@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.45

package/server-managed/repository-changes.ts

@@ -0,0 +1,284 @@
+// The files each commit changes, as the code viewer's Replay plays them
+// (GET /api/admin/repositories/changes), as `git log --name-status` lists
+// them: each file's path and whether the commit added (`A`), modified (`M`),
+// removed (`D`) or renamed (`R`, with the path it had) it, as GitHub's REST
+// API lists a commit's files (GET /repos/:owner/:repo/commits/:sha), a
+// page of FILES_PAGE at a time, as many as MAX_FILES, `more` where it had
+// more. What a commit changes never changes, so each is kept by the commit
+// (`kept`), whole, read of GitHub once; what a reader is answered, only the
+// files within the directory they asked of (changesWithin). And the files a
+// commit holds, which Replay starts from (GET /api/admin/repositories/tree),
+// as GitHub lists its tree at once (repositoryTree), kept as well.
+
+import { GithubApiError, githubJson } from './github-app.ts'
+
+// Commits an answer tells at most, read of GitHub as many at once as
+// CHANGES_PARALLEL.
+export const CHANGES_ASKED = 50
+const CHANGES_PARALLEL = 6
+// A commit's files read, as many as fill MAX_FILES, FILES_PAGE a page (the
+// most GitHub lists a page; it lists fewer, unasked).
+export const MAX_FILES = 300
+export const FILES_PAGE = 100
+const MAX_PATH = 4096
+const SHA = /^[a-f\d]{40}$/u
+
+export type ChangeStatus = 'A' | 'M' | 'D' | 'R'
+// A file a commit changes: its path, its status, and a rename's path before.
+export type ChangedFile = [path: string, status: Exclude<ChangeStatus, 'R'>] | [path: string, status: 'R', from: string]
+export interface CommitChanges { files: ChangedFile[]; more: boolean }
+
+// What each commit changes kept, by the commit.
+export interface ChangesStore {
+  read(shas: string[]): Promise<Map<string, CommitChanges>>
+  write(sha: string, changes: CommitChanges): Promise<void>
+}
+
+const pathOf = (value: unknown) => typeof value === 'string' && value !== '' && value.length <= MAX_PATH && !/\p{Cc}/u.test(value) ? value : null
+
+// A file's status as git names it: a copy is a file added; one GitHub
+// lists unchanged (its mode alone changed, say) changes none.
+const STATUSES: Record<string, ChangeStatus> = { added: 'A', copied: 'A', modified: 'M', changed: 'M', removed: 'D', renamed: 'R' }
+
+type GithubFile = { filename?: unknown; status?: unknown; previous_filename?: unknown }
+
+// A commit's files as GitHub lists them; a rename it names no path before
+// for, a file added.
+export function commitChanges(data: unknown): CommitChanges {
+  const listed = (data as { files?: unknown } | null)?.files
+  if (!Array.isArray(listed)) throw new GithubApiError(502, 'github-malformed')
+  const files = (listed as GithubFile[]).slice(0, MAX_FILES).flatMap((file): ChangedFile[] => {
+    const path = pathOf(file?.filename)
+    const status = typeof file?.status === 'string' ? STATUSES[file.status] : undefined
+    if (!path || !status) return []
+    const from = status === 'R' ? pathOf(file.previous_filename) : null
+    return [status === 'R' ? from ? [path, 'R', from] : [path, 'A'] : [path, status]]
+  })
+  return { files, more: listed.length >= MAX_FILES }
+}
+
+// What a commit changes within the directory `path` ('' the whole
+// repository): its files there, a rename across its edge the file added
+// where it came in, removed where it went out.
+export function changesWithin({ files, more }: CommitChanges, path: string): CommitChanges {
+  if (path === '') return { files, more }
+  const within = (file: string) => file.startsWith(`${path}/`)
+  return { more, files: files.flatMap((file): ChangedFile[] => {
+    if (file[1] !== 'R') return within(file[0]) ? [file] : []
+    const [to, , from] = file
+    if (within(to)) return [within(from) ? file : [to, 'A']]
+    return within(from) ? [[from, 'D']] : []
+  }) }
+}
+
+// Runs `run` for each of `items`, as many at once as `parallel`.
