@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/db-methods.ts

@@ -1,7 +1,9 @@
 import { type LinkReportStore, linkReportMethods, linkRevision } from './link-reports.ts'
 import { type RepositoryAliasStore, repositoryAliasMethods } from './repository-aliases.ts'
 import { type DependencyReviewStore, dependencyReviewMethods } from './dependency-reviews.ts'
+import { type RepositoryDependencyReviewStore, repositoryDependencyReviewMethods } from './repository-dependency-reviews.ts'
 import { type TeamNpmScopeStore, teamNpmScopeMethods } from './team-npm-scopes.ts'
+import { type GithubLinkStore, githubLinkMethods } from './github-links.ts'
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
 import { type Role, roleAtLeast } from '../common/managed/roles.ts'
@@ -358,21 +360,26 @@ export interface UserTeam {
   dependencyReview?: boolean
   permissions: TeamUserPermissions
   cacheKey?: string
+  // The team's repository links, by name: its Repositories, whether or not
+  // anything is attached to them yet.
+  repos: TeamRepoLink[]
   reports: UserTeamReport[]
   bundles: UserTeamBundle[]
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends DependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore {
+export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore, GithubLinkStore {
   claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
   finishMaintenanceLease(owner: string, until: number): Promise<void>
   getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
   // Reuse connections within a finite request or one feed polling iteration.
   withRequest?<T>(work: () => Promise<T>): Promise<T>
-  // Upsert the identity; returns the user's opaque id (stable across logins).
+  // Upsert the identity; returns the user's opaque id (stable across logins),
+  // or null for an account linked to a user (github-links.ts), which neither
+  // signs in nor registers. A name chosen from a linked account is kept.
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
-  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string>
+  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string | null>
   createSession(session: ManagedSession, now: number): Promise<void>
   // A sign-in session; never a view session, so a view token in the session
   // cookie authenticates nothing.
@@ -385,6 +392,10 @@ export interface ManagedDb extends DependencyReviewStore, ActivityStore, Comment
   // A view session opened by `viewerSessionId`, while that session is current
   // and its user is still an admin. Presence is the admin's, not the viewed user's.
   viewSessionWithUser(id: string, viewerSessionId: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  // The two above as they read, recording no presence: for a read again in a
+  // request whose first read recorded it.
+  getSessionWithUser(id: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  getViewSessionWithUser(id: string, viewerSessionId: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
   // Store `candidate` unless the session already has an upload key; returns
   // the stored key, or null when the session no longer exists.
   ensureSessionUploadKey(id: string, candidate: string): Promise<string | null>
@@ -406,6 +417,8 @@ export interface ManagedDb extends DependencyReviewStore, ActivityStore, Comment
   deselectRepo(repoId: number): Promise<boolean>
   listSelectedRepos(): Promise<SelectedRepo[]>
   listAllRepos(): Promise<ManagedRepo[]>
+  // A selected repository's full name, active or not; null for none.
+  getRepoFullName(repoId: number): Promise<string | null>
   deactivateRepo(repoId: number): Promise<boolean>
   reactivateRepo(repoId: number): Promise<boolean>
   deleteRepo(repoId: number): Promise<boolean>
@@ -452,6 +465,8 @@ export interface ManagedDb extends DependencyReviewStore, ActivityStore, Comment
   // stamp nor the trail. Every change also appends to managed_finding_triage_event;
   // listTriageHistory walks one finding's trail, newest first.
   listTriage(findingIds: readonly string[]): Promise<TriageRow[]>
+  // The distinct Fix links of those, without the rest of their entries.
+  listTriageFixes(findingIds: readonly string[]): Promise<string[]>
   getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>>; issues: Awaited<ReturnType<ManagedIssueStore['listManagedIssues']>> }>
   applyManagedIssueFixes(sessionId: string, snapshot: TeamReportAccessSnapshot, updates: IssueFixUpdate[]): Promise<boolean>
   // A content-free fingerprint of current annotations, read in one snapshot.
@@ -536,6 +551,15 @@ type SessionRow = {
   uid: string; login: string; name: string | null; avatar: string | null; role: Role
 }
 type ViewSessionRow = SessionRow & { viewerId: string; viewerLogin: string; viewerName: string | null }
+const ownSession = (row: SessionRow) => ({
+  session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey },
+  user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
+})
+const viewSession = (row: ViewSessionRow) => ({
+  session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey,
+    viewer: { id: row.viewerId, login: row.viewerLogin, name: row.viewerName } },
+  user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
+})
 
 type UserRow = { id: string; login: string; name: string | null; role: Role; created: number; lastSeen: number | null; lastActivity: number | null }
 
