@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/dependency-review-comments.ts

@@ -0,0 +1,98 @@
+// The comment a host formats of one's own dependency reviews, for a copy
+// button to give (reviewed-dependencies.ts `formatDependencyReviews`): of each
+// of one's reviews, as their lists and the review page show them
+// (`withFormatted`), and of those of the versions an open pull request adds
+// (`formattedPull`). It is given one's own published reviews alone, never
+// another's, a draft or a revoked one, however it is asked (`formatOwn`, the
+// only caller of the hook); and is told of none where it answers nothing, or
+// fails, which is logged.
+import type { DependencyReview, DependencyReviewStore } from './dependency-reviews.ts'
+import { type PullDependencies, eachOf } from './pull-dependencies.ts'
+import type { PublishedReview, RepoReviewState } from './repository-dependency-reviews.ts'
+import type { DependencyReviewEntry, ReviewedDependencies } from './reviewed-dependencies.ts'
+
+const FORMAT_AT_ONCE = 8
+// The longest comment told, past which none is.
+const MAX_FORMATTED = 1_000_000
+// The reviews of a pull request's versions read at once, those past them
+// read after, every one formatted.
+const REVIEWS_AT_ONCE = 200
+
+// `review` as the hook is given it: each version with the integrity and
+// shasum the review keeps of the tarball it read, and the version it is of
+// with the patch it is of, where it is a patched one's.
+function entryOf(review: DependencyReview): DependencyReviewEntry {
+  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '',
+      ...review.baseShasum ? { shasum: review.baseShasum } : {} },
+    new: { name: review.package, version: review.version, integrity: review.integrity, ...review.shasum ? { shasum: review.shasum } : {},
+      ...review.patchHash ? { patchHash: review.patchHash } : {} },
+    status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
+    files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),
+    reviewer: review.userLogin, publishedAt: review.publishedAt! }
+}
+
+// Whether `review` is `user`'s own, published, not revoked, with its verdict.
+const ownPublished = (review: DependencyReview, user: string) => review.user === user && review.publishedAt !== null && review.revokedAt === null && review.status !== null
+
+// What the host formats of `reviews`, of them `user`'s own published ones
+// alone, and the pull request they are of the versions of, where it is
+// one's; none where it formats none of them.
+async function formatOwn(reviewed: ReviewedDependencies | null, user: string, reviews: DependencyReview[],
+  pullRequest?: { repository: string; number: number }): Promise<string | null> {
+  const format = reviewed?.formatDependencyReviews
+  const own = reviews.filter(review => ownPublished(review, user))
+  if (!format || own.length === 0) return null
+  try {
+    const text = await format({ reviews: own.map(entryOf), ...pullRequest ? { pullRequest } : {} })
+    return typeof text === 'string' && text.trim() !== '' && text.length <= MAX_FORMATTED ? text : null
+  } catch (error) {
+    console.warn('reviewed dependencies: failed to format dependency reviews', error instanceof Error ? error.message : error)
+    return null
+  }
+}
+
+// `reviews`, each of `user`'s own with the comment the host formats of it
+// (`formatted`), where it formats one; another's never asked of.
+export function withFormatted<T extends DependencyReview>(reviewed: ReviewedDependencies | null, user: string, reviews: T[]): Promise<(T & { formatted?: string })[]> {
+  if (!reviewed?.formatDependencyReviews) return Promise.resolve(reviews)
+  return eachOf(reviews, FORMAT_AT_ONCE, async review => {
+    const formatted = ownPublished(review, user) ? await formatOwn(reviewed, user, [review]) : null
+    return formatted ? { ...review, formatted } : review
+  })
+}
+
+// The ids of those of `reviews` `user` published of the versions `told`
+// adds, as its lockfiles lock each: of its version, of an integrity it is
+// locked with and of its patch, whole or compared with a version it was.
+function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: string): Set<string> {
+  // Theirs by the version they are of, each version probed once.
