@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.45

package/server-managed/dependabot-access.ts

@@ -0,0 +1,60 @@
+// A repository's Dependabot alerts for a repository risk scan, read with the
+// App's installation token where the admin's own access lets them see them on
+// GitHub, as the README's repository risk section tells.
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'
+import { GithubApiError, type GithubIdentity, githubRepoPermission, repoAccessToken, repositoryInstallation } from './github-app.ts'
+
+// The levels GitHub lets see a repository's Dependabot alerts by default
+// (maintain's reads `write`).
+const SEES_ALERTS: ReadonlySet<string> = new Set(['admin', 'write'])
+// Failures of verifying the sign-in that are the sign-in's own: no token, or
+// one of another account (repository-browser.ts getIdentity), or one GitHub no
+// longer takes. Any other, as GitHub failing to answer, is told as it is.
+const UNVERIFIED: ReadonlySet<string> = new Set(['no-repository', 'github-unauthorized'])
+
+// What of a repository's reader (repository-browser.ts) the alerts are asked
+// with: the user's verified identity, and their permission level where its
+// access gate asked GitHub of it already.
+export interface AlertsReader {
+  identity(): Promise<GithubIdentity>
+  permission(): string | null
+}
+
+// Alerts read, and their `recheck`: the user's access to them checked again,
+// asked of GitHub afresh, just before they are told (repository-risk.ts), as
+// access to the repository is, as it may be withdrawn meanwhile.
+export interface AlertsRead { alerts: DependabotAlert[]; recheck(): Promise<void> }
+
+// `repo`'s Dependabot alerts (dependabot-alerts.ts), read with the token of
+// the App's installation GitHub tells covers it now, its token checked to read
+// it (github-app.ts repositoryInstallation), never the one its connection
+// keeps, which may no longer cover it, once the user's own permission on it
+// lets them see them; else refused, the alerts not asked:
+// `dependabot-not-installed`, `dependabot-unverified`, or
+// `dependabot-forbidden`, naming their permission. The token is asked each
+// time of repoAccessToken, which renews it before it expires, as the recheck
+// may come long after the alerts are read.
+export async function appDependabotAlerts(config: ManagedConfig, repo: Pick<SelectedRepo, 'repoId' | 'fullName'>, reader: AlertsReader,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AlertsRead> {
+  const id = await repositoryInstallation(config, repo.repoId, repo.fullName, fetchImpl)
+  const tokenNow = async () => {
+    const token = await repoAccessToken(config, id, fetchImpl)
+    if (token == null) throw new GithubApiError(403, 'dependabot-not-installed')
+    return token
+  }
+  const token = await tokenNow()
+  let who
+  try { who = await reader.identity() } catch (error) {
+    throw error instanceof GithubApiError && UNVERIFIED.has(error.message) ? new GithubApiError(403, 'dependabot-unverified') : error
+  }
+  const seen = (permission: string) => {
+    if (!SEES_ALERTS.has(permission)) {
+      throw new GithubApiError(403, 'dependabot-forbidden', null, `@${who.login}'s access to this repository (${permission}) doesn't let them see its Dependabot alerts on GitHub`)
+    }
+  }
+  seen(reader.permission() ?? await githubRepoPermission(repo.fullName, token, who, fetchImpl))
+  const alerts = await dependabotAlerts(repo.fullName, token, fetchImpl)
+  return { alerts, recheck: async () => { seen(await githubRepoPermission(repo.fullName, await tokenNow(), who, fetchImpl)) } }
+}

package/server-managed/dependabot-alerts.ts

@@ -0,0 +1,185 @@
+// A repository's Dependabot alerts of npm's ecosystem, open or dismissed, as a
+// repository risk scan blends them into npm's advisories (repository-risk.ts),
+// a dismissed one with who dismissed it, when and why: GitHub's
+// `GET /repos/:repo/dependabot/alerts`, a page of 100 at a time, each found by
+// the cursor the one before's Link header names, MAX_PAGES at most. Asked with
+// the App's installation token, once the admin's own access to the repository
+// is found to let them see the alerts on GitHub (dependabot-access.ts): where
+// the installation hasn't Dependabot alerts: read, or the repository has them
+// off, that is thrown as its code, never GitHub's text, for the scan to tell
+// and go on.