@@ -563,12 +587,14 @@ function prepareStatements(db: ManagedSql) {
     // Identity refreshes preserve roles. Login can separately bootstrap the
     // configured sole No access user within this same writer transaction.
     upsertUserStmt: db.prepare(
-      `INSERT INTO managed_user (id, github_user_id, login, name, avatar_url, role, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, 'none', ?, ?)
+      `INSERT INTO managed_user (id, github_user_id, login, name, github_name, avatar_url, role, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, 'none', ?, ?)
        ON CONFLICT(github_user_id) DO UPDATE SET
-         login = excluded.login, name = excluded.name,
+         login = excluded.login, github_name = excluded.github_name,
+         name = CASE WHEN managed_user.name_link IS NULL THEN excluded.name ELSE managed_user.name END,
          avatar_url = excluded.avatar_url, updated_at = excluded.updated_at`,
     ),
+    selectLinkedStmt: db.prepare(`SELECT 1 AS linked FROM managed_github_link WHERE github_user_id = ?`),
     selectUserIdStmt: db.prepare(`SELECT id, role FROM managed_user WHERE github_user_id = ?`),
     promoteInitialAdminStmt: db.prepare(
       `UPDATE managed_user SET role = 'admin' WHERE id = ? AND role = 'none'
@@ -681,6 +707,7 @@ function prepareStatements(db: ManagedSql) {
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo WHERE active = 1 ORDER BY full_name ASC`,
     ),
+    selectRepoFullNameStmt: db.prepare(`SELECT full_name AS fullName FROM managed_selected_repo WHERE repo_id = ?`),
     selectAllReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
               installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
@@ -811,6 +838,8 @@ function prepareStatements(db: ManagedSql) {
         WHERE t.finding_id IN (SELECT value FROM json_each(?))
         ORDER BY t.finding_id ASC`,
     ),
+    selectTriageFixesStmt: db.prepare(`SELECT DISTINCT fix FROM managed_finding_triage
+      WHERE finding_id IN (SELECT value FROM json_each(?)) AND fix IS NOT NULL ORDER BY fix`),
     annotationTriageRevisionStmt: db.prepare(`
       SELECT t.finding_id AS id,
         (SELECT e.batch_id FROM managed_finding_triage_event e
@@ -910,10 +939,15 @@ function prepareStatements(db: ManagedSql) {
     renameTeamStmt: db.prepare(`UPDATE managed_team SET name = ?, updated_at = ? WHERE id = ?`),
     setTeamHiddenStmt: db.prepare(`UPDATE managed_team SET hidden = ?, updated_at = ? WHERE id = ?`),
     selectTeamsStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team ORDER BY name ASC`),
+    // `dependencyReview` where the user reviews dependencies in the team
+    // (dependency-reviews.ts reviewsIn): one that reviews them, and a member
+    // who manages, or triages and may see its dependencies; an admin in any.
     selectTeamsForUserStmt: db.prepare(
-      `SELECT t.id AS id, t.slug AS slug, t.name AS name, t.dependency_review AS dependencyReview,
+      `SELECT t.id AS id, t.slug AS slug, t.name AS name,
+              CASE WHEN t.dependency_review = 1 AND (u.role IN ('admin', 'manage') OR (u.role = 'triage' AND tu.view_dependencies = 1))
+                THEN 1 ELSE 0 END AS dependencyReview,
               tu.view_dependencies AS dependencies, tu.view_security AS security
-         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
+         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id JOIN managed_user u ON u.id = tu.user_id
         WHERE tu.user_id = ? AND t.hidden = 0 ORDER BY t.name ASC, t.id ASC`,
     ),
     selectUserTeamScopesStmt: db.prepare(
@@ -1051,6 +1085,9 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
       const rows = (await selectAllReposStmt.all()) as RepoRow[]
       return rows.map(readManagedRepo)
     },
+    async getRepoFullName(repoId: number): Promise<string | null> {
+      return ((await stmts.selectRepoFullNameStmt.get(repoId)) as { fullName: string } | undefined)?.fullName ?? null
+    },
     async deactivateRepo(repoId: number): Promise<boolean> {
       return Number((await deactivateRepoStmt.run(repoId)).changes) > 0
     },
@@ -1275,6 +1312,10 @@ function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit
         actorId: r.actorId, actorLogin: r.actorLogin, actorName: r.actorName, at: r.at,
       }))
     },
+    async listTriageFixes(findingIds: readonly string[]): Promise<string[]> {