+  const theirs = new Map<string, PublishedReview[]>()
+  for (const review of reviews) {
+    if (review.id === undefined || review.reviewer !== user) continue
+    const key = `${review.package}@${review.version}`
+    theirs.set(key, [...theirs.get(key) ?? [], review])
+  }
+  const mine = new Set<string>()
+  if (theirs.size === 0) return mine
+  for (const pkg of told.lockfiles.flatMap(dir => 'added' in dir ? dir.added : [])) {
+    const hashes = new Set((pkg.integrity ?? '').split(/\s+/u).filter(Boolean))
+    for (const review of theirs.get(`${pkg.name}@${pkg.version}`) ?? []) {
+      if (!hashes.has(review.integrity) || (review.patchHash ?? '') !== (pkg.patchHash ?? '')) continue
+      if (review.basePackage === null || (review.basePackage === pkg.name && (pkg.was ?? []).includes(review.baseVersion ?? ''))) mine.add(review.id!)
+    }
+  }
+  return mine
+}
+
+// The comment the host formats of `user`'s reviews of the versions pull
+// request `number` of `repository` adds (`told`), those its review's state
+// tells of, published to a team counting for it; none where it has none.
+export async function formattedPull(reviewed: ReviewedDependencies | null, db: Pick<DependencyReviewStore, 'listOwnDependencyReviewsById'>, user: string,
+  told: PullDependencies, state: RepoReviewState | null, pullRequest: { repository: string; number: number }): Promise<string | null> {
+  if (!reviewed?.formatDependencyReviews || !state) return null
+  const mine = ownOfPull(told, state.reviews, user)
+  if (mine.size === 0) return null
+  const ids = [...mine], reviews: DependencyReview[] = []
+  for (let at = 0; at < ids.length; at += REVIEWS_AT_ONCE) reviews.push(...await db.listOwnDependencyReviewsById(user, ids.slice(at, at + REVIEWS_AT_ONCE)))
+  return formatOwn(reviewed, user, reviews, pullRequest)
+}

package/server-managed/dependency-reviews.ts

@@ -0,0 +1,364 @@
+import { randomUUID } from 'node:crypto'
+import { ManagedMutationError } from './management.ts'
+import type { PatchSource } from './npm-patch.ts'
+import type { ManagedSql } from './sql.ts'
+import { REVIEW_VERDICTS, type ReviewSummary, type ReviewVerdict, allowedReviewVerdicts, needsPackageJsonReview, summarizeReview } from '../common/dependency-reviews.js'
+
+// A review is of a version, as npm's registry has it, by its integrity; of
+// it as pnpm patches it (`patchHash`, the patch's hash as a lockfile names
+// it), where it is patched; and compared with a version (its base), or none.
+export interface ReviewContext {
+  ecosystem: 'npm'; package: string; version: string; integrity: string; patchHash: string | null
+  basePackage: string | null; baseVersion: string | null; baseIntegrity: string | null
+}
+// The shasums (sha1s, in hex) of the tarballs a review reads, its version's
+// and its base's, where npm tells them: each held, with its integrity, to the
+// tarball its reviewer was shown, as a review is written (http.ts); and where
+// its patch was read (`patch`, npm-patch.ts), a patched version's.
+export interface ReviewedTarballs { shasum: string | null; baseShasum: string | null; patch?: PatchSource | null }
+export interface ReviewInput { file: string; comment: string; status: ReviewVerdict | null }
+export interface ReviewEntry extends ReviewInput { id: string; time: number }
+export interface ReviewTeam { id: string; name: string }
+export interface DependencyReview extends ReviewContext, Omit<ReviewedTarballs, 'patch'>, ReviewSummary {
+  // Where its patch was read, as it was written last: whence it is read again.
