@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/db-schema.ts

@@ -0,0 +1,238 @@
+import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
+import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA } from './github-links.ts'
+
+// Created after the column migration, which predates it on older databases.
+export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
+// What a team's scopes join reports and bundles on: their repository, and the
+// directory in it. Created after the column migrations, as above.
+export const REPO_UPLOAD_INDEXES = `CREATE INDEX IF NOT EXISTS managed_report_repo_idx ON managed_report(repo_id, repo_directory);
+CREATE INDEX IF NOT EXISTS managed_bundle_repo_idx ON managed_bundle(repo_id, repo_directory);`
+
+export const MANAGED_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_user (
+  id             TEXT PRIMARY KEY,
+  github_user_id INTEGER NOT NULL UNIQUE,
+  login          TEXT NOT NULL,
+  name           TEXT,
+  avatar_url     TEXT,
+  role           TEXT NOT NULL DEFAULT 'none',
+  -- GitHub user-to-server token, persisted so the repositories page can list
+  -- the user's repos (GET /user/repos) on demand. Refresh token + expiry are
+  -- null for non-expiring tokens (GitHub App with expiring tokens disabled).
+  gh_access_token      TEXT,
+  gh_refresh_token     TEXT,
+  gh_token_expires_at  INTEGER,
+  created_at     INTEGER NOT NULL,
+  updated_at     INTEGER NOT NULL,
+  -- Presence is independent of admin edits and background token refreshes.
+  -- NULL for legacy accounts until a known session authenticates them.
+  last_seen_at   INTEGER
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS managed_session (
+  id         TEXT PRIMARY KEY,
+  user_id    TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  csrf_token TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  -- Private X25519 JWK that this session's uploads are sealed to (see
+  -- common/managed/upload-seal.ts). Created on first use.
+  upload_key TEXT,
+  -- An administrator's read-only view as user_id: the admin's own session,
+  -- which must stay valid. Ending that session ends the view.
+  viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_session_user_idx ON managed_session(user_id);
+CREATE INDEX IF NOT EXISTS managed_session_expires_idx ON managed_session(expires_at);
+
+-- Repositories selected to operate on. Keyed by GitHub's numeric repo id
+-- (stable across renames). The row carries everything needed to read the repo's
+-- contents server-side later: installation_id mints an App installation token
+-- (Contents: Read) for PRIVATE repos — NULL means a PUBLIC repo readable without
+-- the App — and full_name + default_branch locate the contents. added_by is the
+-- selector, nulled (not cascaded) if that user is removed so the selection
+-- survives.
+CREATE TABLE IF NOT EXISTS managed_selected_repo (
+  repo_id         INTEGER PRIMARY KEY,
+  full_name       TEXT NOT NULL,
+  is_private      INTEGER NOT NULL,
+  installation_id INTEGER,
+  default_branch  TEXT NOT NULL,
+  -- Live browser hint; independent of the default discovered at selection.
+  cached_default_branch TEXT,
+  html_url        TEXT NOT NULL,
+  added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  added_at        INTEGER NOT NULL,
+  updated_at      INTEGER NOT NULL,
+  active          INTEGER NOT NULL DEFAULT 1,
+  -- Its pull requests' dependencies reviewed (repository-dependency-reviews.ts):
+  -- as many published reviews required of each version, and the commit at
+  -- whose lockfiles' versions none is (null for none).
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  dependency_reviews_required INTEGER NOT NULL DEFAULT 1,
+  dependency_review_since TEXT
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS selected_repo_full_name_idx ON managed_selected_repo(full_name);
+
+-- Bundles uploaded to the server (the "Manage bundles" page). Like reports, the
+-- bytes are stored in the clear (blob-store, keyed by this opaque uuid id) for
+-- the server to operate on. integrity is the content hash (sha512-<base64>,
+-- byte-identical to the client's) so re-uploading the same bytes dedupes (UNIQUE);
+-- it is also the key a report's bundleHashes match to auto-link.
+-- uploaded_by / repo_id are the (nullable) user + repo links, both nulled (not
+-- cascaded) when the referenced user / selected repo goes away.
+CREATE TABLE IF NOT EXISTS managed_bundle (
+  id           TEXT PRIMARY KEY,
+  slug         TEXT NOT NULL,
+  integrity    TEXT NOT NULL UNIQUE,
+  filename     TEXT NOT NULL,
+  kind         TEXT,
+  byte_size    INTEGER NOT NULL,
+  uploaded_by  TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  -- Durable snapshot of the uploader's login at upload time, so "who uploaded
+  -- this" survives the uploader being removed (when uploaded_by nulls out).
