@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.46

package/server-managed/github-app.ts

@@ -7,8 +7,10 @@ import { createHash, createSign } from 'node:crypto'
 import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
 import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
+import { onTokenRejected, shareGithubRead, tokenRejected } from './github-requests.ts'
 
 export { GithubApiError } from './github-errors.ts'
+export { onTokenRejected } from './github-requests.ts'
 
 const GITHUB_API = 'https://api.github.com'
 const API_VERSION = '2022-11-28'
@@ -22,12 +24,12 @@ interface InstallationTokenEntry { token: string | null; expiresAt: number; pend
 // cached here. Bound memory per transport and separate App/key/install scopes.
 const installationTokens = new WeakMap<typeof fetch, Map<string, InstallationTokenEntry>>()
 
-function discardInstallationToken(token: string | null, fetchImpl: typeof fetch): void {
-  if (!token) return
+// A token GitHub rejected (401): an installation's no longer reused.
+onTokenRejected((token, fetchImpl) => {
   const cache = installationTokens.get(fetchImpl)
   if (!cache) return
   for (const [key, entry] of cache) if (entry.token === token) cache.delete(key)
-}
+})
 
 // One listed repository. Carries the context to read its contents later:
 // `installationId` mints an App installation token (Contents: Read) for a repo
@@ -69,8 +71,12 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 // One GitHub API call returning parsed JSON, optionally Bearer-authed by a
 // user token, App JWT, or installation token, `body` sent as JSON (a GraphQL
 // query's, given longer to answer). Network / non-2xx / malformed fold into a
-// GithubApiError (401 passes through for the caller to handle).
-export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown): Promise<unknown> {
+// GithubApiError (401 passes through for the caller to handle). Identical GETs
+// share an outstanding read through its body. POSTs only opt in for read-only
+// GraphQL queries (repository-history.ts), never for mutations or token mints.
+export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
+  readOnly = method === 'GET'): Promise<unknown> {
+  if (readOnly) return shareGithubRead(fetchImpl, JSON.stringify([url, token, method, body]), () => githubJson(url, token, fetchImpl, method, body, false))
   let res: Response
   const started = Date.now()
   try {
@@ -85,7 +91,7 @@ export async function githubJson(url: string, token: string | null, fetchImpl: t
       ...(body === undefined ? {} : { body: JSON.stringify(body) }),
     })
   } catch (error) { throw githubUnreachable(error, started) }
-  if (res.status === 401) discardInstallationToken(token, fetchImpl)
+  if (res.status === 401 && token) tokenRejected(token, fetchImpl)
   if (!res.ok) await throwGithubResponseError(res)
   // The answer's body is read within the same timeout: one not read whole is
   // GitHub not reached, as one not answered is; only one that isn't JSON is

package/server-managed/github-issue-links.ts

@@ -52,6 +52,15 @@ function readPage(job: Job, item: Issue | Pull, metadata: Map<string, Metadata>)
 
 function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string, Repository>, checkedAt: number, metadata: Map<string, Metadata>) {
   const updates: IssueFixUpdate[] = []
+  // The issues each job's issue is, by repository and number, read once.
+  const byIssue = new Map<string, ManagedIssue[]>()
+  for (const issue of issues) {
+    const ref = parseGithubFixUrl(issue.issueUrl)
+    if (ref?.kind !== 'issue') continue
+    const key = `${issue.repoId}:${ref.number}`, same = byIssue.get(key)
+    if (same) same.push(issue)
+    else byIssue.set(key, [issue])
+  }
   for (const job of jobs) {
     if (!job.linked || !job.complete) continue
     // "Last" means the newest PR by creation time, never its latest comment.
@@ -62,11 +71,8 @@ function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string,
     if (latest && (!repo || repo.repoId !== latest.repository.databaseId)) continue
     const next = latest ? `https://github.com/${repo!.github}/pull/${latest.number}` : null
     if (latest && next) metadata.set(next, { url: next, ...itemMetadata(latest, 'pull')! })
-    for (const issue of issues) {
-      const ref = parseGithubFixUrl(issue.issueUrl)
-      if (ref?.kind === 'issue' && ref.number === job.number && issue.repoId === job.repo.repoId) {
-        updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
-      }
+    for (const issue of byIssue.get(`${job.repo.repoId}:${job.number}`) ?? []) {
+      updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
     }
   }
   return updates

package/server-managed/github-pulls.ts

@@ -222,6 +222,6 @@ export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot
   })
 }
 
