@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.48

package/server-managed/db-neon.ts

@@ -1,4 +1,4 @@
-import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
@@ -17,6 +17,7 @@ import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA, uploadAction } from './activity.ts'
 import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { countStatement, timed } from './request-timing.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -35,11 +36,18 @@ export type PgConnect = () => Promise<PgConnection>
 // presence updates, and maintenance leases do not take it. Also fences migrations.
 const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
 
+// Whether every version up to the latest is recorded, in one round trip at
+// a cold start: a database with no versions table yet (undefined_table) has
+// none. Outside a transaction, so the failed read aborts nothing.
+const SCHEMA_VERSIONS = 32
 async function currentSchema(db: PgConnection): Promise<boolean> {
-  const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
-  if (!exists) return false
-  const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 31 }, (_, i) => i + 1).every(version => versions.has(version))
+  try {
+    const { rows } = await db.query(`SELECT count(*) AS n FROM managed_schema_version WHERE version BETWEEN 1 AND ${SCHEMA_VERSIONS}`)
+    return Number(rows[0]?.['n']) === SCHEMA_VERSIONS
+  } catch (error) {
+    if ((error as { code?: unknown })?.code === '42P01') return false
+    throw error
+  }
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -176,6 +184,14 @@ async function migrateRepoUploadIndexes(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (31)')
 }
 
+// The shasums of the tarballs a dependency review reads, none known of
+// those written before.
+async function migrateDependencyReviewShasums(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 32')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_dependency_review ${DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (32)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -250,7 +266,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
     for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
-      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes]) await migrate(db)
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes, migrateDependencyReviewShasums]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -318,7 +334,12 @@ function requestConnections(connect: PgConnect) {
 }
 
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
-export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+export async function openPostgresManagedDb(leased: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+  // Each statement told in its request's Server-Timing (request-timing.ts).
+  const connect: PgConnect = async () => {
+    const connection = await leased()
+    return { query: (sql, params) => { countStatement(); return connection.query(sql, params) }, release: discard => connection.release(discard) }
+  }
   const initial = await connect()
   try { await initialize(initial) } catch (err) { await initial.release(true).catch(() => {}); throw err }
   await initial.release()
@@ -424,7 +445,9 @@ export async function openNeonManagedDb(url: string, options: ManagedDbOptions =
   let db: ManagedDb
   try {
     db = await openPostgresManagedDb(async () => {
-      const client = await pool.connect()
+      // A lease's wait told in its request's Server-Timing: a new connection's
+      // TLS, WebSocket and Postgres handshake, where the pool had none idle.
+      const client = await timed('conn', () => pool.connect())
       if (!watched.has(client)) { watched.add(client); client.on('error', () => { failed.add(client) }) }
       return { query: (sql, params) => client.query(sql, params),
         release: discard => Promise.try(() => client.release(discard === true || failed.has(client))) }

package/server-managed/db.ts

@@ -10,6 +10,7 @@ import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
 import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS } from './dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -124,6 +125,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
     for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
+    for (const [column, type] of DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_dependency_review', column, type)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')

package/server-managed/dependabot-access.ts

@@ -1,6 +1,6 @@
 // A repository's Dependabot alerts for a repository risk scan, read with the
 // App's installation token where the admin's own access lets them see them on
-// GitHub, as the README's repository risk section tells.
+// GitHub, as doc/bundles.md's repository risk scan section tells.
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'

package/server-managed/dependency-review-comments.ts

@@ -18,11 +18,14 @@ const MAX_FORMATTED = 1_000_000
 // read after, every one formatted.
 const REVIEWS_AT_ONCE = 200
 
