@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/repository-code.ts

@@ -0,0 +1,215 @@
+// Reading a directory of a repository at a commit for the managed code viewer
+// (GET /api/admin/repositories/code): its tree's tarball as GitHub archives
+// it, verified against the tree's id and kept in upstream's disk cache as
+// bundle builds keep theirs (getRepoTreeTarball), and its files as the npm
+// viewer reads a package's (npm-packages.ts npmFileRows). Readers asking for
+// the same directory meanwhile share its body, a load among the npm viewer's
+// active ones (npm-loads.ts sharedLoad). The default branch's head's bodies
+// are kept in byte storage, for the next to open them (repositoryCodeKept).
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { encodeBrotli } from './brotli.ts'
+import { CacheMissError, type CacheStorage } from './cache-storage.ts'
+import type { KeptStore } from './npm-kept.ts'
+import { plainObject } from './npm-manifest.ts'
+import { MAX_NPM_JSON_LENGTH, NpmPackageError, npmFileRows } from './npm-packages.ts'
+import { type NpmLoad, loadPlaces, readTarballFiles, sharedLoad } from './npm-loads.ts'
+
+// What a directory may hold, bounded apart from a package's (npm-packages.ts),
+// as the viewer holds every file in memory: its files' count and bytes.
+export const MAX_REPOSITORY_CODE_FILES = 80_000
+export const MAX_REPOSITORY_CODE_BYTES = 256 * 1024 * 1024
+// The tarball they come in, bounded in proportion as a package's is: its tar
+// stream, headers and padding included, and its entries, as many again as
+// files, as GitHub's has one for each directory too.
+const REPOSITORY_TAR = { maxFiles: MAX_REPOSITORY_CODE_FILES, maxBytes: MAX_REPOSITORY_CODE_BYTES, maxEntries: 2 * MAX_REPOSITORY_CODE_FILES, maxTarBytes: 384 * 1024 * 1024 }
+// What the files may take as the viewer's JSON, written as one string: short
+// of the longest V8 holds (2^29 - 24 characters).
+const MAX_REPOSITORY_CODE_JSON_LENGTH = 384 * 1024 * 1024
+
+// Whether a directory's files fit, by GitHub's listing of its tree and every
+// tree under it (repository-browser.ts repositoryTreeFiles): asked before
+// its tarball is, which may run to hundreds of MiB. One GitHub cut short
+// (null) has too many.
+export function repositoryCodeFits(files: RepositoryCodeFiles | null): files is RepositoryCodeFiles {
+  return files !== null && files.files <= MAX_REPOSITORY_CODE_FILES && files.bytes <= MAX_REPOSITORY_CODE_BYTES
+}
+
+// A directory's files' count and bytes, as GitHub lists its tree.
+export interface RepositoryCodeFiles { files: number; bytes: number }
+
+// The directory read: the repository by its id and name, the commit, the
+// directory (`''` for the root), its tree's id, and its files as listed,
+// which weigh its load among the active ones.
+export interface RepositoryCodeInput { repoId: number; repo: string; commit: string; path: string; tree: string; listed: RepositoryCodeFiles }
+
+// A package's refusals, as a directory's: past the bounds, or an archive
+// @preventive/archive refuses, as it does one holding a symlink that climbs
+// past the repository's root, or an absolute one.
+const DIRECTORY_ERRORS: Record<string, [number, string]> = { 'package-too-large': [413, 'directory-too-large'], 'bad-tarball': [422, 'directory-unreadable'] }
+const directoryError = (err: unknown) => {
+  const as = err instanceof NpmPackageError ? DIRECTORY_ERRORS[err.message] : undefined
+  return as ? new NpmPackageError(...as) : err
+}
+
+// The directory as the viewer reads it, as brotli-encoded JSON: `{ repoId,
+// repo, commit, path, tree, files }`, its files as npmFileRows gives them,
+// by their paths in the directory, from `tarball`, the tree's, as upstream
+// verifies it with its symlinks let climb `symlinksAbove` levels.
+export function loadRepositoryCodeBody(input: RepositoryCodeInput, tarball: (symlinksAbove: number) => Promise<Uint8Array>): NpmLoad<Buffer> {
+  const { repoId, repo, commit, path, tree, listed } = input
+  // A symlink may reach the repository's root, as a monorepo package's
+  // LICENSE links the root's, and no further: the directory's depth, less
+  // the level the archive's root already stands above its top directory.