+      if (findingIds.length === 0) return []
+      return ((await stmts.selectTriageFixesStmt.all(JSON.stringify(findingIds))) as { fix: string }[]).map(row => row.fix)
+    },
     async listTriage(findingIds: readonly string[]): Promise<TriageRow[]> {
       if (findingIds.length === 0) return []
       const rows = (await selectTriageStmt.all(JSON.stringify(findingIds))) as TriageDbRow[]
@@ -1513,6 +1554,8 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
         cacheKey: createHash('sha256').update(JSON.stringify([
           t.dependencies, t.security, links, scopes.filter(scope => scope.teamId === t.id),
         ])).digest('base64url'),
+        repos: scopes.filter(scope => scope.teamId === t.id).map(scope => ({ repoId: scope.repoId, fullName: scope.fullName, path: scope.path || null }))
+          .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
         reports: reportsByTeam.get(t.id) ?? [],
         bundles: bundlesByTeam.get(t.id) ?? [],
       }))
@@ -1597,7 +1640,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
-    upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
+    upsertUserStmt, selectLinkedStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, ensureUploadKeyStmt, deleteSessionStmt, deleteExpiredStmt,
     selectViewSessionStmt, deleteOtherViewsStmt, insertViewSessionStmt, deleteDemotedViewsStmt,
   } = stmts
@@ -1607,7 +1650,9 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...linkReportMethods(db, key),
     ...repositoryAliasMethods(db),
     ...teamNpmScopeMethods(db),
+    ...githubLinkMethods(db),
     ...dependencyReviewMethods(db),
+    ...repositoryDependencyReviewMethods(db),
     ...bundleBuildLeaseMethods(db),
     ...upstreamCacheMethods(db),
     async claimMaintenanceLease(owner, now, until, migration = false) {
@@ -1619,9 +1664,10 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       await db.prepare('UPDATE managed_maintenance_lease SET expires_at = ? WHERE owner = ?').run(until, owner)
     },
     async upsertUser(user, now, initialAdminGithubId = null) {
+      if (await selectLinkedStmt.get(user.githubUserId)) return null
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
-      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.avatarUrl, now, now)
+      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.name, user.avatarUrl, now, now)
       const row = (await selectUserIdStmt.get(user.githubUserId)) as { id: string; role: Role }
       // Avoid the population check unless this login matches the configured
       // identity and still needs approval. NOT EXISTS stops at any other user.
@@ -1639,10 +1685,11 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       const row = (await selectOwnSessionStmt.get(id, now)) as SessionRow | undefined
       if (row == null) return null
       await touchUserSeenStmt.run(now, row.uid, now)
-      return {
-        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey },
-        user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
-      }
+      return ownSession(row)
+    },
+    async getSessionWithUser(id, now) {
+      const row = (await selectOwnSessionStmt.get(id, now)) as SessionRow | undefined
+      return row == null ? null : ownSession(row)
     },
     async createViewSession(view, now) {
       if (Number((await insertViewSessionStmt.run(view.id, view.csrfToken, now, view.userId, view.viewerSessionId, now)).changes) === 0) return false
@@ -1653,11 +1700,11 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       const row = (await selectViewSessionStmt.get(id, viewerSessionId, now, now)) as ViewSessionRow | undefined
       if (row == null) return null
       await touchUserSeenStmt.run(now, row.viewerId, now)
-      return {
-        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey,
-          viewer: { id: row.viewerId, login: row.viewerLogin, name: row.viewerName } },
-        user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
-      }
+      return viewSession(row)
+    },
+    async getViewSessionWithUser(id, viewerSessionId, now) {
+      const row = (await selectViewSessionStmt.get(id, viewerSessionId, now, now)) as ViewSessionRow | undefined
+      return row == null ? null : viewSession(row)
     },
     async ensureSessionUploadKey(id, candidate) {
       const row = (await ensureUploadKeyStmt.get(candidate, id)) as { uploadKey: string } | undefined