+  uploaded_by_login TEXT,
+  repo_id      INTEGER REFERENCES managed_selected_repo(repo_id) ON DELETE SET NULL,
+  repo_directory  TEXT NOT NULL DEFAULT '',
+  visible      INTEGER NOT NULL DEFAULT 1,
+  uploaded_at  INTEGER NOT NULL,
+  -- 'upload' or 'build' (generated on this server). A server build of bytes
+  -- already stored promotes the row to 'build'; NULL predates the column.
+  provenance   TEXT,
+  -- JSON {preset, conditions, platforms} of a JS/TS server build; NULL otherwise.
+  build_conditions TEXT
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_bundle_uploaded_at_idx ON managed_bundle(uploaded_at);
+
+-- Reports uploaded to the server (the "Manage reports" page). A managed server
+-- is TRUSTED, so the bytes are stored in the clear (blob-store, keyed by this
+-- opaque uuid id) for the server to operate on later; this row carries the
+-- metadata + attribution. uploaded_by / repo_id are the (nullable) user + repo
+-- links, nulled (not cascaded) when the user / selected repo goes away. bundle_id
+-- is the (nullable) auto-resolved link to a stored bundle; bundle_integrity is
+-- the report's declared primary bundle (from its bundleHashes), kept so a later
+-- bundle upload of that integrity can re-link.
+CREATE TABLE IF NOT EXISTS managed_report (
+  id               TEXT PRIMARY KEY,
+  slug             TEXT NOT NULL,
+  filename         TEXT NOT NULL,
+  content_type     TEXT NOT NULL,
+  byte_size        INTEGER NOT NULL,
+  sha256           TEXT NOT NULL,
+  uploaded_by      TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  -- Durable snapshot of the uploader's login (see managed_bundle).
+  uploaded_by_login TEXT,
+  repo_id          INTEGER REFERENCES managed_selected_repo(repo_id) ON DELETE SET NULL,
+  repo_directory   TEXT NOT NULL DEFAULT '',
+  repo_embedded    INTEGER NOT NULL DEFAULT 0,
+  analyzer         TEXT,
+  visible          INTEGER NOT NULL DEFAULT 0,
+  bundle_id        TEXT REFERENCES managed_bundle(id) ON DELETE SET NULL,
+  bundle_integrity TEXT,
+  uploaded_at      INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_report_uploaded_at_idx ON managed_report(uploaded_at);
+CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id);
+CREATE INDEX IF NOT EXISTS managed_report_bundle_integrity_idx ON managed_report(bundle_integrity);
+CREATE INDEX IF NOT EXISTS managed_report_bundle_hash_idx ON managed_report(bundle_id, sha256);
+
+-- Per-finding triage annotations — the managed (trusted-plaintext) counterpart
+-- of the client's localStorage triage map, keyed the same way: by finding id
+-- alone, not by report. Reports mostly repeat one another (a re-scan of the
+-- same code carries the same finding ids) and a finding's triage is shared by
+-- every report that carries it; which ids a viewer may read or write is
+-- decided per report at the endpoint, not here. The wire shape lives in
+-- common/managed/triage.ts. Whole-entry replace, NULL columns are unset;
+-- flagged is tri-state: NULL unset / 1 flagged / 0 an explicit un-flag
+-- tombstone. A cleared entry keeps its row with every field NULL — a
+-- tombstone a reader adopts as "cleared", where a missing row means "never
+-- annotated" (so a stale client copy can't resurrect a teammate's clear).
+-- updated_by is the last writer (nulled when that user is removed);
+-- updated_by_login is the durable login snapshot (see managed_bundle).
+CREATE TABLE IF NOT EXISTS managed_finding_triage (
+  finding_id       TEXT PRIMARY KEY,
+  color            TEXT,
+  triage           TEXT,
+  comment          TEXT,
+  fix              TEXT,
+  flagged          INTEGER,
+  updated_by       TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  updated_by_login TEXT,
+  updated_at       INTEGER NOT NULL
+) STRICT;
+
+-- The trail behind managed_finding_triage: one row per write that CHANGED an entry,
+-- holding the entry as written (every field NULL = a clear), who wrote it and
+-- when. managed_finding_triage stays the current-state projection reads hit; this is
+-- walked only for a finding's history. The wire is whole-entry replace, so a
+-- snapshot per write is exactly what arrived and "what changed" is the diff
+-- against the previous row for the same id, computed on read. batch_id groups
+-- the rows of one request. seq is the rowid: a total order that breaks ties
+-- on at. actor_id / actor_login follow the uploaded_by / uploaded_by_login
+-- convention (live account, durable login snapshot). Everything is kept by
+-- default — the trail is the record; an operator may bound it per finding
+-- (TRIAGE_HISTORY_LIMIT), in which case a finding's older events are trimmed
+-- as new ones land. An id no report carries any more is the tombstone GC's
+-- concern.