+async function eachOf<T>(items: T[], parallel: number, run: (item: T) => Promise<void>) {
+  let next = 0
+  await Promise.all(Array.from({ length: Math.min(parallel, items.length) }, async () => { while (next < items.length) await run(items[next++]!) }))
+}
+
+// A commit's files as GitHub lists them, read a page at a time while each
+// is full, till MAX_FILES are.
+async function commitFiles(url: string, token: string | null, fetchImpl: typeof fetch) {
+  const files: unknown[] = []
+  for (let page = 1; files.length < MAX_FILES; page++) {
+    const data = await githubJson(`${url}?per_page=${FILES_PAGE}&page=${page}`, token, fetchImpl) as { files?: unknown } | null
+    if (!Array.isArray(data?.files)) throw new GithubApiError(502, 'github-malformed')
+    files.push(...data.files)
+    if (data.files.length < FILES_PAGE) break
+  }
+  return { files }
+}
+
+// What each of `shas` changes, kept, else read of GitHub and then kept; null
+// for one GitHub has no commit of (as one of another repository is).
+export async function repositoryChanges(fullName: string, token: string | null, shas: string[], kept: ChangesStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<Map<string, CommitChanges | null>> {
+  const asked = [...new Set(shas)].filter(sha => SHA.test(sha))
+  const found = new Map<string, CommitChanges | null>(await kept.read(asked))
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  await eachOf(asked.filter(sha => !found.has(sha)), CHANGES_PARALLEL, async sha => {
+    try {
+      const changes = commitChanges(await commitFiles(`${repo}/commits/${sha}`, token, fetchImpl))
+      found.set(sha, changes)
+      await kept.write(sha, changes)
+    } catch (err) {
+      // No such commit: GitHub's 404, or its 422 for an id naming none.
+      if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) found.set(sha, null)
+      else throw err
+    }
+  })
+  return new Map(asked.map(sha => [sha, found.get(sha) ?? null]))
+}
+
+// The files a commit (or a tree) holds, as many as MAX_TREE_FILES, each by its path and
+// its bytes (`sizes`, in the same order), as
+// GitHub lists its tree and every tree under it at once
+// (GET /repos/:owner/:repo/git/trees/:tree?recursive=1); where GitHub cuts
+// that listing short (past 100,000 entries or 7 MB, as a large repository's
+// is), as GitHub advises: the tree's own entries listed alone, and each tree
+// in it read so in turn, as many at once as TREES_PARALLEL (treeByTrees).
+// Its blobs, not its directories nor submodules, sorted by path; past
+// MAX_TREE_FILES those nearest its root of those read, `cut` where some are
+// left out: more files than MAX_TREE_FILES, a tree's own entries cut short,
+// or more trees to read than MAX_TREE_READS.
+// Null for a commit GitHub has none of. Kept by the commit and the rules it
+// is read by (TREES_READ), a tree kept by older ones (without sizes, the
+// last) read again.
+export const MAX_TREE_FILES = 75_000
+export const TREES_READ = 3
+const MAX_TREE_READS = 400
+const TREES_PARALLEL = 6
+export interface CommitTree { files: string[]; sizes: number[]; cut: boolean }
+export interface TreeStore {
+  read(commit: string): Promise<CommitTree | null>
+  write(commit: string, tree: CommitTree): Promise<void>
+}
+
+type TreeEntry = { type?: unknown; path?: unknown; sha?: unknown; size?: unknown }
+// A file read: its path and its bytes.