+import { isExactVersion, satisfies, validRange } from '@preventive/upstream/semver.js'
+import { isNpmPackageName } from '../common/managed/npm-packages.js'
+import { GithubApiError, githubUnreachable, throwGithubResponseError } from './github-errors.ts'
+import type { LockedPackage } from './locked-packages.ts'
+
+// An alert, as GitHub has it: its `number` in its repository and its page
+// there (`url`, built, never fetched), the manifest or lockfile it is of
+// (`manifest`, from the repository's root), its package and advisory, the
+// versions it affects as GitHub writes them (`range`, `>= 1.0.0, < 1.2.6`)
+// and the first that isn't (`patched`), `dev` where GitHub tells the
+// dependency is only for development, and `dismissed` where it is: by whom,
+// when, why and what they said, or by one of the repository's rules (`auto`).
+export interface DependabotAlert {
+  number: number
+  url: string
+  manifest: string
+  name: string
+  ghsa: string
+  // The advisory's other ids, as its CVE.
+  aliases: string[]
+  title?: string
+  // `critical`, `high`, `moderate`, `low`: GitHub's `medium` reads `moderate`.
+  severity?: string
+  range?: string
+  patched?: string
+  cwe: string[]
+  dev?: true
+  dismissed?: AlertDismissal
+}
+
+// GitHub's `dismissed_reason`: `fix_started`, `inaccurate`, `no_bandwidth`,
+// `not_used` or `tolerable_risk`; `at` as GitHub writes it (ISO 8601).
+export interface AlertDismissal { auto?: true; reason?: string; at?: string; by?: string; comment?: string }
+
+const API = 'https://api.github.com'
+const API_VERSION = '2022-11-28'
+const USER_AGENT = 'deepview-triage'
+const PER_PAGE = 100
+// Up to how many pages a listing asks: 2,000 alerts of npm's in a repository,
+// past which the rest are left out; where open and dismissed ones are more,
+// the open ones are listed again on their own (dependabotAlerts).
+const MAX_PAGES = 20
+// A page holds each advisory's whole text: given longer than githubJson's.
+const PAGE_TIMEOUT_MS = 20_000
+const GHSA = /^GHSA(?:-[23456789cfghjmpqrvwx]{4}){3}$/u
+const SEVERITIES = new Map([['critical', 'critical'], ['high', 'high'], ['medium', 'moderate'], ['moderate', 'moderate'], ['low', 'low']])
+// A path from a repository's root, as git takes one: no empty, `.` or `..`
+// component, nor a control character.
+const isRepoPath = (path: unknown): path is string => typeof path === 'string' && path.length <= 1024 && !/\p{Cc}/u.test(path)
+  && path.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+
+// The states asked: a fixed alert's dependency is no longer what it was.
+const STATES = ['open', 'dismissed', 'auto_dismissed']
+const REASONS = new Set(['fix_started', 'inaccurate', 'no_bandwidth', 'not_used', 'tolerable_risk'])
+const LOGIN = /^[\dA-Za-z](?:[\dA-Za-z-]{0,38})(?:\[bot\])?$/u
+
+const text = (value: unknown, most = 500) => typeof value === 'string' && value.trim() ? value.trim().slice(0, most) : undefined
+
+// How a dismissed alert was dismissed, as far as GitHub tells it soundly.
+function dismissalOf(state: string, raw: Record<string, any>): AlertDismissal {
+  const at = state === 'auto_dismissed' ? raw['auto_dismissed_at'] : raw['dismissed_at']
+  const when = typeof at === 'string' && at.length <= 40 && !Number.isNaN(Date.parse(at)) ? { at } : {}
+  if (state === 'auto_dismissed') return { auto: true, ...when }
+  const by = raw['dismissed_by']?.login, comment = text(raw['dismissed_comment'], 280), reason = raw['dismissed_reason']
+  return { ...REASONS.has(reason) ? { reason } : {}, ...when, ...typeof by === 'string' && LOGIN.test(by) ? { by } : {}, ...comment === undefined ? {} : { comment } }
+}
+
+// An alert as GitHub answers it, or null for one that isn't an open or
+// dismissed one of npm's, of a package and GHSA npm and GitHub would name.