+CREATE TABLE IF NOT EXISTS managed_finding_triage_event (
+  seq          INTEGER PRIMARY KEY,
+  finding_id   TEXT NOT NULL,
+  batch_id     TEXT NOT NULL,
+  color        TEXT,
+  triage       TEXT,
+  comment      TEXT,
+  fix          TEXT,
+  flagged      INTEGER,
+  actor_id     TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  actor_login  TEXT,
+  at           INTEGER NOT NULL
+) STRICT;
+CREATE INDEX IF NOT EXISTS finding_triage_event_finding_idx ON managed_finding_triage_event(finding_id, seq);
+CREATE INDEX IF NOT EXISTS finding_triage_event_actor_at_idx ON managed_finding_triage_event(actor_id, at);
+
+-- Teams group users + repos for access scoping. Hidden teams grant no access;
+-- the two link tables below carry the many-many relations.
+CREATE TABLE IF NOT EXISTS managed_team (
+  id          TEXT PRIMARY KEY,
+  slug        TEXT NOT NULL,
+  name        TEXT NOT NULL UNIQUE,
+  hidden      INTEGER NOT NULL DEFAULT 0,
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  created_at  INTEGER NOT NULL,
+  updated_at  INTEGER NOT NULL
+) STRICT;
+
+-- Team <-> repo, many-many, with an OPTIONAL path (a subpath of the repo the
+-- team is scoped to; empty path = the whole repo). Distinct paths can coexist;
+-- adding the whole repo replaces them. CASCADE removes links with either side. repo_id
+-- references the selected (operate-on) repos.
+CREATE TABLE IF NOT EXISTS managed_team_repo (
+  team_id  TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  repo_id  INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  path     TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (team_id, repo_id, path)
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS team_repo_repo_idx ON managed_team_repo(repo_id);
+
+-- Team <-> user, many-many, with per-membership visibility permissions (see
+-- common/managed/permissions.ts) — view_dependencies / view_security, both
+-- default 0 (off). CASCADE so the membership dies with either side.
+CREATE TABLE IF NOT EXISTS managed_team_user (
+  team_id           TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  user_id           TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  view_dependencies INTEGER NOT NULL DEFAULT 0,
+  view_security     INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (team_id, user_id)
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA + GITHUB_LINK_SCHEMA

package/server-managed/db-table-names.ts

@@ -0,0 +1,22 @@
+// Table identifiers are code constants. Renames retain rows and foreign keys;
+// an ambiguous old/new pair must be resolved before the server can start.
+const MANAGED_TABLE_RENAMES = [
+  ['selected_repo', 'managed_selected_repo'],
+  ['team_repo', 'managed_team_repo'],
+  ['team_user', 'managed_team_user'],
+  ['finding_triage', 'managed_finding_triage'],
+  ['finding_triage_event', 'managed_finding_triage_event'],
+  ['finding_comment', 'managed_finding_comment'],
+  ['finding_comment_event', 'managed_finding_comment_event'],
+] as const
+
+export function managedTableRenames(tables: Set<string>) {
+  // A fresh installation must not claim similarly named unrelated tables in
+  // a shared database. managed_user anchors an existing managed installation.
+  if (!tables.has('managed_user')) return []
+  const renames = MANAGED_TABLE_RENAMES.filter(([from]) => tables.has(from))
+  for (const [from, to] of renames) {
+    if (tables.has(to)) throw new Error(`Cannot migrate managed tables: both ${from} and ${to} exist`)
+  }
+  return renames
+}

package/server-managed/db.ts

@@ -0,0 +1,142 @@
+// SQLite bootstrap and legacy upgrades. Runtime methods are shared with Neon.