-// `review` as the hook is given it, the version it is of as `locked`, a
-// pull request's lockfile, locks it where it is one's.
+// `review` as the hook is given it: each version with the integrity and
+// shasum the review keeps of the tarball it read, and the version it is of
+// with the patch `locked`, a pull request's lockfile, locks it with, where it
+// is one's.
 function entryOf(review: DependencyReview, locked?: AddedPackage | undefined): DependencyReviewEntry {
-  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '' },
-    new: { name: review.package, version: review.version, integrity: review.integrity, ...locked?.shasum ? { shasum: locked.shasum } : {},
+  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '',
+      ...review.baseShasum ? { shasum: review.baseShasum } : {} },
+    new: { name: review.package, version: review.version, integrity: review.integrity, ...review.shasum ? { shasum: review.shasum } : {},
       ...locked?.patchHash ? { patchHash: locked.patchHash } : {} },
     status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
     files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),

package/server-managed/dependency-reviews.ts

@@ -7,11 +7,15 @@ export interface ReviewContext {
   ecosystem: 'npm'; package: string; version: string; integrity: string
   basePackage: string | null; baseVersion: string | null; baseIntegrity: string | null
 }
+// The shasums (sha1s, in hex) of the tarballs a review reads, its version's
+// and its base's, where npm tells them: each held, with its integrity, to the
+// tarball its reviewer was shown, as a review is written (http.ts).
+export interface ReviewedTarballs { shasum: string | null; baseShasum: string | null }
 export interface ReviewInput { file: string; comment: string; status: ReviewVerdict | null }
 export interface ReviewEntry extends ReviewInput { id: string; time: number }
 export interface ReviewTeam { id: string; name: string }
-export interface DependencyReview extends ReviewContext, ReviewSummary {
-  id: string; user: string | null; userLogin: string; time: number; revision: number
+export interface DependencyReview extends ReviewContext, ReviewedTarballs, ReviewSummary {
+  id: string; user: string | null; userLogin: string; userName: string | null; time: number; revision: number
   publishedAt: number | null; revokedAt: number | null; entries: ReviewEntry[]; teams: ReviewTeam[]; files: string[] | null
   nonTextFiles: string[] | null
   status: ReviewVerdict | null; comment: string
@@ -30,14 +34,15 @@ export interface DependencyReviewStore {
   // The reviews published to team `teamId`, revoked ones too, the latest
   // published first, a page on from `before` (when it was published, and
   // its id), for one who reads them there (reviewsIn); null for another.
+  // In one statement.
   listTeamDependencyReviews(teamId: string, user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null } | null>
-  // Whether `user` reads the reviews published to team `teamId` (reviewsIn).
-  readsTeamDependencyReviews(teamId: string, user: string): Promise<boolean>
   listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
   listDependencyReviewEnabledTeams(): Promise<string[]>
   setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
   discardDependencyReview(sessionId: string, reviewId: string, revision: number): Promise<void>
-  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number): Promise<DependencyReview>
+  // Written with the shasums of the tarballs read (`tarballs`), which a
+  // draft keeps as it is begun, saved and published; none where not told.
+  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number, tarballs?: ReviewedTarballs): Promise<DependencyReview>
 }
 
 // An unpublished review belongs only to its author. Publication freezes all
@@ -51,7 +56,8 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review (
   package TEXT NOT NULL, version TEXT NOT NULL, integrity TEXT NOT NULL,
   base_package TEXT NOT NULL, base_version TEXT NOT NULL, base_integrity TEXT NOT NULL,
   time INTEGER NOT NULL, revision INTEGER NOT NULL, published_at INTEGER, revoked_at INTEGER, files TEXT,
-  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT ''
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT '',
+  shasum TEXT NOT NULL DEFAULT '', base_shasum TEXT NOT NULL DEFAULT ''
 ) STRICT;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_context_idx
   ON managed_dependency_review(ecosystem, package, version, integrity, base_package, base_version, base_integrity, time);
@@ -72,13 +78,19 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
 `
+// The columns added since the table was, for a database that has it already.
+export const DEPENDENCY_REVIEW_COLUMNS = [['shasum', "TEXT NOT NULL DEFAULT ''"], ['base_shasum', "TEXT NOT NULL DEFAULT ''"]] as const
 const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
 const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
 const contextWhere = `${targetWhere} AND base_package = ? AND base_version = ? AND base_integrity = ?`
-const columns = `id, user_id AS user, user_login AS userLogin, ecosystem, package, version, integrity,
+// Its author by the login they reviewed as, and by the name the app's user
+// has now (null once they are none, or have none), as the lists show them.
+const columns = `id, user_id AS user, user_login AS userLogin, (SELECT n.name FROM managed_user n WHERE n.id = user_id) AS userName, ecosystem, package, version, integrity,
   NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
+  NULLIF(shasum, '') AS shasum, NULLIF(base_shasum, '') AS baseShasum,
   time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
 const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
+const shasums = (tarballs: ReviewedTarballs | undefined) => [tarballs?.shasum ?? '', tarballs?.baseShasum ?? '']
 