+  patchSource: PatchSource | null
+  id: string; user: string | null; userLogin: string; userName: string | null; time: number; revision: number
+  publishedAt: number | null; revokedAt: number | null; entries: ReviewEntry[]; teams: ReviewTeam[]; files: string[] | null
+  nonTextFiles: string[] | null
+  status: ReviewVerdict | null; comment: string
+}
+export type ReviewChange = { action: 'save'; reviewId: string | null; revision: number | null; entryId: string | null; entry: ReviewInput }
+  | { action: 'start'; reviewId: null; revision: null }
+  | { action: 'publish'; reviewId: string; revision: number; teamIds: string[]; files: string[]; nonTextFiles: string[]; final: { status: ReviewVerdict; comment: string } | null }
+  | { action: 'continue'; reviewId: string; revision: number }
+  | { action: 'revoke'; reviewId: string; revision: number }
+export interface DependencyReviewStore {
+  listDependencyReviews(context: ReviewContext, user: string, allBases?: boolean): Promise<DependencyReview[]>
+  getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity' | 'patchHash'>): Promise<DependencyReview | null>
+  listOwnDependencyReviews(user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null }>
+  // `user`'s own reviews of `ids`, none another's.
+  listOwnDependencyReviewsById(user: string, ids: string[]): Promise<DependencyReview[]>
+  // The reviews published to team `teamId`, revoked ones too, the latest
+  // published first, a page on from `before` (when it was published, and
+  // its id), for one who reads them there (reviewsIn); null for another.
+  // In one statement.
+  listTeamDependencyReviews(teamId: string, user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null } | null>
+  listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
+  listDependencyReviewEnabledTeams(): Promise<string[]>
+  setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
+  discardDependencyReview(sessionId: string, reviewId: string, revision: number): Promise<void>
+  // Written with the shasums of the tarballs read (`tarballs`), and where its
+  // patch was, which a draft keeps as it is begun, saved and published; none
+  // where not told.
+  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number, tarballs?: ReviewedTarballs): Promise<DependencyReview>
+}
+
+// An unpublished review belongs only to its author. Publication freezes all
+// entries together and attaches that snapshot to its selected teams. Continuing
+// makes a new review; published entries and their timestamps never change.
+// Each author's one draft of a comparison is held so by
+// DEPENDENCY_REVIEW_INDEXES, once its columns are.
+export const DEPENDENCY_REVIEW_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_dependency_review (
+  id TEXT PRIMARY KEY,
+  user_id TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  user_login TEXT NOT NULL, ecosystem TEXT NOT NULL,
+  package TEXT NOT NULL, version TEXT NOT NULL, integrity TEXT NOT NULL,
+  base_package TEXT NOT NULL, base_version TEXT NOT NULL, base_integrity TEXT NOT NULL,
+  time INTEGER NOT NULL, revision INTEGER NOT NULL, published_at INTEGER, revoked_at INTEGER, files TEXT,
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT '',
+  shasum TEXT NOT NULL DEFAULT '', base_shasum TEXT NOT NULL DEFAULT '', patch_hash TEXT NOT NULL DEFAULT '', patch_source TEXT
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_context_idx
+  ON managed_dependency_review(ecosystem, package, version, integrity, base_package, base_version, base_integrity, time);
+CREATE INDEX IF NOT EXISTS managed_dependency_review_author_idx ON managed_dependency_review(user_id, time, id);
+CREATE TABLE IF NOT EXISTS managed_dependency_file_review (
+  id TEXT PRIMARY KEY, review_id TEXT NOT NULL REFERENCES managed_dependency_review(id) ON DELETE CASCADE,
+  file TEXT NOT NULL, comment TEXT NOT NULL,
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), time INTEGER NOT NULL
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_file_review_idx ON managed_dependency_file_review(review_id);
+CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
+  review_id TEXT NOT NULL REFERENCES managed_dependency_review(id) ON DELETE CASCADE,
+  team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  PRIMARY KEY (review_id, team_id)
+) STRICT;
+CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
+`
+// The columns added since the table was, for a database that has it already.
+export const DEPENDENCY_REVIEW_COLUMNS = [['shasum', "TEXT NOT NULL DEFAULT ''"], ['base_shasum', "TEXT NOT NULL DEFAULT ''"],
+  ['patch_hash', "TEXT NOT NULL DEFAULT ''"], ['patch_source', 'TEXT']] as const
+// Each author's one draft of a comparison, its patch's too, made once those
+// columns are: the index held to it before patches were reviewed gone.