package/server-managed/db-neon.ts

@@ -2,11 +2,13 @@ import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA, GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -25,7 +27,8 @@ export interface PgConnection {
     rows: Record<string, unknown>[]; rowCount?: number | null
     fields?: { name: string; dataTypeID: number }[]
   }>
-  release(): Promise<void>
+  // After a failure the connection's state is unknown: discard it, never reuse it.
+  release(discard?: boolean): Promise<void>
 }
 export type PgConnect = () => Promise<PgConnection>
 // Content/access mutations cooperate on this transaction-scoped lock. Reads,
@@ -36,7 +39,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 27 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 31 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -142,6 +145,37 @@ async function migrateDependencyReviews(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (27)')
 }
 
+// Existing names are the sign-in accounts' own: none was chosen yet.
+async function migrateGithubLinks(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 28')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_LINK_SCHEMA))
+  await db.query(`ALTER TABLE managed_user ${GITHUB_LINK_USER_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('UPDATE managed_user SET github_name = name')
+  await db.query('INSERT INTO managed_schema_version VALUES (28)')
+}
+
+async function migrateRepositoryDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 29')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (29)')
+}
+
+// The lockfiles a repository's dependency review holds to, its columns
+// added since 29 added there too; and a team's published reviews, listed by
+// it, indexed so.
+async function migrateRepositoryDependencyReviewLockfiles(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 30')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id)')
+  await db.query('INSERT INTO managed_schema_version VALUES (30)')
+}
+
+async function migrateRepoUploadIndexes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 31')).rows.length > 0) return
+  await db.query(REPO_UPLOAD_INDEXES)
+  await db.query('INSERT INTO managed_schema_version VALUES (31)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -215,7 +249,8 @@ async function initialize(db: PgConnection): Promise<void> {
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews]) await migrate(db)
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -248,7 +283,7 @@ function requestConnections(connect: PgConnect) {
       const connection = await connect()
       let result: T
       try { result = await work(connection) }
-      catch (error) { await connection.release().catch(() => {}); throw error }
+      catch (error) { await connection.release(true).catch(() => {}); throw error }
       await connection.release()
       return result
     }
@@ -259,7 +294,7 @@ function requestConnections(connect: PgConnect) {
       try { return await work(connection) }
       catch (error) {
         delete request.connection
-        await connection.release().catch(() => {})
+        await connection.release(true).catch(() => {})
         throw error
       }
     })
@@ -275,7 +310,7 @@ function requestConnections(connect: PgConnect) {
     finally {
       request.ended = true
       await request.queue
-      if (failed) await request.connection?.release().catch(() => {})
+      if (failed) await request.connection?.release(true).catch(() => {})
       else await request.connection?.release()
     }
   }
@@ -285,7 +320,8 @@ function requestConnections(connect: PgConnect) {
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
 export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
   const initial = await connect()
-  try { await initialize(initial) } finally { await initial.release() }
+  try { await initialize(initial) } catch (err) { await initial.release(true).catch(() => {}); throw err }
+  await initial.release()
   const { withConnection, withRequest } = requestConnections(connect)
   const context = new AsyncLocalStorage<PgConnection>()
   let closed = false
@@ -348,20 +384,52 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
   return methods
 }
 