+function alertOf(fullName: string, raw: unknown): DependabotAlert | null {
+  if (raw == null || typeof raw !== 'object') return null
+  const { number, state, dependency, security_advisory: advisory, security_vulnerability: vulnerability } = raw as Record<string, any>
+  if (!Number.isSafeInteger(number) || number <= 0 || !STATES.includes(state)) return null
+  const ghsa = advisory?.ghsa_id, manifest = dependency?.manifest_path, name = dependency?.package?.name
+  if (dependency?.package?.ecosystem !== 'npm' || !isNpmPackageName(name) || !isRepoPath(manifest) || typeof ghsa !== 'string' || !GHSA.test(ghsa)) return null
+  const severity = SEVERITIES.get(vulnerability?.severity ?? advisory?.severity)
+  const patched = text(vulnerability?.first_patched_version?.identifier, 100), range = text(vulnerability?.vulnerable_version_range, 200), title = text(advisory?.summary)
+  const ids = Array.isArray(advisory?.identifiers) ? advisory.identifiers as { value?: unknown }[] : []
+  const cwes = Array.isArray(advisory?.cwes) ? advisory.cwes as { cwe_id?: unknown }[] : []
+  return {
+    number, url: `https://github.com/${fullName.split('/').map(encodeURIComponent).join('/')}/security/dependabot/${number}`, manifest, name, ghsa,
+    aliases: [...new Set(ids.flatMap(id => typeof id?.value === 'string' && /^[\w.:-]{1,64}$/u.test(id.value) && id.value !== ghsa ? [id.value] : []))],
+    ...title === undefined ? {} : { title }, ...severity === undefined ? {} : { severity },
+    ...range === undefined ? {} : { range }, ...patched === undefined ? {} : { patched },
+    cwe: [...new Set(cwes.flatMap(cwe => typeof cwe?.cwe_id === 'string' && /^CWE-\d{1,6}$/u.test(cwe.cwe_id) ? [cwe.cwe_id] : []))],
+    ...dependency.scope === 'development' ? { dev: true as const } : {},
+    ...state === 'open' ? {} : { dismissed: dismissalOf(state, raw as Record<string, any>) },
+  }
+}
+
+// The next page's cursor, as the Link header's `next` names it: its `after`,
+// or its `page`, all that is taken of it, the rest of its URL left as asked.
+function nextPage(link: string | null): [string, string] | null {
+  const next = link?.split(',').map(part => /^\s*<([^>]*)>\s*;\s*rel="next"\s*$/u.exec(part)?.[1]).find(Boolean)
+  if (!next) return null
+  let url
+  try { url = new URL(next) } catch { return null }
+  if (url.origin !== API) return null
+  const after = url.searchParams.get('after'), page = url.searchParams.get('page')
+  return after ? ['after', after] : page && /^\d{1,4}$/u.test(page) ? ['page', page] : null
+}
+
+// A page asked of GitHub: its alerts and the headers they came with. A 403
+// that isn't a rate limit is told as the alerts being off
+// (`dependabot-disabled`) or not to be read by the App's installation
+// (`dependabot-app-permission`), as a 404 is, the repository found just
+// before; the rest as githubJson tells them.
+async function askPage(url: string, token: string, fetchImpl: typeof fetch): Promise<{ alerts: unknown[]; link: string | null }> {
+  const started = Date.now()
+  let res: Response
+  try {
+    res = await fetchImpl(url, {
+      signal: AbortSignal.timeout(PAGE_TIMEOUT_MS), redirect: 'error',
+      headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION },
+    })
+  } catch (error) { throw githubUnreachable(error, started) }
+  if (res.status === 403) {
+    const message = (await res.clone().json().catch(() => null) as { message?: unknown } | null)?.message
+    const limited = res.headers.get('x-ratelimit-remaining') === '0' || res.headers.has('retry-after')
+      || (typeof message === 'string' && /rate limit|abuse detection/iu.test(message))
+    if (!limited) throw new GithubApiError(403, typeof message === 'string' && /disabled/iu.test(message) ? 'dependabot-disabled' : 'dependabot-app-permission')
+  }
+  if (res.status === 404) throw new GithubApiError(403, 'dependabot-app-permission')
+  if (!res.ok) await throwGithubResponseError(res)
+  let body
+  try { body = await res.json() } catch (error) {
+    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+  }
+  if (!Array.isArray(body)) throw new GithubApiError(502, 'github-malformed')
+  return { alerts: body, link: res.headers.get('link') }
+}
+
+// `fullName`'s alerts in `states`, MAX_PAGES at most, in GitHub's order (the
+// newest first), and whether that is all of them.
