work: () => Promise<T>): Promise<T>
-  // Upsert the identity; returns the user's opaque id (stable across logins).
+  // Upsert the identity; returns the user's opaque id (stable across logins),
+  // or null for an account linked to a user (github-links.ts), which neither
+  // signs in nor registers. A name chosen from a linked account is kept.
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
-  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string>
+  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string | null>
   createSession(session: ManagedSession, now: number): Promise<void>
   // A sign-in session; never a view session, so a view token in the session
   // cookie authenticates nothing.
@@ -563,12 +570,14 @@ function prepareStatements(db: ManagedSql) {
     // Identity refreshes preserve roles. Login can separately bootstrap the
     // configured sole No access user within this same writer transaction.
     upsertUserStmt: db.prepare(
-      `INSERT INTO managed_user (id, github_user_id, login, name, avatar_url, role, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, 'none', ?, ?)
+      `INSERT INTO managed_user (id, github_user_id, login, name, github_name, avatar_url, role, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, 'none', ?, ?)
        ON CONFLICT(github_user_id) DO UPDATE SET
-         login = excluded.login, name = excluded.name,
+         login = excluded.login, github_name = excluded.github_name,
+         name = CASE WHEN managed_user.name_link IS NULL THEN excluded.name ELSE managed_user.name END,
          avatar_url = excluded.avatar_url, updated_at = excluded.updated_at`,
     ),
+    selectLinkedStmt: db.prepare(`SELECT 1 AS linked FROM managed_github_link WHERE github_user_id = ?`),
     selectUserIdStmt: db.prepare(`SELECT id, role FROM managed_user WHERE github_user_id = ?`),
     promoteInitialAdminStmt: db.prepare(
       `UPDATE managed_user SET role = 'admin' WHERE id = ? AND role = 'none'
@@ -910,10 +919,15 @@ function prepareStatements(db: ManagedSql) {
     renameTeamStmt: db.prepare(`UPDATE managed_team SET name = ?, updated_at = ? WHERE id = ?`),
     setTeamHiddenStmt: db.prepare(`UPDATE managed_team SET hidden = ?, updated_at = ? WHERE id = ?`),
     selectTeamsStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team ORDER BY name ASC`),
+    // `dependencyReview` where the user reviews dependencies in the team
+    // (dependency-reviews.ts reviewsIn): one that reviews them, and a member
+    // who manages, or triages and may see its dependencies; an admin in any.
     selectTeamsForUserStmt: db.prepare(
-      `SELECT t.id AS id, t.slug AS slug, t.name AS name, t.dependency_review AS dependencyReview,
+      `SELECT t.id AS id, t.slug AS slug, t.name AS name,
+              CASE WHEN t.dependency_review = 1 AND (u.role IN ('admin', 'manage') OR (u.role = 'triage' AND tu.view_dependencies = 1))
+                THEN 1 ELSE 0 END AS dependencyReview,
               tu.view_dependencies AS dependencies, tu.view_security AS security
-         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
+         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id JOIN managed_user u ON u.id = tu.user_id
         WHERE tu.user_id = ? AND t.hidden = 0 ORDER BY t.name ASC, t.id ASC`,
     ),
     selectUserTeamScopesStmt: db.prepare(
@@ -1513,6 +1527,8 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
         cacheKey: createHash('sha256').update(JSON.stringify([
           t.dependencies, t.security, links, scopes.filter(scope => scope.teamId === t.id),
         ])).digest('base64url'),
+        repos: scopes.filter(scope => scope.teamId === t.id).map(scope => ({ repoId: scope.repoId, fullName: scope.fullName, path: scope.path || null }))
+          .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
         reports: reportsByTeam.get(t.id) ?? [],
         bundles: bundlesByTeam.get(t.id) ?? [],
       }))
@@ -1597,7 +1613,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
-    upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
+    upsertUserStmt, selectLinkedStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, ensureUploadKeyStmt, deleteSessionStmt, deleteExpiredStmt,
     selectViewSessionStmt, deleteOtherViewsStmt, insertViewSessionStmt, deleteDemotedViewsStmt,
   } = stmts
@@ -1607,7 +1623,9 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...linkReportMethods(db, key),
     ...repositoryAliasMethods(db),
     ...teamNpmScopeMethods(db),
+    ...githubLinkMethods(db),
     ...dependencyReviewMethods(db),
+    ...repositoryDependencyReviewMethods(db),
     ...bundleBuildLeaseMethods(db),
     ...upstreamCacheMethods(db),
     async claimMaintenanceLease(owner, now, until, migration = false) {
@@ -1619,9 +1637,10 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       await db.prepare('UPDATE managed_maintenance_lease SET expires_at = ? WHERE owner = ?').run(until, owner)
     },
     async upsertUser(user, now, initialAdminGithubId = null) {
+      if (await selectLinkedStmt.get(user.githubUserId)) return null
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
-      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.avatarUrl, now, now)
+      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.name, user.avatarUrl, now, now)
       const row = (await selectUserIdStmt.get(user.githubUserId)) as { id: string; role: Role }
       // Avoid the population check unless this login matches the configured
       // identity and still needs approval. NOT EXISTS stops at any other user.