+  const symlinksAbove = path.split('/').length - 1
+  // Its places among the active loads, by its files as listed, hold their
+  // JSON too, which the listing cannot tell, as escaping may grow a text
+  // sixfold: as much as a package's may take for each.
+  const places = loadPlaces(listed)
+  const maxLength = Math.min(MAX_REPOSITORY_CODE_JSON_LENGTH, places * MAX_NPM_JSON_LENGTH)
+  return sharedLoad(`repository ${repoId} ${repo} ${commit} ${path} ${tree}`, async () => {
+    let files
+    try { files = npmFileRows(await readTarballFiles(await tarball(symlinksAbove), { ...REPOSITORY_TAR, symlinksAbove }), maxLength) }
+    catch (err) { throw directoryError(err) }
+    return encodeBrotli(Buffer.from(JSON.stringify({ repoId, repo, commit, path, tree, files })))
+  }, 'repository-busy', { places })
+}
+
+// The form of the bodies kept, bumped as what a body holds changes
+// (npmFileRows): one kept in another is none to read.
+const KEPT_CODE_VERSION = 1
+// The largest body kept. Source text runs, as brotli's JSON, to a third of
+// its bytes or less, and a directory's binary files are named, not held, so
+// this keeps one of some 200 MiB of text: nearly every directory that opens
+// at all (MAX_REPOSITORY_CODE_BYTES). One past it would take as much byte
+// storage as hundreds of ordinary directories, and hold a serverless
+// invocation a while uploading it: it is sent as ever, and read again the
+// next time.
+export const MAX_KEPT_CODE_BYTES = 64 * 1024 * 1024
+const COMMIT = /^[a-f\d]{40}$/u
+
+// A directory as kept: the repository by its id and name, the commit and the
+// directory, as its body names them; and the head they are kept at.
+export type KeptCodeAt = Pick<RepositoryCodeInput, 'repoId' | 'repo' | 'commit' | 'path'>
+type KeptCodeHead = Pick<KeptCodeAt, 'commit' | 'repo'>
+// Under the repository, then the commit, so either goes by its prefix; the
+// repository's name and the directory hashed, as a key's parts are names.
+const keptKey = ({ repoId, repo, commit, path }: KeptCodeAt) =>
+  `${repoId}/${commit}/v${KEPT_CODE_VERSION}-${createHash('sha256').update(JSON.stringify([repo, path])).digest('hex')}.json.br`
+
+// Bodies being kept, by their storage and key, each kept once; and each
+// storage's own name among the active loads, as its reads are one of them.
+const keeping = new WeakMap<CacheStorage, Set<string>>()
+const storageNames = new WeakMap<CacheStorage, number>()
+let storagesNamed = 0
+
+// A body kept, read whole, where it is one MAX_KEPT_CODE_BYTES keeps.
+async function readKept(storage: CacheStorage, key: string): Promise<Buffer | null> {
+  const { size, stream } = await storage.open(key)
+  try {
+    if (size !== null && size > MAX_KEPT_CODE_BYTES) return null
+    const parts: Buffer[] = []
+    let length = 0
+    for await (const part of stream) {
+      length += (part as Buffer).byteLength
+      if (length > MAX_KEPT_CODE_BYTES) return null
+      parts.push(Buffer.from(part as Buffer))
+    }
+    return Buffer.concat(parts, length)
+  } finally { stream.destroy() }
+}
+
+// The directories of repositories' default branches' heads, as
+// loadRepositoryCodeBody encodes them, kept in the managed byte storage
+// (`storage`: Vercel Blob, else the filesystem, encrypted at rest where
+// storage is: storage-payload.ts REPOSITORY_CODE_CACHE), so that one opened
+// again, on any instance, asks GitHub for no tarball, and is neither unpacked
+// nor encoded again; by the commit `heads` keeps for each repository, the
+// head as last read (npm-kept.ts codeHeadStore). Most opens read the head:
+// `/repo/<repo id>` opens it, and its route then names its commit, as do its
+// directories opened from it and a reload. A read naming the default branch
+// (`''`, or `heads/` and its name) takes its head as GitHub resolves it for
+// the commit kept, the directories kept at any other removed (`own`ed,
+// behind its answer); any other read, of a commit, a tag or another branch,
+// reads and keeps a directory only where what it resolves to is the commit
+// kept. Nothing kept is per reader, and each is read only once the reader's
+// own access has named its commit. A body names what it was read of, so
+// instances disagreeing on the head meanwhile, as at a push, only cost a
+// directory read again: one kept for a head since moved on removes itself.