+type Blob = [path: string, size: number]
+type TreeListing = (tree: string, recursive: boolean) => Promise<{ entries: TreeEntry[]; truncated: boolean }>
+
+export async function repositoryTree(fullName: string, token: string | null, commit: string, kept: TreeStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<CommitTree | null> {
+  if (!SHA.test(commit)) return null
+  const held = await kept.read(commit)
+  if (held) return held
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  const listing: TreeListing = async (tree, recursive) => {
+    const data = await githubJson(`${repo}/git/trees/${tree}${recursive ? '?recursive=1' : ''}`, token, fetchImpl) as { tree?: unknown; truncated?: unknown }
+    if (!Array.isArray(data?.tree)) throw new GithubApiError(502, 'github-malformed')
+    return { entries: data.tree as TreeEntry[], truncated: data.truncated === true }
+  }
+  let whole: Awaited<ReturnType<TreeListing>>
+  try {
+    whole = await listing(commit, true)
+  } catch (err) {
+    if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) return null
+    throw err
+  }
+  const files: Blob[] = []
+  let cut = false
+  if (whole.truncated) cut = await treeByTrees(commit, listing, files)
+  else blobsOf(whole.entries, '', files)
+  const depth = (path: string) => path.split('/').length
+  const byPath = ([a]: Blob, [b]: Blob) => a < b ? -1 : a > b ? 1 : 0
+  const nearest = files.length > MAX_TREE_FILES ? files.toSorted((a, b) => depth(a[0]) - depth(b[0]) || byPath(a, b)).slice(0, MAX_TREE_FILES) : files
+  const sorted = nearest.toSorted(byPath)
+  const tree = { files: sorted.map(([path]) => path), sizes: sorted.map(([, size]) => size), cut: cut || files.length > MAX_TREE_FILES }
+  await kept.write(commit, tree)
+  return tree
+}
+
+// The blobs of a tree's entries, each its path under `prefix` and its bytes
+// (none, as GitHub names none), onto `files`.
+function blobsOf(entries: TreeEntry[], prefix: string, files: Blob[]) {
+  for (const item of entries) {
+    if (item?.type !== 'blob' || !pathOf(item.path)) continue
+    files.push([`${prefix}${item.path as string}`, Number.isSafeInteger(item.size) && (item.size as number) > 0 ? item.size as number : 0])
+  }
+}
+
+// The files under the commit's tree, `commit`, onto `files`, its trees read
+// a round at a time, those nearest the root first: its own entries, then
+// each tree in it whole, or, where that is cut short, alone in turn, and so
+// on. Each round read whole, whatever answers first, but for trees no file
+// of which could be kept: as deep as, or deeper than, the files nearest the
+// root, as many as MAX_TREE_FILES, of those read (files of a tree are at
+// least a level deeper than it is). As many trees read in all as
+// MAX_TREE_READS, those of a round first in its order. Whether some were
+// left out.
+async function treeByTrees(commit: string, listing: TreeListing, files: Blob[]): Promise<boolean> {
+  let cut = false, reads = 1, round = [{ tree: commit, prefix: '', recursive: false }]
+  const atDepth: number[] = []
+  let counted = 0
+  while (round.length > 0) {
+    for (; counted < files.length; counted++) {
+      const depth = files[counted]![0].split('/').length
+      atDepth[depth] = (atDepth[depth] ?? 0) + 1
+    }
+    // The depth no file deeper than is kept.
+    let kept = Number.POSITIVE_INFINITY
+    for (let depth = 0, sum = 0; depth < atDepth.length; depth++) {
+      sum += atDepth[depth] ?? 0
+      if (sum >= MAX_TREE_FILES) {
+        kept = depth
+        break
+      }
+    }
+    const asked = round.filter(({ prefix }) => prefix.split('/').length - 1 < kept).slice(0, Math.max(0, MAX_TREE_READS - reads))
+    cut ||= asked.length < round.length
+    reads += asked.length
+    const listed: Awaited<ReturnType<TreeListing>>[] = []
+    await eachOf([...asked.keys()], TREES_PARALLEL, async at => { listed[at] = await listing(asked[at]!.tree, asked[at]!.recursive) })
+    const next: typeof round = []
+    for (const [at, { tree, prefix, recursive }] of asked.entries()) {
+      const { entries, truncated } = listed[at]!
+      if (truncated && recursive) {
+        next.push({ tree, prefix, recursive: false })
+        continue
+      }
+      cut ||= truncated
+      blobsOf(entries, prefix, files)
+      if (recursive) continue
+      for (const item of entries) {
+        const path = pathOf(item?.path)
+        if (item?.type === 'tree' && path && typeof item.sha === 'string' && SHA.test(item.sha)) next.push({ tree: item.sha, prefix: `${prefix}${path}/`, recursive: true })
+      }
+    }
+    round = next
+  }
+  return cut
+}
+
+// The files commit `commit` holds within the directory `path` ('' the whole
+// repository), as repositoryTree reads them: its whole tree's within it; where
+// that is cut short, some of the directory's perhaps among those left out,
+// the directory's own tree read so (directoryTree), kept by its id, the files
+// nearest it kept. Null for a commit GitHub has none of.