package/server-managed/db-neon.ts

@@ -2,6 +2,8 @@ import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA, GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
@@ -36,7 +38,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 27 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 30 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -142,6 +144,31 @@ async function migrateDependencyReviews(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (27)')
 }
 
+// Existing names are the sign-in accounts' own: none was chosen yet.
+async function migrateGithubLinks(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 28')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_LINK_SCHEMA))
+  await db.query(`ALTER TABLE managed_user ${GITHUB_LINK_USER_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('UPDATE managed_user SET github_name = name')
+  await db.query('INSERT INTO managed_schema_version VALUES (28)')
+}
+
+async function migrateRepositoryDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 29')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (29)')
+}
+
+// The lockfiles a repository's dependency review holds to, its columns
+// added since 29 added there too; and a team's published reviews, listed by
+// it, indexed so.
+async function migrateRepositoryDependencyReviewLockfiles(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 30')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id)')
+  await db.query('INSERT INTO managed_schema_version VALUES (30)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -215,7 +242,8 @@ async function initialize(db: PgConnection): Promise<void> {
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews]) await migrate(db)
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
+      migrateRepositoryDependencyReviewLockfiles]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')

package/server-managed/db-schema.ts

@@ -3,6 +3,7 @@ import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA } from './github-links.ts'
 
 // Created after the column migration, which predates it on older databases.
 export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
@@ -64,7 +65,13 @@ CREATE TABLE IF NOT EXISTS managed_selected_repo (
   added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   added_at        INTEGER NOT NULL,
   updated_at      INTEGER NOT NULL,
-  active          INTEGER NOT NULL DEFAULT 1
+  active          INTEGER NOT NULL DEFAULT 1,
+  -- Its pull requests' dependencies reviewed (repository-dependency-reviews.ts):
+  -- as many published reviews required of each version, and the commit at
+  -- whose lockfiles' versions none is (null for none).
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  dependency_reviews_required INTEGER NOT NULL DEFAULT 1,
+  dependency_review_since TEXT
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS selected_repo_full_name_idx ON managed_selected_repo(full_name);
@@ -224,4 +231,4 @@ CREATE TABLE IF NOT EXISTS managed_team_user (
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
-` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA + GITHUB_LINK_SCHEMA

package/server-managed/db.ts

@@ -8,6 +8,8 @@ import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -79,6 +81,10 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
       ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     }
     ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    // Existing names are the sign-in accounts' own: none was chosen yet.
+    for (const [column, type] of GITHUB_LINK_USER_COLUMNS) {
+      if (ensureColumn(db, 'managed_user', column, type) && column === 'github_name') db.exec('UPDATE managed_user SET github_name = name')
+    }
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.
@@ -116,6 +122,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
+    for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')