+// The head is kept with the repository's name, which each body's key holds,
+// so a repository renamed has what was kept under its name before removed
+// as a read next names its head. A head is written only for a repository
+// still `active` after it, as one removed meanwhile has its head removed
+// after (remove). Byte storage, as the database, is an optimization: its
+// failures read as a directory kept nowhere, and keep nothing.
+export function repositoryCodeKept(storage: CacheStorage, heads: KeptStore<KeptCodeHead>, active: (repoId: number) => Promise<boolean>,
+  own: (work: Promise<unknown>) => void, debug = false) {
+  const warn = (what: string) => (error: unknown) => { if (debug) console.warn(`managed: kept repository code ${what} failed:`, error) }
+  const headOf = async (repoId: number): Promise<KeptCodeHead | null> => {
+    const kept: unknown = (await heads.read(String(repoId)))?.value
+    return plainObject(kept) && typeof kept['commit'] === 'string' && typeof kept['repo'] === 'string' ? { commit: kept['commit'], repo: kept['repo'] } : null
+  }
+  // What is kept of repository `repoId`: its head first, so that a body being
+  // kept meanwhile removes itself.
+  const remove = async (repoId: number) => {
+    await heads.remove(String(repoId))
+    await storage.delete(String(repoId))
+  }
+  return {
+    // Whether a read of `ref` at repository `repoId`, by its name `repo`,
+    // resolved to `commit` with `defaultBranch` GitHub's, reads and keeps
+    // its directories.
+    async at({ repoId, repo, commit }: Omit<KeptCodeAt, 'path'>, ref: string, defaultBranch: string): Promise<boolean> {
+      if (!COMMIT.test(commit)) return false
+      const kept = await headOf(repoId)
+      const atKept = kept?.commit === commit && kept.repo === repo
+      if (ref !== '' && (defaultBranch === '' || ref !== `heads/${defaultBranch}`)) return atKept
+      if (!atKept) {
+        await heads.write(String(repoId), { commit, repo }, Date.now())
+        // One removed as its commit was read, its head removed before this
+        // wrote it again, keeps nothing, and has what is kept removed again.
+        if (!await active(repoId).catch(() => false)) {
+          await remove(repoId).catch(warn('removal'))
+          return false
+        }
+        // Those kept at the head before, or, renamed, every one kept under
+        // its name before.
+        own(storage.delete(String(repoId), kept?.repo === repo ? commit : undefined).catch(warn('removal')))
+      }
+      return true
+    },
+    // The body kept of the directory `at` names, or null: a load among the
+    // active ones (npm-loads.ts sharedLoad), as one read from GitHub is, a
+    // place of them, as it holds no more than a package may
+    // (MAX_KEPT_CODE_BYTES), till each reader has released it; readers
+    // asking for it meanwhile share it, and none is read where every place
+    // is taken (`repository-busy`).
+    read(at: KeptCodeAt): NpmLoad<Buffer | null> {
+      const key = keptKey(at)
+      const name = storageNames.get(storage) ?? storageNames.set(storage, ++storagesNamed).get(storage)!
+      return sharedLoad(`repository kept ${name} ${key}`, () => readKept(storage, key).catch((error: unknown) => {
+        if (!(error instanceof CacheMissError)) warn('read')(error)
+        return null
+      }), 'repository-busy')
+    },
+    // The directory's body kept, behind its answer, where it is no larger
+    // than MAX_KEPT_CODE_BYTES; and removed again, with the rest of its
+    // commit's, where the head kept is another by then, as when it moved on
+    // or the repository was renamed or removed meanwhile.
+    keep(at: KeptCodeAt, body: Buffer): void {
+      const key = keptKey(at)
+      const kept = keeping.get(storage) ?? keeping.set(storage, new Set()).get(storage)!