 // Who reviews dependencies in team `t`, user `u` as the query joins them: an
 // admin, in any team; a member who manages, in theirs; a member who triages,
@@ -124,8 +136,9 @@ async function requireReviewer(db: ManagedSql, user: string) {
   if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
 }
 
+type ReviewRow = Omit<DependencyReview, 'files' | 'entries' | 'teams' | keyof ReviewSummary> & { files: string | null }
 async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
-  const reviews = rows as (Omit<DependencyReview, 'files'> & { files: string | null })[]
+  const reviews = rows as ReviewRow[]
   if (reviews.length === 0) return []
   const ids = reviews.map(review => review.id), placeholders = ids.map(() => '?').join(',')
   const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
@@ -145,16 +158,24 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
     return of
   }
   const [entriesOf, teamsOf] = [byReview(entries), byReview(linked)]
-  return reviews.map(review => {
-    const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
-    const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
-    const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
-    const ownEntries = fileEntries((entriesOf.get(review.id) ?? []) as ReviewEntry[])
-    return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: (teamsOf.get(review.id) ?? []) as ReviewTeam[] }
-  })
+  return reviews.map(review => expanded(review, (entriesOf.get(review.id) ?? []) as ReviewEntry[], (teamsOf.get(review.id) ?? []) as ReviewTeam[]))
 }
+// A review as its row, its entries and the teams its reader reads it in
+// tell it: its files' snapshot, its entries a file's each (fileEntries), and
+// what they sum up to.
+function expanded(review: ReviewRow, entries: ReviewEntry[], readIn: ReviewTeam[]): DependencyReview {
+  const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+  const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+  const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+  const ownEntries = fileEntries(entries)
+  return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: readIn }
+}
+// Rows gathered into one JSON array value (json_group_array): its text on
+// SQLite, parsed already on Postgres, where none gather as NULL.
+export const gathered = <T>(value: unknown): T[] => value == null ? [] : (typeof value === 'string' ? JSON.parse(value) : value) as T[]
 
-async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number) {
+async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number,
+  tarballs: ReviewedTarballs | undefined) {
   if (!current || current.revokedAt !== null) return conflict()
   const allowed = new Set((await teams(db, user)).map(team => team.id))
   const selected = [...new Set(change.teamIds)]
@@ -164,8 +185,9 @@ async function publish(db: ManagedSql, current: DependencyReview | undefined, us
     if (!summarizeReview(entries, change.files, change.nonTextFiles).checkedFiles) throw new ManagedMutationError(400, 'no-reviewed-files')
     if (!change.final || !allowedReviewVerdicts(entries.filter(entry => !change.nonTextFiles.includes(entry.file))).includes(change.final.status)) throw new ManagedMutationError(400, 'bad-final-verdict')
     if (needsPackageJsonReview(entries, change.files, change.nonTextFiles)) throw new ManagedMutationError(400, 'package-json-not-reviewed')
-    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, revision = revision + 1 WHERE id = ?`)
-      .run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }), change.final.status, change.final.comment, current.id)
+    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, shasum = ?, base_shasum = ?, revision = revision + 1
+      WHERE id = ?`).run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }),
+      change.final.status, change.final.comment, ...shasums(tarballs), current.id)
   } else {
     if (change.final) return conflict()
     await db.prepare('UPDATE managed_dependency_review SET revision = revision + 1 WHERE id = ?').run(current.id)
@@ -193,17 +215,34 @@ async function listContext(db: ManagedSql, context: ReviewContext, user: string,
   return expandReviews(db, rows, user)
 }
 