+async function listAlerts(fullName: string, states: readonly string[], token: string, fetchImpl: typeof fetch) {
+  const base = `${API}/repos/${fullName.split('/').map(encodeURIComponent).join('/')}/dependabot/alerts`
+  const alerts: DependabotAlert[] = []
+  const seen = new Set<number>()
+  let cursor: [string, string] | null = null
+  for (let pages = 0; pages < MAX_PAGES; pages++) {
+    const query = new URLSearchParams({ state: states.join(','), ecosystem: 'npm', per_page: String(PER_PAGE), ...cursor ? { [cursor[0]]: cursor[1] } : {} })
+    const answer = await askPage(`${base}?${query}`, token, fetchImpl)
+    for (const raw of answer.alerts) {
+      const alert = alertOf(fullName, raw)
+      if (alert && !seen.has(alert.number)) { seen.add(alert.number); alerts.push(alert) }
+    }
+    cursor = answer.alerts.length === 0 ? null : nextPage(answer.link)
+    if (!cursor) return { alerts, whole: true }
+  }
+  return { alerts, whole: false }
+}
+
+// `fullName`'s Dependabot alerts of npm's ecosystem, open or dismissed, as
+// `token`, the App's installation's (dependabot-access.ts), may see them, in
+// GitHub's order. Asked at once, but where they are more than a listing holds,
+// as newer dismissed ones would leave older open ones out, the open ones are
+// listed again on their own, and the dismissed ones had kept after them.
+export async function dependabotAlerts(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<DependabotAlert[]> {
+  const all = await listAlerts(fullName, STATES, token, fetchImpl)
+  if (all.whole) return all.alerts
+  const open = await listAlerts(fullName, ['open'], token, fetchImpl)
+  const told = new Set(open.alerts.map(alert => alert.number))
+  return [...open.alerts, ...all.alerts.filter(alert => alert.dismissed && !told.has(alert.number))]
+}
+
+// The versions of an alert's package that a lockfile it is of locks
+// (`packages`) and its range covers, GitHub's read as npm's semver reads its
+// own (`>= 1.0.0, < 1.2.6` as `>= 1.0.0 < 1.2.6`); none where it is of no
+// lockfile read, or its range is none semver reads.
+export function alertVersions(alert: Pick<DependabotAlert, 'name' | 'range'>, packages: readonly LockedPackage[] | undefined): string[] {
+  const range = alert.range === undefined ? null : validRange(alert.range.replaceAll(',', ' '))
+  if (!packages || range === null) return []
+  return [...new Set(packages.flatMap(({ name, version, source }) => name === alert.name && (source === 'registry' || source === 'mirror')
+    && isExactVersion(version) && satisfies(version, range) ? [version] : []))]
+}

package/server-managed/dependency-review-comments.ts

@@ -0,0 +1,97 @@
+// The comment a host formats of one's own dependency reviews, for a copy
+// button to give (reviewed-dependencies.ts `formatDependencyReviews`): of each
+// of one's reviews, as their lists and the review page show them
+// (`withFormatted`), and of those of the versions an open pull request adds
+// (`formattedPull`). It is given one's own published reviews alone, never
+// another's, a draft or a revoked one, however it is asked (`formatOwn`, the
+// only caller of the hook); and is told of none where it answers nothing, or
+// fails, which is logged.
+import type { DependencyReview, DependencyReviewStore } from './dependency-reviews.ts'
+import { type AddedPackage, type PullDependencies, eachOf } from './pull-dependencies.ts'
+import type { PublishedReview, RepoReviewState } from './repository-dependency-reviews.ts'
+import type { DependencyReviewEntry, ReviewedDependencies } from './reviewed-dependencies.ts'
+
+const FORMAT_AT_ONCE = 8
+// The longest comment told, past which none is.
+const MAX_FORMATTED = 1_000_000
+// The reviews of a pull request's versions read at once, those past them
+// read after, every one formatted.
+const REVIEWS_AT_ONCE = 200
+
+// `review` as the hook is given it, the version it is of as `locked`, a
+// pull request's lockfile, locks it where it is one's.
+function entryOf(review: DependencyReview, locked?: AddedPackage | undefined): DependencyReviewEntry {
+  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '' },
+    new: { name: review.package, version: review.version, integrity: review.integrity, ...locked?.shasum ? { shasum: locked.shasum } : {},
+      ...locked?.patchHash ? { patchHash: locked.patchHash } : {} },
+    status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
+    files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),
+    reviewer: review.userLogin, publishedAt: review.publishedAt! }
+}
+
+// Whether `review` is `user`'s own, published, not revoked, with its verdict.