package/server-managed/dependabot-access.ts

@@ -0,0 +1,60 @@
+// A repository's Dependabot alerts for a repository risk scan, read with the
+// App's installation token where the admin's own access lets them see them on
+// GitHub, as the README's repository risk section tells.
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'
+import { GithubApiError, type GithubIdentity, githubRepoPermission, repoAccessToken, repositoryInstallation } from './github-app.ts'
+
+// The levels GitHub lets see a repository's Dependabot alerts by default
+// (maintain's reads `write`).
+const SEES_ALERTS: ReadonlySet<string> = new Set(['admin', 'write'])
+// Failures of verifying the sign-in that are the sign-in's own: no token, or
+// one of another account (repository-browser.ts getIdentity), or one GitHub no
+// longer takes. Any other, as GitHub failing to answer, is told as it is.
+const UNVERIFIED: ReadonlySet<string> = new Set(['no-repository', 'github-unauthorized'])
+
+// What of a repository's reader (repository-browser.ts) the alerts are asked
+// with: the user's verified identity, and their permission level where its
+// access gate asked GitHub of it already.
+export interface AlertsReader {
+  identity(): Promise<GithubIdentity>
+  permission(): string | null
+}
+
+// Alerts read, and their `recheck`: the user's access to them checked again,
+// asked of GitHub afresh, just before they are told (repository-risk.ts), as
+// access to the repository is, as it may be withdrawn meanwhile.
+export interface AlertsRead { alerts: DependabotAlert[]; recheck(): Promise<void> }
+
+// `repo`'s Dependabot alerts (dependabot-alerts.ts), read with the token of
+// the App's installation GitHub tells covers it now, its token checked to read
+// it (github-app.ts repositoryInstallation), never the one its connection
+// keeps, which may no longer cover it, once the user's own permission on it
+// lets them see them; else refused, the alerts not asked:
+// `dependabot-not-installed`, `dependabot-unverified`, or
+// `dependabot-forbidden`, naming their permission. The token is asked each
+// time of repoAccessToken, which renews it before it expires, as the recheck
+// may come long after the alerts are read.
+export async function appDependabotAlerts(config: ManagedConfig, repo: Pick<SelectedRepo, 'repoId' | 'fullName'>, reader: AlertsReader,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AlertsRead> {
+  const id = await repositoryInstallation(config, repo.repoId, repo.fullName, fetchImpl)
+  const tokenNow = async () => {
+    const token = await repoAccessToken(config, id, fetchImpl)
+    if (token == null) throw new GithubApiError(403, 'dependabot-not-installed')
+    return token
+  }
+  const token = await tokenNow()
+  let who
+  try { who = await reader.identity() } catch (error) {
+    throw error instanceof GithubApiError && UNVERIFIED.has(error.message) ? new GithubApiError(403, 'dependabot-unverified') : error
+  }
+  const seen = (permission: string) => {
+    if (!SEES_ALERTS.has(permission)) {
+      throw new GithubApiError(403, 'dependabot-forbidden', null, `@${who.login}'s access to this repository (${permission}) doesn't let them see its Dependabot alerts on GitHub`)
+    }
+  }
+  seen(reader.permission() ?? await githubRepoPermission(repo.fullName, token, who, fetchImpl))
+  const alerts = await dependabotAlerts(repo.fullName, token, fetchImpl)
+  return { alerts, recheck: async () => { seen(await githubRepoPermission(repo.fullName, await tokenNow(), who, fetchImpl)) } }
+}