+      if (body.byteLength > MAX_KEPT_CODE_BYTES || kept.has(key)) return
+      kept.add(key)
+      own((async () => {
+        await storage.put(key, body)
+        const head = await headOf(at.repoId)
+        if (head?.commit !== at.commit || head.repo !== at.repo) await storage.delete(`${at.repoId}/${at.commit}`)
+      })().catch(warn('write')).finally(() => kept.delete(key)))
+    },
+    // What is kept of repository `repoId`, removed once the repository is
+    // no longer active.
+    remove,
+  }
+}
+export type RepositoryCodeKept = ReturnType<typeof repositoryCodeKept>

package/server-managed/repository-dependency-reviews.ts

@@ -0,0 +1,165 @@
+// A connected repository's dependency review, as an admin sets it, and the
+// reviews that pass its pull requests' dependencies (pull-dependency-reviews.ts).
+// Enabled, each package version its open pull requests' lockfiles lock needs
+// as many published reviews as `required`; those its lockfiles locked at
+// `since`, a commit (null for none), none; of the lockfiles it holds to
+// (`lockfiles`, lockfile-scope.ts), every one by default. It is in effect only where a team
+// that reviews dependencies has the repository, which is where reviews that
+// count are published, and not revoked: each reviewer's latest of a version
+// tells where they stand on it, a reject holding it unreviewed whatever
+// others passed it till they accept it again; and a reviewer standing on
+// accepting it passes it by a review of theirs that is full (every file
+// checked; a partial review counts for nothing yet) and accepting (Accept,
+// or Accept with nits).
+import type { ManagedSql } from './sql.ts'
+import { type LockfileScope, scopeText, storedScope } from './lockfile-scope.ts'
+import { reviewsIn } from './dependency-reviews.ts'
+import { type ReviewVerdict, summarizeReview } from '../common/dependency-reviews.js'
+
+export const REPOSITORY_DEPENDENCY_REVIEW_COLUMNS = [['dependency_review', 'INTEGER NOT NULL DEFAULT 0'],
+  ['dependency_reviews_required', 'INTEGER NOT NULL DEFAULT 1'], ['dependency_review_since', 'TEXT'], ['dependency_review_lockfiles', 'TEXT']] as const
+export const MAX_REQUIRED_REVIEWS = 10
+export const SINCE_COMMIT = /^[a-f\d]{40}$/u
+
+export interface RepoDependencyReview { enabled: boolean; required: number; since: string | null; lockfiles: LockfileScope }
+// A review published of the version it is of: its package, version and
+// npm's integrity of it, the patch it is of (none here, the app reviewing no
+// patch yet), the version it was compared with (none for a whole package's),
+// who wrote it (`reviewer`, their id, else their login then), their login
+// as it was then (`login`), its verdict, whether it checked every file
+// (`full`), and when it was published.
+// One made in a pull request's comments (`comment`) counts for it alone;
+// one published here has its `id`.
+export interface PublishedReview {
+  id?: string; package: string; version: string; integrity: string; patchHash?: string; basePackage: string | null; baseVersion: string | null
+  reviewer: string; login: string; status: ReviewVerdict; full: boolean; time: number; comment?: true
+}
+// A repository's review in effect for a reader: its settings, whether they
+// publish reviews to one of the teams that count (`canReview`), and the
+// published reviews of the packages asked.
+export interface RepoReviewState extends Omit<RepoDependencyReview, 'enabled'> { canReview: boolean; reviews: PublishedReview[] }
+
+// A package version whose published reviews are asked.
+export interface ReviewedVersionKey { name: string; version: string }
+
+export interface RepositoryDependencyReviewStore {
+  listRepoDependencyReviews(): Promise<Map<number, RepoDependencyReview>>
+  // One repository's, none where it isn't connected.
+  repoDependencyReview(repoId: number): Promise<RepoDependencyReview | null>
+  // Those of `repoIds` connected, by their ids, in one statement.
+  getRepoDependencyReviews(repoIds: number[]): Promise<Map<number, RepoDependencyReview>>
+  // The teams whose published reviews count for each repository (COUNTING_TEAM),
+  // by name.