+const ownPublished = (review: DependencyReview, user: string) => review.user === user && review.publishedAt !== null && review.revokedAt === null && review.status !== null
+
+// What the host formats of `reviews`, of them `user`'s own published ones
+// alone, and the pull request they are of the versions of, where it is
+// one's; none where it formats none of them.
+async function formatOwn(reviewed: ReviewedDependencies | null, user: string, reviews: { review: DependencyReview; locked?: AddedPackage | undefined }[],
+  pullRequest?: { repository: string; number: number }): Promise<string | null> {
+  const format = reviewed?.formatDependencyReviews
+  const own = reviews.filter(({ review }) => ownPublished(review, user))
+  if (!format || own.length === 0) return null
+  try {
+    const text = await format({ reviews: own.map(({ review, locked }) => entryOf(review, locked)), ...pullRequest ? { pullRequest } : {} })
+    return typeof text === 'string' && text.trim() !== '' && text.length <= MAX_FORMATTED ? text : null
+  } catch (error) {
+    console.warn('reviewed dependencies: failed to format dependency reviews', error instanceof Error ? error.message : error)
+    return null
+  }
+}
+
+// `reviews`, each of `user`'s own with the comment the host formats of it
+// (`formatted`), where it formats one; another's never asked of.
+export function withFormatted<T extends DependencyReview>(reviewed: ReviewedDependencies | null, user: string, reviews: T[]): Promise<(T & { formatted?: string })[]> {
+  if (!reviewed?.formatDependencyReviews) return Promise.resolve(reviews)
+  return eachOf(reviews, FORMAT_AT_ONCE, async review => {
+    const formatted = ownPublished(review, user) ? await formatOwn(reviewed, user, [{ review }]) : null
+    return formatted ? { ...review, formatted } : review
+  })
+}
+
+// Those of `reviews` `user` published of the versions `told` adds, by their
+// ids, with each version as its lockfile locks it: of its version, of an
+// integrity it is locked with and of its patch, whole or compared with a
+// version it was.
+function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: string): Map<string, AddedPackage> {
+  // Theirs by the version they are of, each version probed once.
+  const theirs = new Map<string, PublishedReview[]>()
+  for (const review of reviews) {
+    if (review.id === undefined || review.reviewer !== user) continue
+    const key = `${review.package}@${review.version}`
+    theirs.set(key, [...theirs.get(key) ?? [], review])
+  }
+  const mine = new Map<string, AddedPackage>()
+  if (theirs.size === 0) return mine
+  for (const pkg of told.lockfiles.flatMap(dir => 'added' in dir ? dir.added : [])) {
+    const hashes = new Set((pkg.integrity ?? '').split(/\s+/u).filter(Boolean))
+    for (const review of theirs.get(`${pkg.name}@${pkg.version}`) ?? []) {
+      if (!hashes.has(review.integrity) || (review.patchHash ?? '') !== (pkg.patchHash ?? '')) continue
+      if (review.basePackage === null || (review.basePackage === pkg.name && (pkg.was ?? []).includes(review.baseVersion ?? ''))) mine.set(review.id!, pkg)
+    }
+  }
+  return mine
+}
+
+// The comment the host formats of `user`'s reviews of the versions pull
+// request `number` of `repository` adds (`told`), those its review's state
+// tells of, published to a team counting for it; none where it has none.
+export async function formattedPull(reviewed: ReviewedDependencies | null, db: Pick<DependencyReviewStore, 'listOwnDependencyReviewsById'>, user: string,
+  told: PullDependencies, state: RepoReviewState | null, pullRequest: { repository: string; number: number }): Promise<string | null> {
+  if (!reviewed?.formatDependencyReviews || !state) return null
+  const mine = ownOfPull(told, state.reviews, user)
+  if (mine.size === 0) return null
+  const ids = [...mine.keys()], reviews: DependencyReview[] = []
+  for (let at = 0; at < ids.length; at += REVIEWS_AT_ONCE) reviews.push(...await db.listOwnDependencyReviewsById(user, ids.slice(at, at + REVIEWS_AT_ONCE)))
+  return formatOwn(reviewed, user, reviews.map(review => ({ review, locked: mine.get(review.id) })), pullRequest)
+}

package/server-managed/dependency-reviews.ts

@@ -25,6 +25,14 @@ export interface DependencyReviewStore {
   listDependencyReviews(context: ReviewContext, user: string, allBases?: boolean): Promise<DependencyReview[]>
   getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity'>): Promise<DependencyReview | null>
   listOwnDependencyReviews(user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null }>
+  // `user`'s own reviews of `ids`, none another's.