package/server-managed/dependabot-alerts.ts

@@ -0,0 +1,185 @@
+// A repository's Dependabot alerts of npm's ecosystem, open or dismissed, as a
+// repository risk scan blends them into npm's advisories (repository-risk.ts),
+// a dismissed one with who dismissed it, when and why: GitHub's
+// `GET /repos/:repo/dependabot/alerts`, a page of 100 at a time, each found by
+// the cursor the one before's Link header names, MAX_PAGES at most. Asked with
+// the App's installation token, once the admin's own access to the repository
+// is found to let them see the alerts on GitHub (dependabot-access.ts): where
+// the installation hasn't Dependabot alerts: read, or the repository has them
+// off, that is thrown as its code, never GitHub's text, for the scan to tell
+// and go on.
+import { isExactVersion, satisfies, validRange } from '@preventive/upstream/semver.js'
+import { isNpmPackageName } from '../common/managed/npm-packages.js'
+import { GithubApiError, githubUnreachable, throwGithubResponseError } from './github-errors.ts'
+import type { LockedPackage } from './locked-packages.ts'
+
+// An alert, as GitHub has it: its `number` in its repository and its page
+// there (`url`, built, never fetched), the manifest or lockfile it is of
+// (`manifest`, from the repository's root), its package and advisory, the
+// versions it affects as GitHub writes them (`range`, `>= 1.0.0, < 1.2.6`)
+// and the first that isn't (`patched`), `dev` where GitHub tells the
+// dependency is only for development, and `dismissed` where it is: by whom,
+// when, why and what they said, or by one of the repository's rules (`auto`).
+export interface DependabotAlert {
+  number: number
+  url: string
+  manifest: string
+  name: string
+  ghsa: string
+  // The advisory's other ids, as its CVE.
+  aliases: string[]
+  title?: string
+  // `critical`, `high`, `moderate`, `low`: GitHub's `medium` reads `moderate`.
+  severity?: string
+  range?: string
+  patched?: string
+  cwe: string[]
+  dev?: true
+  dismissed?: AlertDismissal
+}
+
+// GitHub's `dismissed_reason`: `fix_started`, `inaccurate`, `no_bandwidth`,
+// `not_used` or `tolerable_risk`; `at` as GitHub writes it (ISO 8601).
+export interface AlertDismissal { auto?: true; reason?: string; at?: string; by?: string; comment?: string }
+
+const API = 'https://api.github.com'
+const API_VERSION = '2022-11-28'
+const USER_AGENT = 'deepview-triage'
+const PER_PAGE = 100
+// Up to how many pages a listing asks: 2,000 alerts of npm's in a repository,
+// past which the rest are left out; where open and dismissed ones are more,
+// the open ones are listed again on their own (dependabotAlerts).
+const MAX_PAGES = 20
+// A page holds each advisory's whole text: given longer than githubJson's.
+const PAGE_TIMEOUT_MS = 20_000
+const GHSA = /^GHSA(?:-[23456789cfghjmpqrvwx]{4}){3}$/u
+const SEVERITIES = new Map([['critical', 'critical'], ['high', 'high'], ['medium', 'moderate'], ['moderate', 'moderate'], ['low', 'low']])
+// A path from a repository's root, as git takes one: no empty, `.` or `..`
+// component, nor a control character.
+const isRepoPath = (path: unknown): path is string => typeof path === 'string' && path.length <= 1024 && !/\p{Cc}/u.test(path)
+  && path.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+
+// The states asked: a fixed alert's dependency is no longer what it was.
+const STATES = ['open', 'dismissed', 'auto_dismissed']
+const REASONS = new Set(['fix_started', 'inaccurate', 'no_bandwidth', 'not_used', 'tolerable_risk'])
+const LOGIN = /^[\dA-Za-z](?:[\dA-Za-z-]{0,38})(?:\[bot\])?$/u
+
+const text = (value: unknown, most = 500) => typeof value === 'string' && value.trim() ? value.trim().slice(0, most) : undefined
+
+// How a dismissed alert was dismissed, as far as GitHub tells it soundly.