-export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}): Promise<ManagedDb> {
-  // Reuse the e2e optional-driver boundary. Requests lease one connection and
-  // close it before returning; no socket must survive a frozen invocation.
-  const { Client, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
-    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query']; on?(event: 'error', listener: (error: Error) => void): void }
+// Idle connections stay open this long between leases, so a warm instance's
+// requests and feed polls (three seconds apart) skip the TLS, WebSocket and
+// Postgres handshake a new connection repeats.
+const NEON_POOL_IDLE_MS = 5_000
+
+type NeonPoolClient = {
+  query: PgConnection['query']
+  release(discard?: boolean): void
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+export type NeonPool = {
+  connect(): Promise<NeonPoolClient>
+  end(): Promise<void>
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+
+// `attachPool` is Vercel's attachDatabasePool on serverless instances: each
+// release keeps the invocation alive until idle connections have closed, so
+// no socket survives a frozen instance.
+export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}, attachPool?: (pool: NeonPool) => void): Promise<ManagedDb> {
+  // Reuse the e2e optional-driver boundary.
+  const { Pool, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
+    Pool: new (config: { connectionString: string; max: number; idleTimeoutMillis: number }) => NeonPool
     neonConfig: { webSocketConstructor: typeof WebSocket }
   }
   neonConfig.webSocketConstructor = WebSocket
-  return openPostgresManagedDb(async () => {
-    const client = new Client(url)
-    // A remote disconnect between operations must reject the next query, not
-    // become an unhandled EventEmitter error while the request is reading Blob.
-    client.on?.('error', () => {})
-    try { await client.connect() } catch (err) { await client.end().catch(() => {}); throw err }
-    return { query: (sql, params) => client.query(sql, params), release: () => client.end() }
-  }, options, true)
+  // Leases stay unbounded, one per request or operation as before: a cap would
+  // stall a request that holds one while it awaits work needing another.
+  const pool = new Pool({ connectionString: url, max: Infinity, idleTimeoutMillis: NEON_POOL_IDLE_MS })
+  // The pool evicts an idle connection the server closed. Neither that nor a
+  // remote disconnect while leased may become an unhandled EventEmitter error;
+  // a leased one must instead reject its next query, and is then discarded.
+  pool.on('error', () => {})
+  attachPool?.(pool)
+  const failed = new WeakSet<NeonPoolClient>(), watched = new WeakSet<NeonPoolClient>()
+  let ending: Promise<void> | undefined
+  const end = () => ending ??= pool.end()
+  let db: ManagedDb
+  try {
+    db = await openPostgresManagedDb(async () => {
+      const client = await pool.connect()
+      if (!watched.has(client)) { watched.add(client); client.on('error', () => { failed.add(client) }) }
+      return { query: (sql, params) => client.query(sql, params),
+        release: discard => Promise.try(() => client.release(discard === true || failed.has(client))) }
+    }, options, true)
+  } catch (err) { await end().catch(() => {}); throw err }
+  const close = db.close
+  return { ...db, async close() { try { await close() } finally { await end() } } }
 }

package/server-managed/db-schema.ts

@@ -3,9 +3,14 @@ import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA } from './github-links.ts'
 
 // Created after the column migration, which predates it on older databases.
 export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
+// What a team's scopes join reports and bundles on: their repository, and the
+// directory in it. Created after the column migrations, as above.
+export const REPO_UPLOAD_INDEXES = `CREATE INDEX IF NOT EXISTS managed_report_repo_idx ON managed_report(repo_id, repo_directory);
+CREATE INDEX IF NOT EXISTS managed_bundle_repo_idx ON managed_bundle(repo_id, repo_directory);`
 
 export const MANAGED_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_user (
@@ -64,7 +69,13 @@ CREATE TABLE IF NOT EXISTS managed_selected_repo (
   added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   added_at        INTEGER NOT NULL,
   updated_at      INTEGER NOT NULL,
-  active          INTEGER NOT NULL DEFAULT 1
+  active          INTEGER NOT NULL DEFAULT 1,
+  -- Its pull requests' dependencies reviewed (repository-dependency-reviews.ts):
+  -- as many published reviews required of each version, and the commit at
+  -- whose lockfiles' versions none is (null for none).
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  dependency_reviews_required INTEGER NOT NULL DEFAULT 1,
+  dependency_review_since TEXT
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS selected_repo_full_name_idx ON managed_selected_repo(full_name);
@@ -224,4 +235,4 @@ CREATE TABLE IF NOT EXISTS managed_team_user (
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
-` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA + GITHUB_LINK_SCHEMA