+  listOwnDependencyReviewsById(user: string, ids: string[]): Promise<DependencyReview[]>
+  // The reviews published to team `teamId`, revoked ones too, the latest
+  // published first, a page on from `before` (when it was published, and
+  // its id), for one who reads them there (reviewsIn); null for another.
+  listTeamDependencyReviews(teamId: string, user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null } | null>
+  // Whether `user` reads the reviews published to team `teamId` (reviewsIn).
+  readsTeamDependencyReviews(teamId: string, user: string): Promise<boolean>
   listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
   listDependencyReviewEnabledTeams(): Promise<string[]>
   setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
@@ -62,6 +70,7 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
   team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
   PRIMARY KEY (review_id, team_id)
 ) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
 `
 const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
 const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
@@ -71,6 +80,16 @@ const columns = `id, user_id AS user, user_login AS userLogin, ecosystem, packag
   time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
 const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
 
+// Who reviews dependencies in team `t`, user `u` as the query joins them: an
+// admin, in any team; a member who manages, in theirs; a member who triages,
+// in theirs whose dependencies they may see (`view_dependencies`). Publishing
+// (`publishing`) needs the team to review dependencies; reading what was
+// published there, not, so what it published stays read once it stops. A
+// hidden team is no one's.
+export const reviewsIn = (publishing: boolean) => `t.hidden = 0${publishing ? ' AND t.dependency_review = 1' : ''} AND (u.role = 'admin' OR EXISTS (
+  SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = u.id
+    AND (u.role = 'manage' OR (u.role = 'triage' AND m.view_dependencies = 1))))`
+
 // Fold legacy multi-note files into one text field without changing a frozen
 // snapshot's stored rows. Continuing or saving uses one row per file.
 function fileEntries(entries: ReviewEntry[]): ReviewEntry[] {
@@ -93,11 +112,18 @@ async function actor(db: ManagedSql, sessionId: string, admin = false) {
   if (!(admin ? ['admin'] : ['triage', 'manage', 'admin']).includes(user.role)) throw new ManagedMutationError(403, 'forbidden')
   return user
 }
+// The teams `user` publishes reviews to (reviewsIn).
 async function teams(db: ManagedSql, user: string): Promise<ReviewTeam[]> {
-  return await db.prepare(`SELECT t.id, t.name FROM managed_team t
-    JOIN managed_team_user m ON m.team_id = t.id AND m.user_id = ?
-    WHERE t.hidden = 0 AND t.dependency_review = 1 ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+  return await db.prepare(`SELECT t.id, t.name FROM managed_team t JOIN managed_user u ON u.id = ?
+    WHERE ${reviewsIn(true)} ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+}
+// A draft is begun or edited by one who publishes to some team; their own
+// published review revoked, or published to more teams, as `publish` checks
+// each, whoever they are now.
+async function requireReviewer(db: ManagedSql, user: string) {
+  if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
 }
+
 async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
   const reviews = rows as (Omit<DependencyReview, 'files'> & { files: string | null })[]
   if (reviews.length === 0) return []
@@ -105,10 +131,9 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
   const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
     FROM managed_dependency_file_review WHERE review_id IN (${placeholders}) ORDER BY time, id`).all(...ids) as (ReviewEntry & { reviewId: string })[]
   const linked = await db.prepare(`SELECT rt.review_id AS reviewId, t.id, t.name FROM managed_dependency_review_team rt
-    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id
-    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = ? OR (t.hidden = 0 AND EXISTS (
-      SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = ?)))
-    ORDER BY t.name, t.id`).all(...ids, user, user) as (ReviewTeam & { reviewId: string })[]
+    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = u.id OR (${reviewsIn(false)}))
+    ORDER BY t.name, t.id`).all(user, ...ids) as (ReviewTeam & { reviewId: string })[]
   return reviews.map(review => {
     const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
     const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
@@ -147,6 +172,30 @@ async function listOwn(db: ManagedSql, user: string, before: { time: number; id:
   return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: last.time, id: last.id } : null }
 }
 
+// A version's reviews, of its base (`context`), or of any (`allBases`), that
+// `user` reads: their own, and those published to a team they read in.