+export async function directoryFiles(fullName: string, token: string | null, commit: string, path: string, kept: TreeStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<CommitTree | null> {
+  const whole = await repositoryTree(fullName, token, commit, kept, fetchImpl)
+  if (!whole || path === '' || !whole.cut) return whole && treeWithin(whole, path)
+  const id = await directoryTree(fullName, token, commit, path, fetchImpl)
+  const own = id ? await repositoryTree(fullName, token, id, kept, fetchImpl) : null
+  return own ? { ...own, files: own.files.map(file => `${path}/${file}`) } : treeWithin(whole, path)
+}
+
+// The id of the tree at `path` in commit `commit`, read a level at a time
+// (GET /repos/:owner/:repo/git/trees/:tree, its own entries alone); null
+// where it has none there, or GitHub has no such commit.
+async function directoryTree(fullName: string, token: string | null, commit: string, path: string, fetchImpl: typeof fetch): Promise<string | null> {
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  let tree = commit
+  for (const name of path.split('/')) {
+    let data: { tree?: unknown }
+    try {
+      data = await githubJson(`${repo}/git/trees/${tree}`, token, fetchImpl) as typeof data
+    } catch (err) {
+      if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) return null
+      throw err
+    }
+    if (!Array.isArray(data?.tree)) throw new GithubApiError(502, 'github-malformed')
+    const entry = (data.tree as TreeEntry[]).find(item => item?.path === name && item.type === 'tree')
+    if (typeof entry?.sha !== 'string' || !SHA.test(entry.sha)) return null
+    tree = entry.sha
+  }
+  return tree
+}
+
+// The files of a tree within the directory `path` ('' the whole repository).
+export function treeWithin({ files, sizes, cut }: CommitTree, path: string): CommitTree {
+  if (path === '') return { files, sizes, cut }
+  const within = [...files.keys()].filter(at => files[at]!.startsWith(`${path}/`))
+  return { files: within.map(at => files[at]!), sizes: within.map(at => sizes[at]!), cut }
+}
+
+// The commits a request names (`shas`), each once, as many as
+// CHANGES_ASKED; null for none, or for one that isn't a commit id.
+export function changesAsked(shas: string | null): string[] | null {
+  if (!shas) return null
+  const asked = [...new Set(shas.split(','))]
+  return asked.length <= CHANGES_ASKED && asked.every(sha => SHA.test(sha)) ? asked : null
+}

package/server-managed/repository-code.ts

@@ -0,0 +1,52 @@
+// Reading a directory of a repository at a commit for the managed code viewer
+// (GET /api/admin/repositories/code): its tree's tarball as GitHub archives
+// it, verified against the tree's id and kept in upstream's disk cache as
+// bundle builds keep theirs (getRepoTreeTarball), and its files as the npm
+// viewer reads a package's (npm-packages.ts npmFileRows). Readers asking for
+// the same directory meanwhile share its body, a load among the npm viewer's
+// active ones (npm-loads.ts sharedLoad).
+import { Buffer } from 'node:buffer'
+import { encodeBrotli } from './brotli.ts'
+import { MAX_NPM_PACKAGE_BYTES, MAX_NPM_PACKAGE_FILES, NpmPackageError, npmFileRows } from './npm-packages.ts'
+import { type NpmLoad, readTarballFiles, sharedLoad } from './npm-loads.ts'
+
+// As much as a package may hold: the viewer holds every file in memory.
+export const MAX_REPOSITORY_CODE_FILES = MAX_NPM_PACKAGE_FILES
+export const MAX_REPOSITORY_CODE_BYTES = MAX_NPM_PACKAGE_BYTES
+
+// Whether a directory's files fit, by GitHub's listing of its tree and every
+// tree under it (repository-browser.ts repositoryTreeFiles): asked before
+// its tarball is, which may run to hundreds of MiB. One GitHub cut short
+// (null) has too many.