-export function storedFixUrls(entries: { fix: string | null }[]): string[] {
-  return [...new Set(entries.flatMap(entry => entry.fix && parseGithubFixUrl(entry.fix) ? [entry.fix] : []))].toSorted()
+export function storedFixUrls(fixes: string[]): string[] {
+  return [...new Set(fixes.filter(fix => parseGithubFixUrl(fix)))].toSorted()
 }

package/server-managed/github-requests.ts

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto'
+
+// Only outstanding reads: a completed answer (or failure) is never reused.
+// Keep transports and credentials separate, including anonymous reads. When
+// full, new reads proceed normally rather than waiting for an unrelated one.
+const MAX_PENDING_READS = 1000
+type PendingRead = { promise: Promise<unknown>; shared: boolean }
+const pendingReads = new WeakMap<typeof fetch, Map<string, PendingRead>>()
+
+// Invalidate installation credentials and access verdicts when GitHub rejects
+// a token, including when several callers share the rejected request.
+const rejectedTokenListeners = new Set<(token: string, fetchImpl: typeof fetch) => void>()
+export function onTokenRejected(listener: (token: string, fetchImpl: typeof fetch) => void): void {
+  rejectedTokenListeners.add(listener)
+}
+export function tokenRejected(token: string, fetchImpl: typeof fetch): void {
+  for (const listener of rejectedTokenListeners) listener(token, fetchImpl)
+}
+
+export async function shareGithubRead<T>(fetchImpl: typeof fetch, request: string, read: () => Promise<T>): Promise<T> {
+  let pending = pendingReads.get(fetchImpl)
+  if (!pending) { pending = new Map(); pendingReads.set(fetchImpl, pending) }
+  // The request includes credentials and query variables. Retain only its hash.
+  const key = createHash('sha256').update(request).digest('hex')
+  const held = pending.get(key)
+  if (held) {
+    held.shared = true
+    return structuredClone(await held.promise) as T
+  }
+  if (pending.size >= MAX_PENDING_READS) return read()
+  const entry: PendingRead = { promise: read(), shared: false }
+  pending.set(key, entry)
+  try {
+    const value = await entry.promise
+    // Independent objects for coalesced callers, without copying large trees
+    // or histories when nobody joined the read.
+    return (entry.shared ? structuredClone(value) : value) as T
+  } finally { pending.delete(key) }
+}

package/server-managed/http-response.ts

@@ -15,8 +15,16 @@ export function attachmentDisposition(filename: string): string {
 // already materialized by the authorization/filtering layer before we get here.
 export function writeResponse(res: ServerResponse, body: string | Buffer): void {
   const bytes = typeof body === 'string' ? Buffer.from(body) : body
-  if (bytes.length <= UPLOAD_CHUNK_BYTES) { res.end(body); return }
-  for (let offset = 0; offset < bytes.length; offset += 64 * 1024) res.write(bytes.subarray(offset, offset + 64 * 1024))
+  writeResponseParts(res, [bytes], bytes.length)
+}
+
+// A body of `length` bytes held in parts, written as writeResponse writes
+// one without first copying them into one buffer.
+export function writeResponseParts(res: ServerResponse, parts: Buffer[], length: number): void {
+  if (length <= UPLOAD_CHUNK_BYTES) { res.end(parts.length === 1 ? parts[0] : Buffer.concat(parts, length)); return }
+  for (const part of parts) {
+    for (let offset = 0; offset < part.length; offset += 64 * 1024) res.write(part.subarray(offset, offset + 64 * 1024))
+  }
   res.end()
 }