+async function listContext(db: ManagedSql, context: ReviewContext, user: string, allBases: boolean) {
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
+    AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
+      SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+      WHERE rt.review_id = r.id AND ${reviewsIn(false)})))
+    ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
+  return expandReviews(db, rows, user)
+}
+
+const readsTeam = async (db: ManagedSql, teamId: string, user: string) =>
+  Boolean(await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}`).get(user, teamId))
+
+async function listTeam(db: ManagedSql, teamId: string, user: string, before: { time: number; id: string } | null) {
+  if (!await readsTeam(db, teamId, user)) return null
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
+    WHERE rt.team_id = ? AND r.published_at IS NOT NULL ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
+    ORDER BY r.published_at DESC, r.id DESC LIMIT 51`).all(teamId, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
+  const page = rows.slice(0, 50)
+  const last = page.at(-1)
+  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
+}
+
 async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
   const existing = await db.prepare(`SELECT id FROM managed_dependency_file_review
     WHERE review_id = ? AND file = ? ORDER BY time, id`).all(reviewId, entry.file) as { id: string }[]
@@ -171,6 +220,13 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
   const read = (id: string) => db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ?`).get(id)
   return {
     listOwnDependencyReviews: (user, before) => listOwn(db, user, before),
+    async listOwnDependencyReviewsById(user, ids) {
+      if (ids.length === 0) return []
+      return expandReviews(db, await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE user_id = ? AND id IN (${ids.map(() => '?').join(',')})
+        ORDER BY time, id`).all(user, ...ids), user)
+    },
+    listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
+    readsTeamDependencyReviews: (teamId, user) => readsTeam(db, teamId, user),
     async getLatestOwnDependencyReview(user, target) {
       const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
         WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
@@ -191,16 +247,10 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
       return true
     },
     listDependencyReviewTeams: user => teams(db, user),
-    async listDependencyReviews(context, user, allBases = false) {
-      const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
-        AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
-          SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id AND t.hidden = 0
-          JOIN managed_team_user m ON m.team_id = rt.team_id WHERE rt.review_id = r.id AND m.user_id = ?)))
-        ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
-      return expandReviews(db, rows, user)
-    },
+    listDependencyReviews: (context, user, allBases = false) => listContext(db, context, user, allBases),
     async changeDependencyReview(context, sessionId, change, now) {
       const user = await actor(db, sessionId)
+      if (change.action !== 'revoke' && change.action !== 'publish') await requireReviewer(db, user.id)
       let id = change.reviewId
       let current: DependencyReview | undefined
       if (id) {

package/server-managed/github-accounts.ts

@@ -0,0 +1,33 @@
+// GitHub accounts as GitHub's REST and GraphQL APIs name them, where a
+// repository's activity names its authors (repository-history.ts and the
+// Commits, Issues, Agents and Pulse tabs' readers).
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+
+// An account as GitHub names it: its login, else null, and its numeric id
+// where GitHub names one with it.
+export interface NamedAccount { login: string | null; id: number | null }
+export function accountOf(account: { login?: unknown; id?: unknown } | null | undefined): NamedAccount {
+  const login = typeof account?.login === 'string' && LOGIN.test(account.login) ? account.login : null
+  const id = account?.id
+  return { login, id: login && Number.isSafeInteger(id) && (id as number) > 0 ? id as number : null }
+}
+
+// An actor (the author of an issue or a pull request, one who merged one) as
+// GitHub's GraphQL API names it: its login, and its account's numeric id, a
+// user's or a GitHub App's bot's.
+export const ACTOR = 'login ... on User { databaseId } ... on Bot { databaseId }'
+export type GraphAccount = { login?: unknown; databaseId?: unknown } | null | undefined
+export const actorOf = (actor: GraphAccount) => accountOf({ login: actor?.login, id: actor?.databaseId })
+
+// A commit's author's account, as GitHub's GraphQL API names it: the user
+// GitHub knows its address for; else, as GitHub's REST API does, the account
+// whose noreply address its address is, `<id>+<login>@users.noreply.github.com`:
+// a GitHub App's bot's, which is no user (GraphQL's `user` is a User's, never
+// a bot's).
+const NOREPLY = /^([1-9]\d{0,11})\+([^@]+)@users\.noreply\.github\.com$/iu
+export type GraphActor = { email?: unknown; user?: GraphAccount | null }
+export function commitAccount(author: GraphActor | null | undefined): NamedAccount {
+  const user = actorOf(author?.user)
+  const noreply = user.id === null && typeof author?.email === 'string' ? NOREPLY.exec(author.email) : null
+  return noreply ? accountOf({ login: noreply[2], id: Number(noreply[1]) }) : user
+}

package/server-managed/github-actions.ts

@@ -0,0 +1,71 @@
+// GitHub as a risk scan resolves actions with (risk ActionsSource), read with
+// an admin's own token, or none for public repositories alone: what GitHub
+// has none of reads as none, anything else is thrown as a GithubApiError.