+export function repositoryCodeFits(files: { files: number; bytes: number } | null): boolean {
+  return files !== null && files.files <= MAX_REPOSITORY_CODE_FILES && files.bytes <= MAX_REPOSITORY_CODE_BYTES
+}
+
+// The directory read: the repository by its id and name, the commit, the
+// directory (`''` for the root) and its tree's id.
+export interface RepositoryCodeInput { repoId: number; repo: string; commit: string; path: string; tree: string }
+
+// A package's refusals, as a directory's: past the bounds, or an archive
+// @preventive/archive refuses, as it does one holding a symlink that climbs
+// past the repository's root, or an absolute one.
+const DIRECTORY_ERRORS: Record<string, [number, string]> = { 'package-too-large': [413, 'directory-too-large'], 'bad-tarball': [422, 'directory-unreadable'] }
+const directoryError = (err: unknown) => {
+  const as = err instanceof NpmPackageError ? DIRECTORY_ERRORS[err.message] : undefined
+  return as ? new NpmPackageError(...as) : err
+}
+
+// The directory as the viewer reads it, as brotli-encoded JSON: `{ repoId,
+// repo, commit, path, tree, files }`, its files as npmFileRows gives them,
+// by their paths in the directory, from `tarball`, the tree's.
+export function loadRepositoryCodeBody(input: RepositoryCodeInput, tarball: () => Promise<Uint8Array>): NpmLoad<Buffer> {
+  const { repoId, repo, commit, path, tree } = input
+  return sharedLoad(`repository ${repoId} ${repo} ${commit} ${path} ${tree}`, async () => {
+    let files
+    // A symlink may reach the repository's root, as a monorepo package's
+    // LICENSE links the root's, and no further: the directory's depth, less
+    // the level the archive's root already stands above its top directory.
+    try { files = npmFileRows(await readTarballFiles(await tarball(), { symlinksAbove: path.split('/').length - 1 })) }
+    catch (err) { throw directoryError(err) }
+    return encodeBrotli(Buffer.from(JSON.stringify({ repoId, repo, commit, path, tree, files })))
+  }, 'repository-busy')
+}

package/server-managed/repository-dependency-reviews.ts

@@ -0,0 +1,135 @@
+// A connected repository's dependency review, as an admin sets it, and the
+// reviews that pass its pull requests' dependencies (pull-dependency-reviews.ts).
+// Enabled, each package version its open pull requests' lockfiles lock needs
+// as many published reviews as `required`; those its lockfiles locked at
+// `since`, a commit (null for none), none; of the lockfiles it holds to
+// (`lockfiles`, lockfile-scope.ts), every one by default. It is in effect only where a team
+// that reviews dependencies has the repository, which is where reviews that
+// count are published, and not revoked: each reviewer's latest of a version
+// tells where they stand on it, a reject holding it unreviewed whatever
+// others passed it till they accept it again; and a reviewer standing on
+// accepting it passes it by a review of theirs that is full (every file
+// checked; a partial review counts for nothing yet) and accepting (Accept,
+// or Accept with nits).
+import type { ManagedSql } from './sql.ts'
+import { type LockfileScope, scopeText, storedScope } from './lockfile-scope.ts'
+import { reviewsIn } from './dependency-reviews.ts'
+import { type ReviewVerdict, summarizeReview } from '../common/dependency-reviews.js'
+
+export const REPOSITORY_DEPENDENCY_REVIEW_COLUMNS = [['dependency_review', 'INTEGER NOT NULL DEFAULT 0'],
+  ['dependency_reviews_required', 'INTEGER NOT NULL DEFAULT 1'], ['dependency_review_since', 'TEXT'], ['dependency_review_lockfiles', 'TEXT']] as const
+export const MAX_REQUIRED_REVIEWS = 10
+export const SINCE_COMMIT = /^[a-f\d]{40}$/u
+
+export interface RepoDependencyReview { enabled: boolean; required: number; since: string | null; lockfiles: LockfileScope }
+// A review published of the version it is of: its package, version and
+// npm's integrity of it, the patch it is of (none here, the app reviewing no
+// patch yet), the version it was compared with (none for a whole package's),
+// who wrote it (`reviewer`, their id, else their login then), its verdict,
+// whether it checked every file (`full`), and when it was published.