+  listRepoReviewTeams(): Promise<Map<number, { id: string; name: string }[]>>
+  // Sets a repository's review, its commit and lockfiles too but where
+  // `since` or `lockfiles` is undefined, which keeps it; the setting then, or
+  // null for no repository.
+  setRepoDependencyReview(repoId: number, setting: Omit<RepoDependencyReview, 'since' | 'lockfiles'> & { since?: string | null; lockfiles?: LockfileScope }): Promise<RepoDependencyReview | null>
+  // Its review in effect for `user`, as `setting` tells it where read
+  // already, with the published reviews of `versions`.
+  repoDependencyReviewState(repoId: number, user: string, versions: ReviewedVersionKey[], setting?: RepoDependencyReview | null): Promise<RepoReviewState | null>
+  // Which of `users` publish reviews to a team counting for repository
+  // `repoId`, whose reviews its pull requests' comments make count.
+  listRepoReviewers(repoId: number, users: string[]): Promise<Set<string>>
+}
+
+type SettingRow = { repoId: number; enabled: number; required: number; since: string | null; lockfiles: string | null }
+const setting = (row: SettingRow): RepoDependencyReview => ({ enabled: row.enabled === 1, required: row.required, since: row.since, lockfiles: storedScope(row.lockfiles) })
+// Teams whose published reviews count for repository `?`: that review
+// dependencies and have it, not hidden.
+const COUNTING_TEAM = `t.hidden = 0 AND t.dependency_review = 1 AND EXISTS (
+  SELECT 1 FROM managed_team_repo tr WHERE tr.team_id = t.id AND tr.repo_id = ?)`
+const VERSIONS_AT_ONCE = 250
+
+// The published and unrevoked reviews of `versions` in teams counting for
+// repository `repoId`, each with whether it is full, a couple of hundred
+// versions a query: those of their packages' and versions' found, the
+// versions asked alone kept, their files' reviews read of those alone.
+async function publishedReviews(db: ManagedSql, repoId: number, versions: ReviewedVersionKey[]): Promise<PublishedReview[]> {
+  const found: PublishedReview[] = []
+  for (let at = 0; at < versions.length; at += VERSIONS_AT_ONCE) {
+    const asked = versions.slice(at, at + VERSIONS_AT_ONCE)
+    const keys = new Set(asked.map(({ name, version }) => `${name}@${version}`))
+    const [names, numbers] = [[...new Set(asked.map(({ name }) => name))], [...new Set(asked.map(({ version }) => version))]]
+    const rows = (await db.prepare(`SELECT r.id, r.user_id AS userId, r.user_login AS userLogin, r.package, r.version, r.integrity,
+        NULLIF(r.base_package, '') AS basePackage, NULLIF(r.base_version, '') AS baseVersion, r.files, r.status, r.published_at AS publishedAt
+      FROM managed_dependency_review r
+      WHERE r.ecosystem = 'npm' AND r.published_at IS NOT NULL AND r.revoked_at IS NULL AND r.status IS NOT NULL
+        AND r.package IN (${names.map(() => '?').join(',')}) AND r.version IN (${numbers.map(() => '?').join(',')})
+        AND EXISTS (SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id
+          WHERE rt.review_id = r.id AND ${COUNTING_TEAM})`).all(...names, ...numbers, repoId) as
+      { id: string; userId: string | null; userLogin: string; package: string; version: string; integrity: string
+        basePackage: string | null; baseVersion: string | null; files: string | null; status: ReviewVerdict; publishedAt: number }[])
+      .filter(row => keys.has(`${row.package}@${row.version}`))
+    if (rows.length === 0) continue
+    const entries = new Map<string, { file: string; status: ReviewVerdict | null }[]>()
+    for (const { reviewId, ...entry } of await db.prepare(`SELECT review_id AS reviewId, file, status FROM managed_dependency_file_review
+      WHERE review_id IN (${rows.map(() => '?').join(',')})`).all(...rows.map(row => row.id)) as { reviewId: string; file: string; status: ReviewVerdict | null }[]) {
+      const of = entries.get(reviewId)
+      if (of) of.push(entry)
+      else entries.set(reviewId, [entry])
+    }
+    for (const row of rows) {
+      const snapshot = row.files === null ? null : JSON.parse(row.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+      // A snapshot of paths alone, before non-text files were told, can't be full.