package/server-managed/db.ts

@@ -7,7 +7,9 @@ import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -79,6 +81,10 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
       ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     }
     ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    // Existing names are the sign-in accounts' own: none was chosen yet.
+    for (const [column, type] of GITHUB_LINK_USER_COLUMNS) {
+      if (ensureColumn(db, 'managed_user', column, type) && column === 'github_name') db.exec('UPDATE managed_user SET github_name = name')
+    }
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.
@@ -107,6 +113,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     if (addedVisible) db.prepare('UPDATE managed_report SET visible = 1 WHERE visible = 0').run()
     ensureColumn(db, 'managed_bundle', 'uploaded_by_login', 'TEXT')
     ensureColumn(db, 'managed_bundle', 'repo_directory', "TEXT NOT NULL DEFAULT ''")
+    db.exec(REPO_UPLOAD_INDEXES)
     ensureColumn(db, 'managed_bundle', 'visible', 'INTEGER NOT NULL DEFAULT 1')
     // Existing rows stay NULL (unknown): some may have been built on the server.
     ensureColumn(db, 'managed_bundle', 'provenance', 'TEXT')
@@ -116,6 +123,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
+    for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')

package/server-managed/dependabot-access.ts

@@ -0,0 +1,60 @@
+// A repository's Dependabot alerts for a repository risk scan, read with the
+// App's installation token where the admin's own access lets them see them on
+// GitHub, as the README's repository risk section tells.
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'
+import { GithubApiError, type GithubIdentity, githubRepoPermission, repoAccessToken, repositoryInstallation } from './github-app.ts'
+
+// The levels GitHub lets see a repository's Dependabot alerts by default
+// (maintain's reads `write`).
+const SEES_ALERTS: ReadonlySet<string> = new Set(['admin', 'write'])
+// Failures of verifying the sign-in that are the sign-in's own: no token, or
+// one of another account (repository-browser.ts getIdentity), or one GitHub no
+// longer takes. Any other, as GitHub failing to answer, is told as it is.
+const UNVERIFIED: ReadonlySet<string> = new Set(['no-repository', 'github-unauthorized'])
+
+// What of a repository's reader (repository-browser.ts) the alerts are asked
+// with: the user's verified identity, and their permission level where its
+// access gate asked GitHub of it already.
+export interface AlertsReader {
+  identity(): Promise<GithubIdentity>
+  permission(): string | null
+}
+
+// Alerts read, and their `recheck`: the user's access to them checked again,
+// asked of GitHub afresh, just before they are told (repository-risk.ts), as
+// access to the repository is, as it may be withdrawn meanwhile.
+export interface AlertsRead { alerts: DependabotAlert[]; recheck(): Promise<void> }
+
+// `repo`'s Dependabot alerts (dependabot-alerts.ts), read with the token of
+// the App's installation GitHub tells covers it now, its token checked to read
+// it (github-app.ts repositoryInstallation), never the one its connection
+// keeps, which may no longer cover it, once the user's own permission on it
+// lets them see them; else refused, the alerts not asked:
+// `dependabot-not-installed`, `dependabot-unverified`, or
+// `dependabot-forbidden`, naming their permission. The token is asked each
+// time of repoAccessToken, which renews it before it expires, as the recheck
+// may come long after the alerts are read.
+export async function appDependabotAlerts(config: ManagedConfig, repo: Pick<SelectedRepo, 'repoId' | 'fullName'>, reader: AlertsReader,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AlertsRead> {
+  const id = await repositoryInstallation(config, repo.repoId, repo.fullName, fetchImpl)
+  const tokenNow = async () => {
+    const token = await repoAccessToken(config, id, fetchImpl)
+    if (token == null) throw new GithubApiError(403, 'dependabot-not-installed')
+    return token
+  }
+  const token = await tokenNow()
+  let who
+  try { who = await reader.identity() } catch (error) {
+    throw error instanceof GithubApiError && UNVERIFIED.has(error.message) ? new GithubApiError(403, 'dependabot-unverified') : error
+  }
+  const seen = (permission: string) => {
+    if (!SEES_ALERTS.has(permission)) {
+      throw new GithubApiError(403, 'dependabot-forbidden', null, `@${who.login}'s access to this repository (${permission}) doesn't let them see its Dependabot alerts on GitHub`)
+    }
+  }
+  seen(reader.permission() ?? await githubRepoPermission(repo.fullName, token, who, fetchImpl))
+  const alerts = await dependabotAlerts(repo.fullName, token, fetchImpl)
+  return { alerts, recheck: async () => { seen(await githubRepoPermission(repo.fullName, await tokenNow(), who, fetchImpl)) } }
+}