-const readsTeam = async (db: ManagedSql, teamId: string, user: string) =>
-  Boolean(await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}`).get(user, teamId))
-
+// A team's page of reviews in one statement: a row of its reader `v` where
+// they read them there (reviewsIn), none for another, with each review on
+// a row of its own, its entries and the teams `v` reads it in (as
+// expandReviews reads them) each one JSON array.
 async function listTeam(db: ManagedSql, teamId: string, user: string, before: { time: number; id: string } | null) {
-  if (!await readsTeam(db, teamId, user)) return null
-  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
-    WHERE rt.team_id = ? AND r.published_at IS NOT NULL ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
-    ORDER BY r.published_at DESC, r.id DESC LIMIT 51`).all(teamId, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
-  const page = rows.slice(0, 50)
+  const rows = await db.prepare(`WITH reader AS (
+      SELECT u.id AS id FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}
+    ), page AS (
+      SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
+      WHERE rt.team_id = ? AND r.published_at IS NOT NULL AND EXISTS (SELECT 1 FROM reader)
+        ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
+      ORDER BY r.published_at DESC, r.id DESC LIMIT 51
+    )
+    SELECT v.id AS reader, p.*,
+      (SELECT json_group_array(json_object('id', e.id, 'file', e.file, 'comment', e.comment, 'status', e.status, 'time', e.time) ORDER BY e.time, e.id)
+        FROM managed_dependency_file_review e WHERE e.review_id = p.id) AS entries,
+      (SELECT json_group_array(json_object('id', t.id, 'name', t.name) ORDER BY t.name, t.id)
+        FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = v.id
+        WHERE rt.review_id = p.id AND (p.user = u.id OR (${reviewsIn(false)}))) AS teams
+    FROM reader v LEFT JOIN page p ON 1 = 1
+    ORDER BY p.publishedAt DESC, p.id DESC`).all(user, teamId, teamId, ...before ? [before.time, before.time, before.id] : []) as
+    (ReviewRow & { reader: string; entries: unknown; teams: unknown })[]
+  if (rows.length === 0) return null
+  const reviews = rows.filter(row => row.id != null)
+  const page = reviews.slice(0, 50)
   const last = page.at(-1)
-  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
+  return { reviews: page.map(({ reader: _reader, entries, teams: readIn, ...review }) => expanded(review, gathered(entries), gathered(readIn))),
+    next: reviews.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
 }
 
 async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
@@ -236,7 +275,6 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         ORDER BY time, id`).all(user, ...ids), user)
     },
     listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
-    readsTeamDependencyReviews: (teamId, user) => readsTeam(db, teamId, user),
     async getLatestOwnDependencyReview(user, target) {
       const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
         WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
@@ -258,7 +296,7 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
     },
     listDependencyReviewTeams: user => teams(db, user),
     listDependencyReviews: (context, user, allBases = false) => listContext(db, context, user, allBases),
-    async changeDependencyReview(context, sessionId, change, now) {
+    async changeDependencyReview(context, sessionId, change, now, tarballs) {
       const user = await actor(db, sessionId)
       if (change.action !== 'revoke' && change.action !== 'publish') await requireReviewer(db, user.id)
       let id = change.reviewId
@@ -274,8 +312,8 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         if (await unpublished()) return conflict()
         const next = randomUUID()
         await db.prepare(`INSERT INTO managed_dependency_review
-          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, time, revision)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), now)
+          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, shasum, base_shasum, time, revision)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), ...shasums(tarballs), now)
         return next
       }
       if (change.action === 'start') {
@@ -294,11 +332,11 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         if (!current || current.publishedAt === null || current.revokedAt !== null) return conflict()
         await db.prepare('UPDATE managed_dependency_review SET revoked_at = ?, revision = revision + 1 WHERE id = ?').run(now, id)
       } else if (change.action === 'publish') {
-        await publish(db, current, user.id, change, now)
+        await publish(db, current, user.id, change, now, tarballs)
       } else {
         if (current?.publishedAt != null) return conflict()
         if (change.entry.status === null && !change.entryId) throw new ManagedMutationError(400, 'bad-review')
-        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, revision = revision + 1 WHERE id = ?').run(now, id)
+        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, shasum = ?, base_shasum = ?, revision = revision + 1 WHERE id = ?').run(now, ...shasums(tarballs), id)
         else { if (change.entryId) return conflict(); id = await create() }
         await saveFile(db, id, change.entry, change.entryId, now)
       }

package/server-managed/github-accounts.ts

@@ -1,6 +1,8 @@
 // GitHub accounts as GitHub's REST and GraphQL APIs name them, where a
 // repository's activity names its authors (repository-history.ts and the
 // Commits, Issues, Agents and Pulse tabs' readers).
+import { githubGraphql } from './github-graphql.ts'
+
 const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
 