+export const DEPENDENCY_REVIEW_INDEXES = `
+DROP INDEX IF EXISTS managed_dependency_review_unpublished_idx;
+CREATE UNIQUE INDEX IF NOT EXISTS managed_dependency_review_draft_idx
+  ON managed_dependency_review(user_id, ecosystem, package, version, integrity, patch_hash, base_package, base_version, base_integrity)
+  WHERE published_at IS NULL;`
+const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.patchHash ?? '', c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
+const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ? AND patch_hash = ?'
+const contextWhere = `${targetWhere} AND base_package = ? AND base_version = ? AND base_integrity = ?`
+// Its author by the login they reviewed as, and by the name the app's user
+// has now (null once they are none, or have none), as the lists show them.
+const columns = `id, user_id AS user, user_login AS userLogin, (SELECT n.name FROM managed_user n WHERE n.id = user_id) AS userName, ecosystem, package, version, integrity,
+  NULLIF(patch_hash, '') AS patchHash, NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
+  NULLIF(shasum, '') AS shasum, NULLIF(base_shasum, '') AS baseShasum, patch_source AS patchSource,
+  time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
+const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
+// What a review keeps of the bytes it read: its tarballs' shasums, and where
+// its patch was.
+const shasums = (tarballs: ReviewedTarballs | undefined) => [tarballs?.shasum ?? '', tarballs?.baseShasum ?? '', tarballs?.patch ? JSON.stringify(tarballs.patch) : null]
+
+// Who reviews dependencies in team `t`, user `u` as the query joins them: an
+// admin, in any team; a member who manages, in theirs; a member who triages,
+// in theirs whose dependencies they may see (`view_dependencies`). Publishing
+// (`publishing`) needs the team to review dependencies; reading what was
+// published there, not, so what it published stays read once it stops. A
+// hidden team is no one's.
+export const reviewsIn = (publishing: boolean) => `t.hidden = 0${publishing ? ' AND t.dependency_review = 1' : ''} AND (u.role = 'admin' OR EXISTS (
+  SELECT 1 FROM managed_team_user m WHERE m.team_id = t.id AND m.user_id = u.id
+    AND (u.role = 'manage' OR (u.role = 'triage' AND m.view_dependencies = 1))))`
+
+// Fold legacy multi-note files into one text field without changing a frozen
+// snapshot's stored rows. Continuing or saving uses one row per file.
+function fileEntries(entries: ReviewEntry[]): ReviewEntry[] {
+  const files = new Map<string, ReviewEntry>(), verdicts = Object.keys(REVIEW_VERDICTS)
+  for (const entry of entries) {
+    if (entry.status === null) continue
+    const current = files.get(entry.file)
+    if (!current) { files.set(entry.file, { ...entry }); continue }
+    current.comment = [current.comment, entry.comment].filter(Boolean).join('\n\n')
+    if (verdicts.indexOf(entry.status ?? '') > verdicts.indexOf(current.status ?? '')) current.status = entry.status
+    current.time = Math.max(current.time, entry.time)
+  }
+  return [...files.values()]
+}
+
+async function actor(db: ManagedSql, sessionId: string, admin = false) {
+  const user = await db.prepare(`SELECT u.id, u.login, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+    WHERE s.id = ? AND s.expires_at > ? AND s.viewer_session IS NULL`).get(sessionId, Date.now()) as { id: string; login: string; role: string } | undefined
+  if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+  if (!(admin ? ['admin'] : ['triage', 'manage', 'admin']).includes(user.role)) throw new ManagedMutationError(403, 'forbidden')
+  return user
+}
+// The teams `user` publishes reviews to (reviewsIn).
+async function teams(db: ManagedSql, user: string): Promise<ReviewTeam[]> {
+  return await db.prepare(`SELECT t.id, t.name FROM managed_team t JOIN managed_user u ON u.id = ?