+// One made in a pull request's comments (`comment`) counts for it alone;
+// one published here has its `id`.
+export interface PublishedReview {
+  id?: string; package: string; version: string; integrity: string; patchHash?: string; basePackage: string | null; baseVersion: string | null
+  reviewer: string; status: ReviewVerdict; full: boolean; time: number; comment?: true
+}
+// A repository's review in effect for a reader: its settings, whether they
+// publish reviews to one of the teams that count (`canReview`), and the
+// published reviews of the packages asked.
+export interface RepoReviewState extends Omit<RepoDependencyReview, 'enabled'> { canReview: boolean; reviews: PublishedReview[] }
+
+export interface RepositoryDependencyReviewStore {
+  listRepoDependencyReviews(): Promise<Map<number, RepoDependencyReview>>
+  // The teams whose published reviews count for each repository (COUNTING_TEAM),
+  // by name.
+  listRepoReviewTeams(): Promise<Map<number, { id: string; name: string }[]>>
+  // Sets a repository's review, its commit and lockfiles too but where
+  // `since` or `lockfiles` is undefined, which keeps it; the setting then, or
+  // null for no repository.
+  setRepoDependencyReview(repoId: number, setting: Omit<RepoDependencyReview, 'since' | 'lockfiles'> & { since?: string | null; lockfiles?: LockfileScope }): Promise<RepoDependencyReview | null>
+  repoDependencyReviewState(repoId: number, user: string, packages: string[]): Promise<RepoReviewState | null>
+  // Which of `users` publish reviews to a team counting for repository
+  // `repoId`, whose reviews its pull requests' comments make count.
+  listRepoReviewers(repoId: number, users: string[]): Promise<Set<string>>
+}
+
+type SettingRow = { repoId: number; enabled: number; required: number; since: string | null; lockfiles: string | null }
+const setting = (row: SettingRow): RepoDependencyReview => ({ enabled: row.enabled === 1, required: row.required, since: row.since, lockfiles: storedScope(row.lockfiles) })
+// Teams whose published reviews count for repository `?`: that review
+// dependencies and have it, not hidden.
+const COUNTING_TEAM = `t.hidden = 0 AND t.dependency_review = 1 AND EXISTS (
+  SELECT 1 FROM managed_team_repo tr WHERE tr.team_id = t.id AND tr.repo_id = ?)`
+const PACKAGES_AT_ONCE = 500
+
+// The published and unrevoked reviews of `packages` in teams counting for
+// repository `repoId`, each with whether it is full, a few hundred packages
+// a query.
+async function publishedReviews(db: ManagedSql, repoId: number, packages: string[]): Promise<PublishedReview[]> {
+  const found: PublishedReview[] = []
+  for (let at = 0; at < packages.length; at += PACKAGES_AT_ONCE) {
+    const names = packages.slice(at, at + PACKAGES_AT_ONCE)
+    const rows = await db.prepare(`SELECT r.id, r.user_id AS userId, r.user_login AS userLogin, r.package, r.version, r.integrity,
+        NULLIF(r.base_package, '') AS basePackage, NULLIF(r.base_version, '') AS baseVersion, r.files, r.status, r.published_at AS publishedAt
+      FROM managed_dependency_review r
+      WHERE r.ecosystem = 'npm' AND r.published_at IS NOT NULL AND r.revoked_at IS NULL AND r.status IS NOT NULL
+        AND r.package IN (${names.map(() => '?').join(',')})
+        AND EXISTS (SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id
+          WHERE rt.review_id = r.id AND ${COUNTING_TEAM})`).all(...names, repoId) as
+      { id: string; userId: string | null; userLogin: string; package: string; version: string; integrity: string
+        basePackage: string | null; baseVersion: string | null; files: string | null; status: ReviewVerdict; publishedAt: number }[]
+    if (rows.length === 0) continue
+    const entries = await db.prepare(`SELECT review_id AS reviewId, file, status FROM managed_dependency_file_review
+      WHERE review_id IN (${rows.map(() => '?').join(',')})`).all(...rows.map(row => row.id)) as { reviewId: string; file: string; status: ReviewVerdict | null }[]
+    for (const row of rows) {
+      const snapshot = row.files === null ? null : JSON.parse(row.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+      // A snapshot of paths alone, before non-text files were told, can't be full.