+function dismissalOf(state: string, raw: Record<string, any>): AlertDismissal {
+  const at = state === 'auto_dismissed' ? raw['auto_dismissed_at'] : raw['dismissed_at']
+  const when = typeof at === 'string' && at.length <= 40 && !Number.isNaN(Date.parse(at)) ? { at } : {}
+  if (state === 'auto_dismissed') return { auto: true, ...when }
+  const by = raw['dismissed_by']?.login, comment = text(raw['dismissed_comment'], 280), reason = raw['dismissed_reason']
+  return { ...REASONS.has(reason) ? { reason } : {}, ...when, ...typeof by === 'string' && LOGIN.test(by) ? { by } : {}, ...comment === undefined ? {} : { comment } }
+}
+
+// An alert as GitHub answers it, or null for one that isn't an open or
+// dismissed one of npm's, of a package and GHSA npm and GitHub would name.
+function alertOf(fullName: string, raw: unknown): DependabotAlert | null {
+  if (raw == null || typeof raw !== 'object') return null
+  const { number, state, dependency, security_advisory: advisory, security_vulnerability: vulnerability } = raw as Record<string, any>
+  if (!Number.isSafeInteger(number) || number <= 0 || !STATES.includes(state)) return null
+  const ghsa = advisory?.ghsa_id, manifest = dependency?.manifest_path, name = dependency?.package?.name
+  if (dependency?.package?.ecosystem !== 'npm' || !isNpmPackageName(name) || !isRepoPath(manifest) || typeof ghsa !== 'string' || !GHSA.test(ghsa)) return null
+  const severity = SEVERITIES.get(vulnerability?.severity ?? advisory?.severity)
+  const patched = text(vulnerability?.first_patched_version?.identifier, 100), range = text(vulnerability?.vulnerable_version_range, 200), title = text(advisory?.summary)
+  const ids = Array.isArray(advisory?.identifiers) ? advisory.identifiers as { value?: unknown }[] : []
+  const cwes = Array.isArray(advisory?.cwes) ? advisory.cwes as { cwe_id?: unknown }[] : []
+  return {
+    number, url: `https://github.com/${fullName.split('/').map(encodeURIComponent).join('/')}/security/dependabot/${number}`, manifest, name, ghsa,
+    aliases: [...new Set(ids.flatMap(id => typeof id?.value === 'string' && /^[\w.:-]{1,64}$/u.test(id.value) && id.value !== ghsa ? [id.value] : []))],
+    ...title === undefined ? {} : { title }, ...severity === undefined ? {} : { severity },
+    ...range === undefined ? {} : { range }, ...patched === undefined ? {} : { patched },
+    cwe: [...new Set(cwes.flatMap(cwe => typeof cwe?.cwe_id === 'string' && /^CWE-\d{1,6}$/u.test(cwe.cwe_id) ? [cwe.cwe_id] : []))],
+    ...dependency.scope === 'development' ? { dev: true as const } : {},
+    ...state === 'open' ? {} : { dismissed: dismissalOf(state, raw as Record<string, any>) },
+  }
+}
+
+// The next page's cursor, as the Link header's `next` names it: its `after`,
+// or its `page`, all that is taken of it, the rest of its URL left as asked.
+function nextPage(link: string | null): [string, string] | null {
+  const next = link?.split(',').map(part => /^\s*<([^>]*)>\s*;\s*rel="next"\s*$/u.exec(part)?.[1]).find(Boolean)
+  if (!next) return null
+  let url
+  try { url = new URL(next) } catch { return null }
+  if (url.origin !== API) return null
+  const after = url.searchParams.get('after'), page = url.searchParams.get('page')
+  return after ? ['after', after] : page && /^\d{1,4}$/u.test(page) ? ['page', page] : null
+}
+
+// A page asked of GitHub: its alerts and the headers they came with. A 403
+// that isn't a rate limit is told as the alerts being off
+// (`dependabot-disabled`) or not to be read by the App's installation
+// (`dependabot-app-permission`), as a 404 is, the repository found just
+// before; the rest as githubJson tells them.
+async function askPage(url: string, token: string, fetchImpl: typeof fetch): Promise<{ alerts: unknown[]; link: string | null }> {
+  const started = Date.now()
+  let res: Response
+  try {
+    res = await fetchImpl(url, {