+import { mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { migrateSlugs } from './slugs.ts'
+import { migrateReportLocations } from './report-migration.ts'
+import { initCommentMethods } from './comments.ts'
+import { initActivityMethods } from './activity.ts'
+import { revisionSchema } from './revisions.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS } from './dependency-reviews.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
+import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
+import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
+import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
+import { managedTableRenames } from './db-table-names.ts'
+import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
+import { createSqliteDriver, scopeManagedMethods } from './sql.ts'
+export type * from './db-methods.ts'
+
+function migrateManagedTableNames(db: DatabaseSync): void {
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    db.exec('CREATE TABLE IF NOT EXISTS managed_schema_version (version INTEGER PRIMARY KEY) STRICT;')
+    if (!db.prepare('SELECT version FROM managed_schema_version WHERE version = 3').get()) {
+      const rows = db.prepare("SELECT name FROM sqlite_schema WHERE type = 'table'").all() as { name: string }[]
+      for (const [from, to] of managedTableRenames(new Set(rows.map(row => row.name)))) {
+        db.exec(`ALTER TABLE ${from} RENAME TO ${to}`)
+      }
+      db.exec('INSERT INTO managed_schema_version VALUES (3)')
+    }
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}
+
+// Preserve the legacy single-path links while adding path to their identity.
+function migrateTeamRepoPaths(db: DatabaseSync): void {
+  const columns = db.prepare('PRAGMA table_info(managed_team_repo)').all() as { name: string; pk: number }[]
+  if (columns.some(column => column.name === 'path' && column.pk === 3)) return
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    db.exec(`CREATE TABLE managed_team_repo_paths (
+      team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+      repo_id INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+      path TEXT NOT NULL DEFAULT '', PRIMARY KEY (team_id, repo_id, path)
+    ) STRICT;
+    INSERT INTO managed_team_repo_paths SELECT team_id, repo_id, COALESCE(path, '') FROM managed_team_repo;
+    DROP TABLE managed_team_repo;
+    ALTER TABLE managed_team_repo_paths RENAME TO managed_team_repo;
+    CREATE INDEX team_repo_repo_idx ON managed_team_repo(repo_id);`)
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}
+
+// Add `column` to `table` if it's missing (a lightweight migration for DBs that
+// predate the column; `table`/`column` are code constants, never user input).
+function ensureColumn(db: DatabaseSync, table: string, column: string, type: string): boolean {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[]
+  if (cols.some((c) => c.name === column)) return false
+  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`)
+  return true
+}
+
+export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}): ManagedDb {
+  mkdirSync(dirname(path), { recursive: true })
+  const db = new DatabaseSync(path)
+  try {
+    db.exec('PRAGMA journal_mode = WAL;')
+    db.exec('PRAGMA synchronous = FULL;')
+    db.exec('PRAGMA foreign_keys = ON;')
+    migrateManagedTableNames(db)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + GITHUB_COMMIT_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA + UPSTREAM_CACHE_SCHEMA)
+    ensureColumn(db, 'managed_selected_repo', 'cached_default_branch', 'TEXT')
+    ensureColumn(db, 'managed_session', 'upload_key', 'TEXT')
+    ensureColumn(db, 'managed_session', 'viewer_session', 'TEXT REFERENCES managed_session(id) ON DELETE CASCADE')
+    db.exec(VIEW_SESSION_INDEX)
+    for (const table of ['managed_report', 'managed_bundle']) {
+      ensureColumn(db, table, 'data_key', 'TEXT')
+      ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    }
+    ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    // Existing names are the sign-in accounts' own: none was chosen yet.
+    for (const [column, type] of GITHUB_LINK_USER_COLUMNS) {
+      if (ensureColumn(db, 'managed_user', column, type) && column === 'github_name') db.exec('UPDATE managed_user SET github_name = name')
+    }
+    ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
+    ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
+    // Existing public links must opt in too; never preserve an implicit grant.
+    ensureColumn(db, 'managed_workspace_share', 'dependencies', 'INTEGER NOT NULL DEFAULT 0')
+    ensureColumn(db, 'managed_workspace_share', 'security', 'INTEGER NOT NULL DEFAULT 0')
+    migrateTeamRepoPaths(db)
+    migrateSlugs(db)
+    // Migrate DBs created before a column existed (CREATE TABLE IF NOT EXISTS
+    // never alters an already-present table). Idempotent — skipped on fresh DBs.
+    const addedLastSeen = ensureColumn(db, 'managed_user', 'last_seen_at', 'INTEGER')
+    if (addedLastSeen) {
+      // Session creation is known authentication activity. updated_at is not:
+      // role changes and token refreshes also wrote it. Keep unknowns NULL.