+import { createClient } from '@preventive/upstream/github.js'
+import type { ActionsSource } from '../risk/index.js'
+import { GithubApiError, upstreamGithub } from './github-errors.ts'
+import { githubJson } from './github-app.ts'
+
+// How many pages of 100 tags are listed; a repository with more is told by
+// its tags one at a time.
+const MAX_TAG_PAGES = 10
+const BRANCHES_PAGE = 100
+
+const api = (name: string, suffix: string) => `https://api.github.com/repos/${name.split('/').map(encodeURIComponent).join('/')}${suffix}`
+
+// Whether upstream refused what it was asked before asking GitHub, as a ref
+// git wouldn't take: its arguments' checks say what each must be.
+const isRefused = (error: unknown) => error instanceof Error && error.name === 'AssertionError' && / must be /u.test(error.message)
+
+// What `read` answers, null where GitHub has none (a 404), or upstream
+// refused to ask.
+async function orNone<T>(read: () => Promise<T>): Promise<T | null> {
+  try {
+    return await upstreamGithub(() => read().catch((error: unknown) => { throw isRefused(error) ? new GithubApiError(404, 'github-not-found') : error }))
+  } catch (error) {
+    if (error instanceof GithubApiError && error.status === 404) return null
+    throw error
+  }
+}
+
+interface RepoObject { full_name?: unknown; default_branch?: unknown; fork?: unknown; parent?: { full_name?: unknown }; archived?: unknown; private?: unknown }
+
+export function githubActionsSource(token: string | null, fetchImpl: typeof fetch = globalThis.fetch): ActionsSource {
+  const client = createClient({ token })
+  return {
+    async repo(name) {
+      const info = await orNone(() => client.getRepo({ repo: name, followRedirect: true })) as RepoObject | null
+      if (!info) return null
+      if (typeof info.full_name !== 'string' || typeof info.default_branch !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return { fullName: info.full_name, defaultBranch: info.default_branch, archived: info.archived === true, private: info.private !== false,
+        fork: info.fork === true ? (typeof info.parent?.full_name === 'string' ? info.parent.full_name : '') : null }
+    },
+    tags(name) {
+      // More than MAX_TAG_PAGES pages, which upstream refuses to list whole.
+      return upstreamGithub(() => client.listRepoTags({ repo: name, maxPages: MAX_TAG_PAGES })
+        .catch((error: unknown) => { if (error instanceof Error && /more than \d+ pages/u.test(error.message)) return null; throw error }))
+    },
+    tag: async (name, tag) => (await orNone(() => client.getRepoTag({ repo: name, tag })))?.oid ?? null,
+    branch: async (name, branch) => (await orNone(() => client.getRepoHead({ repo: name, branch })))?.oid ?? null,
+    async branches(name) {
+      const listed = await githubJson(api(name, `/branches?per_page=${BRANCHES_PAGE}`), token, fetchImpl)
+      if (!Array.isArray(listed)) throw new GithubApiError(502, 'github-malformed')
+      const branches = (listed as { name?: unknown; commit?: { sha?: unknown } }[]).flatMap(item => typeof item?.name === 'string'
+        && typeof item.commit?.sha === 'string' && /^[\da-f]{40}$/u.test(item.commit.sha) ? [{ branch: item.name, oid: item.commit.sha }] : [])
+      return { branches, complete: listed.length < BRANCHES_PAGE }
+    },
+    // `base...sha`: `sha` is `base` or in its history where GitHub tells it
+    // behind or identical, a commit of a fork in the same network too.
+    async contains(name, base, sha) {
+      if (!/^[\da-f]{40}$/u.test(sha)) return null
+      let compared
+      try { compared = await githubJson(api(name, `/compare/${base.split('/').map(encodeURIComponent).join('/')}...${sha}?per_page=1`), token, fetchImpl) as { status?: unknown } } catch (error) {
+        if (error instanceof GithubApiError && (error.status === 404 || error.message === 'github-status-422')) return null
+        throw error
+      }
+      if (typeof compared?.status !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return compared.status === 'behind' || compared.status === 'identical'
+    },
+    file: (name, path, commit) => orNone(() => client.getRepoFile({ repo: name, path, ref: commit })),
+  }
+}