 // An account as GitHub names it: its login, else null, and its numeric id
@@ -23,7 +25,8 @@ export const actorOf = (actor: GraphAccount) => accountOf({ login: actor?.login,
 // GitHub knows its address for; else, as GitHub's REST API does, the account
 // whose noreply address its address is, `<id>+<login>@users.noreply.github.com`:
 // a GitHub App's bot's, which is no user (GraphQL's `user` is a User's, never
-// a bot's).
+// a bot's). One by GitHub's older no-reply address, `<login>@users.noreply.github.com`,
+// naming no id, its user looked up by its login (repository-history.ts linkNoreplyUsers).
 const NOREPLY = /^([1-9]\d{0,11})\+([^@]+)@users\.noreply\.github\.com$/iu
 export type GraphActor = { email?: unknown; user?: GraphAccount | null }
 export function commitAccount(author: GraphActor | null | undefined): NamedAccount {
@@ -31,3 +34,27 @@ export function commitAccount(author: GraphActor | null | undefined): NamedAccou
   const noreply = user.id === null && typeof author?.email === 'string' ? NOREPLY.exec(author.email) : null
   return noreply ? accountOf({ login: noreply[2], id: Number(noreply[1]) }) : user
 }
+
+// GitHub's no-reply address of old, `<login>@users.noreply.github.com`, which
+// names no id: GitHub links the commits it authors to the account of its
+// login, as its REST API names them, but its GraphQL API names no user for it.
+const NOREPLY_LOGIN = /^([A-Za-z\d][A-Za-z\d-]{0,38})@users\.noreply\.github\.com$/iu
+const MAX_NOREPLY_LOGINS = 100
+
+// Commits' authors and co-authors (`actors`), as GitHub's GraphQL API names
+// them, those it names no user for by such an address named the user of its
+// login, as GitHub links them: those logins, as many as MAX_NOREPLY_LOGINS,
+// looked up in one query, where any is.
+export async function linkNoreplyUsers(actors: (GraphActor | null | undefined)[], token: string, fetchImpl: typeof fetch): Promise<void> {
+  const unnamed = actors.flatMap(actor => {
+    const login = actor && !actor.user && typeof actor.email === 'string' ? NOREPLY_LOGIN.exec(actor.email)?.[1]?.toLowerCase() : undefined
+    return login ? [{ actor: actor!, login }] : []
+  })
+  const logins = [...new Set(unnamed.map(({ login }) => login))].slice(0, MAX_NOREPLY_LOGINS)
+  if (logins.length === 0) return
+  const query = `query(${logins.map((_, at) => `$l${at}: String!`).join(', ')}) { ${logins.map((_, at) => `u${at}: user(login: $l${at}) { login databaseId }`).join(' ')} }`
+  const data = await githubGraphql(query, Object.fromEntries(logins.map((login, at) => [`l${at}`, login])), token, fetchImpl,
+    error => error?.type === 'NOT_FOUND') as Record<string, GraphAccount> | null
+  const users = new Map(logins.map((login, at) => [login, data?.[`u${at}`] ?? null]))
+  for (const { actor, login } of unnamed) actor.user = users.get(login) ?? null
+}

package/server-managed/github-app.ts

@@ -8,6 +8,7 @@ import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
 import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 import { onTokenRejected, shareGithubRead, tokenRejected } from './github-requests.ts'
+import { timed } from './request-timing.ts'
 