+      db.exec(`UPDATE managed_user SET last_seen_at = (
+        SELECT MAX(s.created_at) FROM managed_session s WHERE s.user_id = managed_user.id
+      )`)
+    }
+    ensureColumn(db, 'managed_report', 'uploaded_by_login', 'TEXT')
+    ensureColumn(db, 'managed_report', 'repo_embedded', 'INTEGER NOT NULL DEFAULT 0')
+    migrateReportLocations(db, join(dirname(path), 'reports'))
+    ensureColumn(db, 'managed_report', 'analyzer', 'TEXT')
+    // Existing rows predate publication controls and were already visible.
+    // Backfill only when adding the column; newly inserted rows still use the
+    // hidden default and must be explicitly published.
+    const addedVisible = ensureColumn(db, 'managed_report', 'visible', 'INTEGER NOT NULL DEFAULT 0')
+    if (addedVisible) db.prepare('UPDATE managed_report SET visible = 1 WHERE visible = 0').run()
+    ensureColumn(db, 'managed_bundle', 'uploaded_by_login', 'TEXT')
+    ensureColumn(db, 'managed_bundle', 'repo_directory', "TEXT NOT NULL DEFAULT ''")
+    db.exec(REPO_UPLOAD_INDEXES)
+    ensureColumn(db, 'managed_bundle', 'visible', 'INTEGER NOT NULL DEFAULT 1')
+    // Existing rows stay NULL (unknown): some may have been built on the server.
+    ensureColumn(db, 'managed_bundle', 'provenance', 'TEXT')
+    ensureColumn(db, 'managed_bundle', 'build_conditions', 'TEXT')
+    ensureColumn(db, 'managed_team', 'hidden', 'INTEGER NOT NULL DEFAULT 0')
+    ensureColumn(db, 'managed_team', 'dependency_review', 'INTEGER NOT NULL DEFAULT 0')
+    ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
+    ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
+    ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
+    for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
+    for (const [column, type] of DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_dependency_review', column, type)
+    ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
+    ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
+    ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')
+    initCommentMethods(db)
+    initActivityMethods(db)
+    db.exec(revisionSchema())
+  } catch (err) {
+    try { db.close() } catch {}
+    throw err
+  }
+
+  const driver = createSqliteDriver(db)
+  return scopeManagedMethods(createManagedMethods(driver, options), driver)
+}

package/server-managed/dependabot-access.ts

@@ -0,0 +1,60 @@
+// A repository's Dependabot alerts for a repository risk scan, read with the
+// App's installation token where the admin's own access lets them see them on
+// GitHub, as doc/bundles.md's repository risk scan section tells.
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'
+import { GithubApiError, type GithubIdentity, githubRepoPermission, repoAccessToken, repositoryInstallation } from './github-app.ts'
+
+// The levels GitHub lets see a repository's Dependabot alerts by default
+// (maintain's reads `write`).
+const SEES_ALERTS: ReadonlySet<string> = new Set(['admin', 'write'])
+// Failures of verifying the sign-in that are the sign-in's own: no token, or
+// one of another account (repository-browser.ts getIdentity), or one GitHub no
+// longer takes. Any other, as GitHub failing to answer, is told as it is.
+const UNVERIFIED: ReadonlySet<string> = new Set(['no-repository', 'github-unauthorized'])
+
+// What of a repository's reader (repository-browser.ts) the alerts are asked
+// with: the user's verified identity, and their permission level where its
+// access gate asked GitHub of it already.
+export interface AlertsReader {
+  identity(): Promise<GithubIdentity>
+  permission(): string | null
+}
+
+// Alerts read, and their `recheck`: the user's access to them checked again,
+// asked of GitHub afresh, just before they are told (repository-risk.ts), as
+// access to the repository is, as it may be withdrawn meanwhile.
+export interface AlertsRead { alerts: DependabotAlert[]; recheck(): Promise<void> }
+
+// `repo`'s Dependabot alerts (dependabot-alerts.ts), read with the token of
+// the App's installation GitHub tells covers it now, its token checked to read
+// it (github-app.ts repositoryInstallation), never the one its connection
+// keeps, which may no longer cover it, once the user's own permission on it
+// lets them see them; else refused, the alerts not asked:
+// `dependabot-not-installed`, `dependabot-unverified`, or
+// `dependabot-forbidden`, naming their permission. The token is asked each
+// time of repoAccessToken, which renews it before it expires, as the recheck
+// may come long after the alerts are read.