+      const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+      const nonText = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+      const full = summarizeReview(entries.get(row.id) ?? [], files, nonText).coverage === 'full'
+      found.push({ id: row.id, package: row.package, version: row.version, integrity: row.integrity, basePackage: row.basePackage, baseVersion: row.baseVersion,
+        reviewer: row.userId ?? `login:${row.userLogin.toLowerCase()}`, login: row.userLogin, status: row.status, full, time: Number(row.publishedAt) })
+    }
+  }
+  return found
+}
+
+export function repositoryDependencyReviewMethods(db: ManagedSql): RepositoryDependencyReviewStore {
+  const columns = `repo_id AS repoId, dependency_review AS enabled, dependency_reviews_required AS required, dependency_review_since AS since,
+    dependency_review_lockfiles AS lockfiles`
+  const readSetting = async (repoId: number) => {
+    const row = await db.prepare(`SELECT ${columns} FROM managed_selected_repo WHERE repo_id = ?`).get(repoId) as SettingRow | undefined
+    return row ? setting(row) : null
+  }
+  return {
+    async listRepoDependencyReviews() {
+      const rows = await db.prepare(`SELECT ${columns} FROM managed_selected_repo`).all() as SettingRow[]
+      return new Map(rows.map(row => [row.repoId, setting(row)]))
+    },
+    repoDependencyReview: readSetting,
+    async getRepoDependencyReviews(repoIds) {
+      if (repoIds.length === 0) return new Map()
+      const rows = await db.prepare(`SELECT ${columns} FROM managed_selected_repo WHERE repo_id IN (${repoIds.map(() => '?').join(',')})`).all(...repoIds) as SettingRow[]
+      return new Map(rows.map(row => [row.repoId, setting(row)]))
+    },
+    async listRepoReviewTeams() {
+      const rows = await db.prepare(`SELECT DISTINCT tr.repo_id AS repoId, t.id AS id, t.name AS name FROM managed_team_repo tr
+        JOIN managed_team t ON t.id = tr.team_id WHERE t.hidden = 0 AND t.dependency_review = 1 ORDER BY t.name, t.id`).all() as { repoId: number; id: string; name: string }[]
+      const teams = new Map<number, { id: string; name: string }[]>()
+      for (const { repoId, id, name } of rows) teams.set(repoId, [...teams.get(repoId) ?? [], { id, name }])
+      return teams
+    },
+    async setRepoDependencyReview(repoId, { enabled, required, since, lockfiles }) {
+      const set: [string, unknown][] = [['dependency_review', enabled ? 1 : 0], ['dependency_reviews_required', required],
+        ...since === undefined ? [] : [['dependency_review_since', since] as [string, unknown]],
+        ...lockfiles === undefined ? [] : [['dependency_review_lockfiles', scopeText(lockfiles)] as [string, unknown]]]
+      const { changes } = await db.prepare(`UPDATE managed_selected_repo SET ${set.map(([column]) => `${column} = ?`).join(', ')} WHERE repo_id = ?`)
+        .run(...set.map(([, value]) => value), repoId)
+      if (Number(changes) === 0) return null
+      return setting(await db.prepare(`SELECT ${columns} FROM managed_selected_repo WHERE repo_id = ?`).get(repoId) as SettingRow)
+    },
+    async listRepoReviewers(repoId, users) {
+      if (users.length === 0) return new Set()
+      const rows = await db.prepare(`SELECT DISTINCT u.id FROM managed_user u JOIN managed_team t ON t.hidden = 0
+        WHERE u.id IN (${users.map(() => '?').join(',')}) AND ${reviewsIn(true)} AND ${COUNTING_TEAM}`).all(...users, repoId) as { id: string }[]
+      return new Set(rows.map(row => row.id))
+    },
+    async repoDependencyReviewState(repoId, user, versions, read) {
+      const now = read === undefined ? await readSetting(repoId) : read
+      if (!now?.enabled) return null
+      if (!await db.prepare(`SELECT 1 FROM managed_team t WHERE ${COUNTING_TEAM}`).get(repoId)) return null
+      const canReview = await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ?