 export { GithubApiError } from './github-errors.ts'
 export { onTokenRejected } from './github-requests.ts'
@@ -74,31 +75,34 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 // GithubApiError (401 passes through for the caller to handle). Identical GETs
 // share an outstanding read through its body. POSTs only opt in for read-only
 // GraphQL queries (repository-history.ts), never for mutations or token mints.
-export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
+export function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
   readOnly = method === 'GET'): Promise<unknown> {
   if (readOnly) return shareGithubRead(fetchImpl, JSON.stringify([url, token, method, body]), () => githubJson(url, token, fetchImpl, method, body, false))
-  let res: Response
-  const started = Date.now()
-  try {
-    res = await fetchImpl(url, {
-      method,
-      signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
-      redirect: 'error',
-      headers: {
-        ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
-        ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
-      },
-      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    })
-  } catch (error) { throw githubUnreachable(error, started) }
-  if (res.status === 401 && token) tokenRejected(token, fetchImpl)
-  if (!res.ok) await throwGithubResponseError(res)
-  // The answer's body is read within the same timeout: one not read whole is
-  // GitHub not reached, as one not answered is; only one that isn't JSON is
-  // malformed.
-  try { return await res.json() } catch (error) {
-    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
-  }
+  // Each call told in its request's Server-Timing (request-timing.ts).
+  return timed('gh', async () => {
+    let res: Response
+    const started = Date.now()
+    try {
+      res = await fetchImpl(url, {
+        method,
+        signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
+        redirect: 'error',
+        headers: {
+          ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
+          ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      })
+    } catch (error) { throw githubUnreachable(error, started) }
+    if (res.status === 401 && token) tokenRejected(token, fetchImpl)
+    if (!res.ok) await throwGithubResponseError(res)
+    // The answer's body is read within the same timeout: one not read whole is
+    // GitHub not reached, as one not answered is; only one that isn't JSON is
+    // malformed.
+    try { return await res.json() } catch (error) {
+      throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+    }
+  })
 }
 
 // Validate one repo object into a ConnectedRepo (or null to skip), tagging it

package/server-managed/github-graphql.ts

@@ -0,0 +1,39 @@
+// GitHub's GraphQL API, a query at a time, as the repository readers ask it
+// (repository-history.ts, repository-agents.ts, repository-pulse.ts and the rest).
+import { GithubApiError, githubJson } from './github-app.ts'
+
+export type GraphqlError = { type?: unknown; path?: unknown; message?: unknown }
+
+const NAMED_ERRORS = new Set(['RATE_LIMITED', 'NOT_FOUND', 'FORBIDDEN'])
+// GitHub's own words for a query it stopped past its time (ten seconds):
+// "Something went wrong while executing your query. This may be the result
+// of a timeout, …", with no type.
+const TIMED_OUT = /\btimeout\b/iu
+
+// One GraphQL query with `token`, answered with its `data`: one GitHub answers
+// with errors, but for those the caller reads past (`tolerated`, the fields
+// they name then null), is rate limited, names what isn't there, is refused,
+// as one a GitHub App lacks the permission for is, or a token the scope for
+// (`INSUFFICIENT_SCOPES`, a sign-in's having none), took GitHub too long, or
+// else is malformed, as one GitHub rejects unread is (a field or type its API
+// doesn't know). GitHub's words for errors of none of those first three types
+// are logged, those read past too.
+export async function githubGraphql(query: string, variables: Record<string, unknown>, token: string, fetchImpl: typeof fetch,
+  tolerated: (error: GraphqlError) => boolean = () => false) {
+  const body = await githubJson('https://api.github.com/graphql', token, fetchImpl, 'POST', { query, variables }, true) as { data?: unknown; errors?: GraphqlError[] } | null
+  const all = Array.isArray(body?.errors) ? body.errors : []
+  const unnamed = all.filter(error => !NAMED_ERRORS.has(String(error?.type)))
+  if (unnamed.length > 0) {
+    console.warn('managed: GitHub answered a query with errors:', JSON.stringify(unnamed.slice(0, 3)
+      .map(error => ({ type: error?.type, message: String(error?.message).slice(0, 300), path: error?.path }))))
+  }
+  const errors = all.filter(error => !tolerated(error))
+  if (errors.length > 0) {
+    if (errors.some(error => error?.type === 'RATE_LIMITED')) throw new GithubApiError(429, 'github-rate-limited', 60)
+    if (errors.some(error => error?.type === 'NOT_FOUND')) throw new GithubApiError(404, 'github-not-found')
+    if (errors.some(error => error?.type === 'FORBIDDEN' || error?.type === 'INSUFFICIENT_SCOPES')) throw new GithubApiError(502, 'github-status-403')
+    if (errors.some(error => typeof error?.message === 'string' && TIMED_OUT.test(error.message))) throw new GithubApiError(502, 'github-timeout')
+    throw new GithubApiError(502, 'github-malformed')
+  }
+  return body?.data
+}