+export async function appDependabotAlerts(config: ManagedConfig, repo: Pick<SelectedRepo, 'repoId' | 'fullName'>, reader: AlertsReader,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AlertsRead> {
+  const id = await repositoryInstallation(config, repo.repoId, repo.fullName, fetchImpl)
+  const tokenNow = async () => {
+    const token = await repoAccessToken(config, id, fetchImpl)
+    if (token == null) throw new GithubApiError(403, 'dependabot-not-installed')
+    return token
+  }
+  const token = await tokenNow()
+  let who
+  try { who = await reader.identity() } catch (error) {
+    throw error instanceof GithubApiError && UNVERIFIED.has(error.message) ? new GithubApiError(403, 'dependabot-unverified') : error
+  }
+  const seen = (permission: string) => {
+    if (!SEES_ALERTS.has(permission)) {
+      throw new GithubApiError(403, 'dependabot-forbidden', null, `@${who.login}'s access to this repository (${permission}) doesn't let them see its Dependabot alerts on GitHub`)
+    }
+  }
+  seen(reader.permission() ?? await githubRepoPermission(repo.fullName, token, who, fetchImpl))
+  const alerts = await dependabotAlerts(repo.fullName, token, fetchImpl)
+  return { alerts, recheck: async () => { seen(await githubRepoPermission(repo.fullName, await tokenNow(), who, fetchImpl)) } }
+}

package/server-managed/dependabot-alerts.ts

@@ -0,0 +1,185 @@
+// A repository's Dependabot alerts of npm's ecosystem, open or dismissed, as a
+// repository risk scan blends them into npm's advisories (repository-risk.ts),
+// a dismissed one with who dismissed it, when and why: GitHub's
+// `GET /repos/:repo/dependabot/alerts`, a page of 100 at a time, each found by
+// the cursor the one before's Link header names, MAX_PAGES at most. Asked with
+// the App's installation token, once the admin's own access to the repository
+// is found to let them see the alerts on GitHub (dependabot-access.ts): where
+// the installation hasn't Dependabot alerts: read, or the repository has them
+// off, that is thrown as its code, never GitHub's text, for the scan to tell
+// and go on.
+import { isExactVersion, satisfies, validRange } from '@preventive/upstream/semver.js'
+import { isNpmPackageName } from '../common/managed/npm-packages.js'
+import { GithubApiError, githubUnreachable, throwGithubResponseError } from './github-errors.ts'
+import type { LockedPackage } from './locked-packages.ts'
+
+// An alert, as GitHub has it: its `number` in its repository and its page
+// there (`url`, built, never fetched), the manifest or lockfile it is of
+// (`manifest`, from the repository's root), its package and advisory, the
+// versions it affects as GitHub writes them (`range`, `>= 1.0.0, < 1.2.6`)
+// and the first that isn't (`patched`), `dev` where GitHub tells the
+// dependency is only for development, and `dismissed` where it is: by whom,
+// when, why and what they said, or by one of the repository's rules (`auto`).
+export interface DependabotAlert {
+  number: number
+  url: string
+  manifest: string
+  name: string
+  ghsa: string
+  // The advisory's other ids, as its CVE.
+  aliases: string[]
+  title?: string
+  // `critical`, `high`, `moderate`, `low`: GitHub's `medium` reads `moderate`.
+  severity?: string
+  range?: string
+  patched?: string
+  cwe: string[]
+  dev?: true
+  dismissed?: AlertDismissal
+}
+
+// GitHub's `dismissed_reason`: `fix_started`, `inaccurate`, `no_bandwidth`,
+// `not_used` or `tolerable_risk`; `at` as GitHub writes it (ISO 8601).
+export interface AlertDismissal { auto?: true; reason?: string; at?: string; by?: string; comment?: string }
+
+const API = 'https://api.github.com'
+const API_VERSION = '2022-11-28'
+const USER_AGENT = 'deepview-triage'
+const PER_PAGE = 100
+// Up to how many pages a listing asks: 2,000 alerts of npm's in a repository,
+// past which the rest are left out; where open and dismissed ones are more,
+// the open ones are listed again on their own (dependabotAlerts).
+const MAX_PAGES = 20
+// A page holds each advisory's whole text: given longer than githubJson's.
+const PAGE_TIMEOUT_MS = 20_000
+const GHSA = /^GHSA(?:-[23456789cfghjmpqrvwx]{4}){3}$/u
+const SEVERITIES = new Map([['critical', 'critical'], ['high', 'high'], ['medium', 'moderate'], ['moderate', 'moderate'], ['low', 'low']])
+// A path from a repository's root, as git takes one: no empty, `.` or `..`
+// component, nor a control character.