+      signal: AbortSignal.timeout(PAGE_TIMEOUT_MS), redirect: 'error',
+      headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION },
+    })
+  } catch (error) { throw githubUnreachable(error, started) }
+  if (res.status === 403) {
+    const message = (await res.clone().json().catch(() => null) as { message?: unknown } | null)?.message
+    const limited = res.headers.get('x-ratelimit-remaining') === '0' || res.headers.has('retry-after')
+      || (typeof message === 'string' && /rate limit|abuse detection/iu.test(message))
+    if (!limited) throw new GithubApiError(403, typeof message === 'string' && /disabled/iu.test(message) ? 'dependabot-disabled' : 'dependabot-app-permission')
+  }
+  if (res.status === 404) throw new GithubApiError(403, 'dependabot-app-permission')
+  if (!res.ok) await throwGithubResponseError(res)
+  let body
+  try { body = await res.json() } catch (error) {
+    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+  }
+  if (!Array.isArray(body)) throw new GithubApiError(502, 'github-malformed')
+  return { alerts: body, link: res.headers.get('link') }
+}
+
+// `fullName`'s alerts in `states`, MAX_PAGES at most, in GitHub's order (the
+// newest first), and whether that is all of them.
+async function listAlerts(fullName: string, states: readonly string[], token: string, fetchImpl: typeof fetch) {
+  const base = `${API}/repos/${fullName.split('/').map(encodeURIComponent).join('/')}/dependabot/alerts`
+  const alerts: DependabotAlert[] = []
+  const seen = new Set<number>()
+  let cursor: [string, string] | null = null
+  for (let pages = 0; pages < MAX_PAGES; pages++) {
+    const query = new URLSearchParams({ state: states.join(','), ecosystem: 'npm', per_page: String(PER_PAGE), ...cursor ? { [cursor[0]]: cursor[1] } : {} })
+    const answer = await askPage(`${base}?${query}`, token, fetchImpl)
+    for (const raw of answer.alerts) {
+      const alert = alertOf(fullName, raw)
+      if (alert && !seen.has(alert.number)) { seen.add(alert.number); alerts.push(alert) }
+    }
+    cursor = answer.alerts.length === 0 ? null : nextPage(answer.link)
+    if (!cursor) return { alerts, whole: true }
+  }
+  return { alerts, whole: false }
+}
+
+// `fullName`'s Dependabot alerts of npm's ecosystem, open or dismissed, as
+// `token`, the App's installation's (dependabot-access.ts), may see them, in
+// GitHub's order. Asked at once, but where they are more than a listing holds,
+// as newer dismissed ones would leave older open ones out, the open ones are
+// listed again on their own, and the dismissed ones had kept after them.
+export async function dependabotAlerts(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<DependabotAlert[]> {
+  const all = await listAlerts(fullName, STATES, token, fetchImpl)
+  if (all.whole) return all.alerts
+  const open = await listAlerts(fullName, ['open'], token, fetchImpl)
+  const told = new Set(open.alerts.map(alert => alert.number))
+  return [...open.alerts, ...all.alerts.filter(alert => alert.dismissed && !told.has(alert.number))]
+}
+
+// The versions of an alert's package that a lockfile it is of locks
+// (`packages`) and its range covers, GitHub's read as npm's semver reads its
+// own (`>= 1.0.0, < 1.2.6` as `>= 1.0.0 < 1.2.6`); none where it is of no
+// lockfile read, or its range is none semver reads.
+export function alertVersions(alert: Pick<DependabotAlert, 'name' | 'range'>, packages: readonly LockedPackage[] | undefined): string[] {
+  const range = alert.range === undefined ? null : validRange(alert.range.replaceAll(',', ' '))
+  if (!packages || range === null) return []
+  return [...new Set(packages.flatMap(({ name, version, source }) => name === alert.name && (source === 'registry' || source === 'mirror')
+    && isExactVersion(version) && satisfies(version, range) ? [version] : []))]
+}