package/server-managed/github-issue-links.ts

@@ -71,8 +71,15 @@ function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string,
     if (latest && (!repo || repo.repoId !== latest.repository.databaseId)) continue
     const next = latest ? `https://github.com/${repo!.github}/pull/${latest.number}` : null
     if (latest && next) metadata.set(next, { url: next, ...itemMetadata(latest, 'pull')! })
+    // Only a changed derived Fix is written: an unchanged one's check time
+    // alone would bump the annotations revision that every open team feed
+    // polls, for nothing they show. Changes still stamp it, so an older lookup
+    // never replaces a newer change (managed-issues.ts). An older lookup that
+    // differs can now land after a newer unchanged one, as it could already
+    // land before it (whose compare-and-set then fails); either way the next
+    // lookup finds the stored Fix differs, and writes the current one.
     for (const issue of byIssue.get(`${job.repo.repoId}:${job.number}`) ?? []) {
-      updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
+      if (issue.autoFixUrl !== next) updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
     }
   }
   return updates

package/server-managed/github-metadata.ts

@@ -77,8 +77,8 @@ CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
 `
 // Bundles show their commit's details and tags from these tables. Readers rely
 // on bundle access alone; only a GitHub read made with access fills them.
-// Commits are retained without eviction. Create a bundle refreshes a
-// repository's tags, which go with the repository.
+// Commits are retained without eviction. Every refs read of a repository
+// (Create a bundle's, the code viewer's) refreshes its tags, which go with it.
 export const GITHUB_COMMIT_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_github_commit (
   cache_key TEXT PRIMARY KEY,

package/server-managed/http-response.ts

@@ -38,21 +38,39 @@ export function sendJson(res: ServerResponse, status: number, body: unknown, hea
 // before a line, has the response cut short, as is one whose lines fail: a
 // response that ends is one with every line.
 export async function sendLines(res: ServerResponse, lines: AsyncIterable<unknown>, allowed: () => Promise<boolean>) {
-  res.writeHead(200, { 'content-type': 'application/x-ndjson', 'content-encoding': 'br', 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff' })
-  const encoder = createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } })
-  const sent = pipeline(encoder, res).catch(() => {})
-  const closed = new Promise(resolve => { res.once('close', resolve) })
+  const out = openLines(res)
   try {
     for await (const line of lines) {
-      if (res.destroyed || !await allowed()) { res.destroy(); return }
-      encoder.write(`${JSON.stringify(line)}\n`)
-      await Promise.race([new Promise<void>(resolve => { encoder.flush(() => { resolve() }) }), closed])
+      if (res.destroyed || !await allowed()) { out.cut(); return }
+      await out.write(line)
     }
   } catch (err) {
     console.warn('managed: a streamed response failed:', err)
-    res.destroy()
+    out.cut()
     return
   }
-  encoder.end()
-  await sent
+  await out.end()
+}
+
+// A response of lines of JSON as sendLines sends them, written as its caller
+// has each: `write` sends one, flushed, false where the reader is gone; `end`
+// ends it with every line; `cut` ends it short.
+export function openLines(res: ServerResponse) {
+  res.writeHead(200, { 'content-type': 'application/x-ndjson', 'content-encoding': 'br', 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff' })
+  const encoder = createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } })
+  const sent = pipeline(encoder, res).catch(() => {})
+  const closed = new Promise(resolve => { res.once('close', resolve) })
+  return {
+    async write(line: unknown): Promise<boolean> {
+      if (res.destroyed) return false
+      encoder.write(`${JSON.stringify(line)}\n`)
+      await Promise.race([new Promise<void>(resolve => { encoder.flush(() => { resolve() }) }), closed])
+      return !res.destroyed
+    },
+    async end() {
+      encoder.end()
+      await sent
+    },
+    cut() { res.destroy() },
+  }
 }