+        WHERE ${reviewsIn(true)} AND ${COUNTING_TEAM}`).get(user, repoId) != null
+      const asked = [...new Map(versions.map(version => [`${version.name}@${version.version}`, version])).values()]
+      return { required: now.required, since: now.since, lockfiles: now.lockfiles, canReview, reviews: await publishedReviews(db, repoId, asked) }
+    },
+  }
+}

package/server-managed/repository-discovery.ts

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto'
+import type { ManagedConfig } from './config.ts'
+import { GithubApiError, filterInstalledRepos, listInstalledRepos, listUserRepos } from './github-app.ts'
+import type { ConnectedRepo, RepoListing } from './github-app.ts'
+
+const CACHE_MS = 60_000
+const MAX_ENTRIES = 100
+interface Entry {
+  expires: number
+  pending: boolean
+  value: Promise<ConnectedRepo[]>
+}
+
+// One directory per HTTP handler. Searches/pages reuse discovery, but selected
+// flags still come from the database on every request. User results are scoped
+// to both the managed identity and its current GitHub credential. This cache is
+// only for discovery; connecting a repo still verifies fresh installation access.
+export class RepositoryDiscovery {
+  private readonly cache = new Map<string, Entry>()
+  private readonly config: ManagedConfig
+  private readonly fetchImpl: typeof fetch
+  private readonly now: () => number
+
+  constructor(config: ManagedConfig, fetchImpl: typeof fetch = (...args) => globalThis.fetch(...args), now: () => number = Date.now) {
+    this.config = config
+    this.fetchImpl = fetchImpl
+    this.now = now
+  }
+
+  private read(key: string, load: () => Promise<ConnectedRepo[]>): Promise<ConnectedRepo[]> {
+    const cached = this.cache.get(key)
+    if (cached && (cached.pending || cached.expires > this.now())) return cached.value
+    this.cache.delete(key)
+    while (this.cache.size >= MAX_ENTRIES) this.cache.delete(this.cache.keys().next().value!)
+    const entry: Entry = { expires: 0, pending: true, value: Promise.resolve([]) }
+    entry.value = load().then(repos => {
+      entry.expires = this.now() + CACHE_MS
+      entry.pending = false
+      return repos
+    }, (err: unknown) => {
+      if (this.cache.get(key) === entry) this.cache.delete(key)
+      throw err
+    })
+    this.cache.set(key, entry)
+    return entry.value
+  }
+
+  async list(scope: 'installed' | 'public', userId: string, token: string | null, showAll = false, refresh = false): Promise<RepoListing> {
+    // Invalidate derived user results along with the installation catalogue.
+    // An older in-flight read cannot repopulate this map after refresh.
+    if (refresh) this.cache.clear()
+    const installed = () => this.read('installed', () => listInstalledRepos(this.config, this.fetchImpl))
+    if (scope === 'installed' && showAll) return { repositories: await installed(), tokenMissing: false }
+    const publicInstalled = async (): Promise<ConnectedRepo[]> => (await installed()).filter(repo => repo.visibility === 'public')
+    if (token == null) return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    const credential = createHash('sha256').update(token).digest('hex')
+    const key = JSON.stringify([scope, userId, credential])
+    try {
+      if (scope === 'installed') {
+        const repositories = await this.read(key, async () => filterInstalledRepos(this.config, await installed(), token, this.fetchImpl))
+        return { repositories, tokenMissing: false }
+      }
+      // Installations only deduplicate the public picker. Their failure must
+      // not block otherwise readable public repos or look like a stale login.
+      // Cache the two sources separately so failed installation discovery is
+      // retried without caching a degraded combined list for another minute.
+      const [userRepos, installedRepos] = await Promise.all([
+        this.read(key, () => listUserRepos(token)),
+        installed().catch((err: unknown) => {
+          console.warn('managed: installed repo deduplication failed:', err)
+          return []
+        }),
+      ])
+      const installedIds = new Set(installedRepos.map(repo => repo.id))
+      const repositories = userRepos.filter(repo => repo.visibility === 'public' && !installedIds.has(repo.id))
+      return { repositories, tokenMissing: false }
+    } catch (err) {
+      if (!(err instanceof GithubApiError) || err.status !== 401) throw err
+      return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    }
+  }
+}