+      const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+      const nonText = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+      const full = summarizeReview(entries.filter(entry => entry.reviewId === row.id), files, nonText).coverage === 'full'
+      found.push({ id: row.id, package: row.package, version: row.version, integrity: row.integrity, basePackage: row.basePackage, baseVersion: row.baseVersion,
+        reviewer: row.userId ?? `login:${row.userLogin.toLowerCase()}`, status: row.status, full, time: Number(row.publishedAt) })
+    }
+  }
+  return found
+}
+
+export function repositoryDependencyReviewMethods(db: ManagedSql): RepositoryDependencyReviewStore {
+  const columns = `repo_id AS repoId, dependency_review AS enabled, dependency_reviews_required AS required, dependency_review_since AS since,
+    dependency_review_lockfiles AS lockfiles`
+  return {
+    async listRepoDependencyReviews() {
+      const rows = await db.prepare(`SELECT ${columns} FROM managed_selected_repo`).all() as SettingRow[]
+      return new Map(rows.map(row => [row.repoId, setting(row)]))
+    },
+    async listRepoReviewTeams() {
+      const rows = await db.prepare(`SELECT DISTINCT tr.repo_id AS repoId, t.id AS id, t.name AS name FROM managed_team_repo tr
+        JOIN managed_team t ON t.id = tr.team_id WHERE t.hidden = 0 AND t.dependency_review = 1 ORDER BY t.name, t.id`).all() as { repoId: number; id: string; name: string }[]
+      const teams = new Map<number, { id: string; name: string }[]>()
+      for (const { repoId, id, name } of rows) teams.set(repoId, [...teams.get(repoId) ?? [], { id, name }])
+      return teams
+    },
+    async setRepoDependencyReview(repoId, { enabled, required, since, lockfiles }) {
+      const set: [string, unknown][] = [['dependency_review', enabled ? 1 : 0], ['dependency_reviews_required', required],
+        ...since === undefined ? [] : [['dependency_review_since', since] as [string, unknown]],
+        ...lockfiles === undefined ? [] : [['dependency_review_lockfiles', scopeText(lockfiles)] as [string, unknown]]]
+      const { changes } = await db.prepare(`UPDATE managed_selected_repo SET ${set.map(([column]) => `${column} = ?`).join(', ')} WHERE repo_id = ?`)
+        .run(...set.map(([, value]) => value), repoId)
+      if (Number(changes) === 0) return null
+      return setting(await db.prepare(`SELECT ${columns} FROM managed_selected_repo WHERE repo_id = ?`).get(repoId) as SettingRow)
+    },
+    async listRepoReviewers(repoId, users) {
+      if (users.length === 0) return new Set()
+      const rows = await db.prepare(`SELECT DISTINCT u.id FROM managed_user u JOIN managed_team t ON t.hidden = 0
+        WHERE u.id IN (${users.map(() => '?').join(',')}) AND ${reviewsIn(true)} AND ${COUNTING_TEAM}`).all(...users, repoId) as { id: string }[]
+      return new Set(rows.map(row => row.id))
+    },
+    async repoDependencyReviewState(repoId, user, packages) {
+      const row = await db.prepare(`SELECT ${columns} FROM managed_selected_repo WHERE repo_id = ?`).get(repoId) as SettingRow | undefined
+      if (!row || row.enabled !== 1) return null
+      if (!await db.prepare(`SELECT 1 FROM managed_team t WHERE ${COUNTING_TEAM}`).get(repoId)) return null
+      const canReview = await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ?
+        WHERE ${reviewsIn(true)} AND ${COUNTING_TEAM}`).get(user, repoId) != null
+      return { required: row.required, since: row.since, lockfiles: storedScope(row.lockfiles), canReview, reviews: await publishedReviews(db, repoId, [...new Set(packages)]) }
+    },
+  }
+}