+    WHERE ${reviewsIn(true)} ORDER BY t.name, t.id`).all(user) as ReviewTeam[]
+}
+// A draft is begun or edited by one who publishes to some team; their own
+// published review revoked, or published to more teams, as `publish` checks
+// each, whoever they are now.
+async function requireReviewer(db: ManagedSql, user: string) {
+  if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
+}
+
+type ReviewRow = Omit<DependencyReview, 'files' | 'entries' | 'teams' | 'patchSource' | keyof ReviewSummary> & { files: string | null; patchSource: string | null }
+async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
+  const reviews = rows as ReviewRow[]
+  if (reviews.length === 0) return []
+  const ids = reviews.map(review => review.id), placeholders = ids.map(() => '?').join(',')
+  const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
+    FROM managed_dependency_file_review WHERE review_id IN (${placeholders}) ORDER BY time, id`).all(...ids) as (ReviewEntry & { reviewId: string })[]
+  const linked = await db.prepare(`SELECT rt.review_id AS reviewId, t.id, t.name FROM managed_dependency_review_team rt
+    JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+    WHERE rt.review_id IN (${placeholders}) AND (r.user_id = u.id OR (${reviewsIn(false)}))
+    ORDER BY t.name, t.id`).all(user, ...ids) as (ReviewTeam & { reviewId: string })[]
+  // Each review's own, in their order, by its id.
+  const byReview = <T extends { reviewId: string }>(list: T[]) => {
+    const of = new Map<string, Omit<T, 'reviewId'>[]>()
+    for (const { reviewId, ...row } of list) {
+      const own = of.get(reviewId)
+      if (own) own.push(row)
+      else of.set(reviewId, [row])
+    }
+    return of
+  }
+  const [entriesOf, teamsOf] = [byReview(entries), byReview(linked)]
+  return reviews.map(review => expanded(review, (entriesOf.get(review.id) ?? []) as ReviewEntry[], (teamsOf.get(review.id) ?? []) as ReviewTeam[]))
+}
+// A review as its row, its entries and the teams its reader reads it in
+// tell it: its files' snapshot, its entries a file's each (fileEntries), and
+// what they sum up to; where its patch was read.
+function expanded(review: ReviewRow, entries: ReviewEntry[], readIn: ReviewTeam[]): DependencyReview {
+  const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+  const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+  const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+  const ownEntries = fileEntries(entries)
+  return { ...review, patchSource: review.patchSource ? JSON.parse(review.patchSource) as PatchSource : null, files, nonTextFiles, entries: ownEntries,
+    ...summarizeReview(ownEntries, files, nonTextFiles), teams: readIn }
+}
+// Rows gathered into one JSON array value (json_group_array): its text on
+// SQLite, parsed already on Postgres, where none gather as NULL.
+export const gathered = <T>(value: unknown): T[] => value == null ? [] : (typeof value === 'string' ? JSON.parse(value) : value) as T[]
+
+async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number,
+  tarballs: ReviewedTarballs | undefined) {
+  if (!current || current.revokedAt !== null) return conflict()
+  const allowed = new Set((await teams(db, user)).map(team => team.id))
+  const selected = [...new Set(change.teamIds)]
+  if (selected.length === 0 || selected.some(team => !allowed.has(team))) throw new ManagedMutationError(400, 'bad-review-teams')
+  const entries = await db.prepare('SELECT file, status FROM managed_dependency_file_review WHERE review_id = ?').all(current.id) as ReviewInput[]
+  if (current.publishedAt === null) {
+    if (!summarizeReview(entries, change.files, change.nonTextFiles).checkedFiles) throw new ManagedMutationError(400, 'no-reviewed-files')
+    if (!change.final || !allowedReviewVerdicts(entries.filter(entry => !change.nonTextFiles.includes(entry.file))).includes(change.final.status)) throw new ManagedMutationError(400, 'bad-final-verdict')
+    if (needsPackageJsonReview(entries, change.files, change.nonTextFiles)) throw new ManagedMutationError(400, 'package-json-not-reviewed')
+    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, shasum = ?, base_shasum = ?, patch_source = ?, revision = revision + 1
+      WHERE id = ?`).run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }),
+      change.final.status, change.final.comment, ...shasums(tarballs), current.id)
+  } else {
+    if (change.final) return conflict()
+    await db.prepare('UPDATE managed_dependency_review SET revision = revision + 1 WHERE id = ?').run(current.id)
+  }
+  for (const team of selected) await db.prepare('INSERT INTO managed_dependency_review_team (review_id, team_id) VALUES (?, ?) ON CONFLICT DO NOTHING').run(current.id, team)
+}
+
+async function listOwn(db: ManagedSql, user: string, before: { time: number; id: string } | null) {
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE user_id = ?