+const isRepoPath = (path: unknown): path is string => typeof path === 'string' && path.length <= 1024 && !/\p{Cc}/u.test(path)
+  && path.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+
+// The states asked: a fixed alert's dependency is no longer what it was.
+const STATES = ['open', 'dismissed', 'auto_dismissed']
+const REASONS = new Set(['fix_started', 'inaccurate', 'no_bandwidth', 'not_used', 'tolerable_risk'])
+const LOGIN = /^[\dA-Za-z](?:[\dA-Za-z-]{0,38})(?:\[bot\])?$/u
+
+const text = (value: unknown, most = 500) => typeof value === 'string' && value.trim() ? value.trim().slice(0, most) : undefined
+
+// How a dismissed alert was dismissed, as far as GitHub tells it soundly.
+function dismissalOf(state: string, raw: Record<string, any>): AlertDismissal {
+  const at = state === 'auto_dismissed' ? raw['auto_dismissed_at'] : raw['dismissed_at']
+  const when = typeof at === 'string' && at.length <= 40 && !Number.isNaN(Date.parse(at)) ? { at } : {}
+  if (state === 'auto_dismissed') return { auto: true, ...when }
+  const by = raw['dismissed_by']?.login, comment = text(raw['dismissed_comment'], 280), reason = raw['dismissed_reason']
+  return { ...REASONS.has(reason) ? { reason } : {}, ...when, ...typeof by === 'string' && LOGIN.test(by) ? { by } : {}, ...comment === undefined ? {} : { comment } }
+}
+
+// An alert as GitHub answers it, or null for one that isn't an open or
+// dismissed one of npm's, of a package and GHSA npm and GitHub would name.
+function alertOf(fullName: string, raw: unknown): DependabotAlert | null {
+  if (raw == null || typeof raw !== 'object') return null
+  const { number, state, dependency, security_advisory: advisory, security_vulnerability: vulnerability } = raw as Record<string, any>
+  if (!Number.isSafeInteger(number) || number <= 0 || !STATES.includes(state)) return null
+  const ghsa = advisory?.ghsa_id, manifest = dependency?.manifest_path, name = dependency?.package?.name
+  if (dependency?.package?.ecosystem !== 'npm' || !isNpmPackageName(name) || !isRepoPath(manifest) || typeof ghsa !== 'string' || !GHSA.test(ghsa)) return null
+  const severity = SEVERITIES.get(vulnerability?.severity ?? advisory?.severity)
+  const patched = text(vulnerability?.first_patched_version?.identifier, 100), range = text(vulnerability?.vulnerable_version_range, 200), title = text(advisory?.summary)
+  const ids = Array.isArray(advisory?.identifiers) ? advisory.identifiers as { value?: unknown }[] : []
+  const cwes = Array.isArray(advisory?.cwes) ? advisory.cwes as { cwe_id?: unknown }[] : []
+  return {
+    number, url: `https://github.com/${fullName.split('/').map(encodeURIComponent).join('/')}/security/dependabot/${number}`, manifest, name, ghsa,
+    aliases: [...new Set(ids.flatMap(id => typeof id?.value === 'string' && /^[\w.:-]{1,64}$/u.test(id.value) && id.value !== ghsa ? [id.value] : []))],
+    ...title === undefined ? {} : { title }, ...severity === undefined ? {} : { severity },
+    ...range === undefined ? {} : { range }, ...patched === undefined ? {} : { patched },
+    cwe: [...new Set(cwes.flatMap(cwe => typeof cwe?.cwe_id === 'string' && /^CWE-\d{1,6}$/u.test(cwe.cwe_id) ? [cwe.cwe_id] : []))],
+    ...dependency.scope === 'development' ? { dev: true as const } : {},
+    ...state === 'open' ? {} : { dismissed: dismissalOf(state, raw as Record<string, any>) },
+  }
+}
+
+// The next page's cursor, as the Link header's `next` names it: its `after`,
+// or its `page`, all that is taken of it, the rest of its URL left as asked.
+function nextPage(link: string | null): [string, string] | null {
+  const next = link?.split(',').map(part => /^\s*<([^>]*)>\s*;\s*rel="next"\s*$/u.exec(part)?.[1]).find(Boolean)
+  if (!next) return null
+  let url
+  try { url = new URL(next) } catch { return null }
+  if (url.origin !== API) return null
+  const after = url.searchParams.get('after'), page = url.searchParams.get('page')
+  return after ? ['after', after] : page && /^\d{1,4}$/u.test(page) ? ['page', page] : null
+}
+
+// A page asked of GitHub: its alerts and the headers they came with. A 403
+// that isn't a rate limit is told as the alerts being off
+// (`dependabot-disabled`) or not to be read by the App's installation
+// (`dependabot-app-permission`), as a 404 is, the repository found just
+// before; the rest as githubJson tells them.