package/server-managed/dependency-review-comments.ts

@@ -0,0 +1,97 @@
+// The comment a host formats of one's own dependency reviews, for a copy
+// button to give (reviewed-dependencies.ts `formatDependencyReviews`): of each
+// of one's reviews, as their lists and the review page show them
+// (`withFormatted`), and of those of the versions an open pull request adds
+// (`formattedPull`). It is given one's own published reviews alone, never
+// another's, a draft or a revoked one, however it is asked (`formatOwn`, the
+// only caller of the hook); and is told of none where it answers nothing, or
+// fails, which is logged.
+import type { DependencyReview, DependencyReviewStore } from './dependency-reviews.ts'
+import { type AddedPackage, type PullDependencies, eachOf } from './pull-dependencies.ts'
+import type { PublishedReview, RepoReviewState } from './repository-dependency-reviews.ts'
+import type { DependencyReviewEntry, ReviewedDependencies } from './reviewed-dependencies.ts'
+
+const FORMAT_AT_ONCE = 8
+// The longest comment told, past which none is.
+const MAX_FORMATTED = 1_000_000
+// The reviews of a pull request's versions read at once, those past them
+// read after, every one formatted.
+const REVIEWS_AT_ONCE = 200
+
+// `review` as the hook is given it, the version it is of as `locked`, a
+// pull request's lockfile, locks it where it is one's.
+function entryOf(review: DependencyReview, locked?: AddedPackage | undefined): DependencyReviewEntry {
+  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '' },
+    new: { name: review.package, version: review.version, integrity: review.integrity, ...locked?.shasum ? { shasum: locked.shasum } : {},
+      ...locked?.patchHash ? { patchHash: locked.patchHash } : {} },
+    status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
+    files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),
+    reviewer: review.userLogin, publishedAt: review.publishedAt! }
+}
+
+// Whether `review` is `user`'s own, published, not revoked, with its verdict.
+const ownPublished = (review: DependencyReview, user: string) => review.user === user && review.publishedAt !== null && review.revokedAt === null && review.status !== null
+
+// What the host formats of `reviews`, of them `user`'s own published ones
+// alone, and the pull request they are of the versions of, where it is
+// one's; none where it formats none of them.
+async function formatOwn(reviewed: ReviewedDependencies | null, user: string, reviews: { review: DependencyReview; locked?: AddedPackage | undefined }[],
+  pullRequest?: { repository: string; number: number }): Promise<string | null> {
+  const format = reviewed?.formatDependencyReviews
+  const own = reviews.filter(({ review }) => ownPublished(review, user))
+  if (!format || own.length === 0) return null
+  try {
+    const text = await format({ reviews: own.map(({ review, locked }) => entryOf(review, locked)), ...pullRequest ? { pullRequest } : {} })
+    return typeof text === 'string' && text.trim() !== '' && text.length <= MAX_FORMATTED ? text : null
+  } catch (error) {
+    console.warn('reviewed dependencies: failed to format dependency reviews', error instanceof Error ? error.message : error)
+    return null
+  }
+}
+
+// `reviews`, each of `user`'s own with the comment the host formats of it
+// (`formatted`), where it formats one; another's never asked of.
+export function withFormatted<T extends DependencyReview>(reviewed: ReviewedDependencies | null, user: string, reviews: T[]): Promise<(T & { formatted?: string })[]> {
+  if (!reviewed?.formatDependencyReviews) return Promise.resolve(reviews)
+  return eachOf(reviews, FORMAT_AT_ONCE, async review => {
+    const formatted = ownPublished(review, user) ? await formatOwn(reviewed, user, [{ review }]) : null
+    return formatted ? { ...review, formatted } : review
+  })
+}
+
+// Those of `reviews` `user` published of the versions `told` adds, by their
+// ids, with each version as its lockfile locks it: of its version, of an
+// integrity it is locked with and of its patch, whole or compared with a
+// version it was.
+function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: string): Map<string, AddedPackage> {
+  // Theirs by the version they are of, each version probed once.
+  const theirs = new Map<string, PublishedReview[]>()
+  for (const review of reviews) {
+    if (review.id === undefined || review.reviewer !== user) continue
+    const key = `${review.package}@${review.version}`
+    theirs.set(key, [...theirs.get(key) ?? [], review])
+  }
+  const mine = new Map<string, AddedPackage>()
+  if (theirs.size === 0) return mine
+  for (const pkg of told.lockfiles.flatMap(dir => 'added' in dir ? dir.added : [])) {
+    const hashes = new Set((pkg.integrity ?? '').split(/\s+/u).filter(Boolean))
+    for (const review of theirs.get(`${pkg.name}@${pkg.version}`) ?? []) {
+      if (!hashes.has(review.integrity) || (review.patchHash ?? '') !== (pkg.patchHash ?? '')) continue
+      if (review.basePackage === null || (review.basePackage === pkg.name && (pkg.was ?? []).includes(review.baseVersion ?? ''))) mine.set(review.id!, pkg)
+    }
+  }
+  return mine
+}
+
+// The comment the host formats of `user`'s reviews of the versions pull
+// request `number` of `repository` adds (`told`), those its review's state
+// tells of, published to a team counting for it; none where it has none.
+export async function formattedPull(reviewed: ReviewedDependencies | null, db: Pick<DependencyReviewStore, 'listOwnDependencyReviewsById'>, user: string,
+  told: PullDependencies, state: RepoReviewState | null, pullRequest: { repository: string; number: number }): Promise<string | null> {
+  if (!reviewed?.formatDependencyReviews || !state) return null
+  const mine = ownOfPull(told, state.reviews, user)
+  if (mine.size === 0) return null
+  const ids = [...mine.keys()], reviews: DependencyReview[] = []
+  for (let at = 0; at < ids.length; at += REVIEWS_AT_ONCE) reviews.push(...await db.listOwnDependencyReviewsById(user, ids.slice(at, at + REVIEWS_AT_ONCE)))
+  return formatOwn(reviewed, user, reviews.map(review => ({ review, locked: mine.get(review.id) })), pullRequest)
+}