+async function askPage(url: string, token: string, fetchImpl: typeof fetch): Promise<{ alerts: unknown[]; link: string | null }> {
+  const started = Date.now()
+  let res: Response
+  try {
+    res = await fetchImpl(url, {
+      signal: AbortSignal.timeout(PAGE_TIMEOUT_MS), redirect: 'error',
+      headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION },
+    })
+  } catch (error) { throw githubUnreachable(error, started) }
+  if (res.status === 403) {
+    const message = (await res.clone().json().catch(() => null) as { message?: unknown } | null)?.message
+    const limited = res.headers.get('x-ratelimit-remaining') === '0' || res.headers.has('retry-after')
+      || (typeof message === 'string' && /rate limit|abuse detection/iu.test(message))
+    if (!limited) throw new GithubApiError(403, typeof message === 'string' && /disabled/iu.test(message) ? 'dependabot-disabled' : 'dependabot-app-permission')
+  }
+  if (res.status === 404) throw new GithubApiError(403, 'dependabot-app-permission')
+  if (!res.ok) await throwGithubResponseError(res)
+  let body
+  try { body = await res.json() } catch (error) {
+    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+  }
+  if (!Array.isArray(body)) throw new GithubApiError(502, 'github-malformed')
+  return { alerts: body, link: res.headers.get('link') }
+}
+
+// `fullName`'s alerts in `states`, MAX_PAGES at most, in GitHub's order (the
+// newest first), and whether that is all of them.
+async function listAlerts(fullName: string, states: readonly string[], token: string, fetchImpl: typeof fetch) {
+  const base = `${API}/repos/${fullName.split('/').map(encodeURIComponent).join('/')}/dependabot/alerts`
+  const alerts: DependabotAlert[] = []
+  const seen = new Set<number>()
+  let cursor: [string, string] | null = null
+  for (let pages = 0; pages < MAX_PAGES; pages++) {
+    const query = new URLSearchParams({ state: states.join(','), ecosystem: 'npm', per_page: String(PER_PAGE), ...cursor ? { [cursor[0]]: cursor[1] } : {} })
+    const answer = await askPage(`${base}?${query}`, token, fetchImpl)
+    for (const raw of answer.alerts) {
+      const alert = alertOf(fullName, raw)
+      if (alert && !seen.has(alert.number)) { seen.add(alert.number); alerts.push(alert) }
+    }
+    cursor = answer.alerts.length === 0 ? null : nextPage(answer.link)
+    if (!cursor) return { alerts, whole: true }
+  }
+  return { alerts, whole: false }
+}
+
+// `fullName`'s Dependabot alerts of npm's ecosystem, open or dismissed, as
+// `token`, the App's installation's (dependabot-access.ts), may see them, in
+// GitHub's order. Asked at once, but where they are more than a listing holds,
+// as newer dismissed ones would leave older open ones out, the open ones are
+// listed again on their own, and the dismissed ones had kept after them.
+export async function dependabotAlerts(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<DependabotAlert[]> {
+  const all = await listAlerts(fullName, STATES, token, fetchImpl)
+  if (all.whole) return all.alerts
+  const open = await listAlerts(fullName, ['open'], token, fetchImpl)
+  const told = new Set(open.alerts.map(alert => alert.number))
+  return [...open.alerts, ...all.alerts.filter(alert => alert.dismissed && !told.has(alert.number))]
+}
+
+// The versions of an alert's package that a lockfile it is of locks
+// (`packages`) and its range covers, GitHub's read as npm's semver reads its
+// own (`>= 1.0.0, < 1.2.6` as `>= 1.0.0 < 1.2.6`); none where it is of no
+// lockfile read, or its range is none semver reads.
+export function alertVersions(alert: Pick<DependabotAlert, 'name' | 'range'>, packages: readonly LockedPackage[] | undefined): string[] {
+  const range = alert.range === undefined ? null : validRange(alert.range.replaceAll(',', ' '))
+  if (!packages || range === null) return []
+  return [...new Set(packages.flatMap(({ name, version, source }) => name === alert.name && (source === 'registry' || source === 'mirror')
+    && isExactVersion(version) && satisfies(version, range) ? [version] : []))]
+}