+    ${before ? 'AND (time < ? OR (time = ? AND id < ?))' : ''} ORDER BY time DESC, id DESC LIMIT 51`)
+    .all(user, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
+  const page = rows.slice(0, 50)
+  const last = page.at(-1)
+  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: last.time, id: last.id } : null }
+}
+
+// A version's reviews, of its base (`context`), or of any (`allBases`), that
+// `user` reads: their own, and those published to a team they read in.
+async function listContext(db: ManagedSql, context: ReviewContext, user: string, allBases: boolean) {
+  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r WHERE ${allBases ? targetWhere : contextWhere}
+    AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
+      SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
+      WHERE rt.review_id = r.id AND ${reviewsIn(false)})))
+    ORDER BY time, id`).all(...values(context).slice(0, allBases ? 5 : 8), user, user)
+  return expandReviews(db, rows, user)
+}
+
+// A team's page of reviews in one statement: a row of its reader `v` where
+// they read them there (reviewsIn), none for another, with each review on
+// a row of its own, its entries and the teams `v` reads it in (as
+// expandReviews reads them) each one JSON array.
+async function listTeam(db: ManagedSql, teamId: string, user: string, before: { time: number; id: string } | null) {
+  const rows = await db.prepare(`WITH reader AS (
+      SELECT u.id AS id FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}
+    ), page AS (
+      SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
+      WHERE rt.team_id = ? AND r.published_at IS NOT NULL AND EXISTS (SELECT 1 FROM reader)
+        ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
+      ORDER BY r.published_at DESC, r.id DESC LIMIT 51
+    )
+    SELECT v.id AS reader, p.*,
+      (SELECT json_group_array(json_object('id', e.id, 'file', e.file, 'comment', e.comment, 'status', e.status, 'time', e.time) ORDER BY e.time, e.id)
+        FROM managed_dependency_file_review e WHERE e.review_id = p.id) AS entries,
+      (SELECT json_group_array(json_object('id', t.id, 'name', t.name) ORDER BY t.name, t.id)
+        FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = v.id
+        WHERE rt.review_id = p.id AND (p.user = u.id OR (${reviewsIn(false)}))) AS teams
+    FROM reader v LEFT JOIN page p ON 1 = 1
+    ORDER BY p.publishedAt DESC, p.id DESC`).all(user, teamId, teamId, ...before ? [before.time, before.time, before.id] : []) as
+    (ReviewRow & { reader: string; entries: unknown; teams: unknown })[]
+  if (rows.length === 0) return null
+  const reviews = rows.filter(row => row.id != null)
+  const page = reviews.slice(0, 50)
+  const last = page.at(-1)
+  return { reviews: page.map(({ reader: _reader, entries, teams: readIn, ...review }) => expanded(review, gathered(entries), gathered(readIn))),
+    next: reviews.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
+}
+
+async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
+  const existing = await db.prepare(`SELECT id FROM managed_dependency_file_review
+    WHERE review_id = ? AND file = ? ORDER BY time, id`).all(reviewId, entry.file) as { id: string }[]
+  if (requestedId && !existing.some(row => row.id === requestedId)) return conflict()
+  if (entry.status === null) {
+    await db.prepare('DELETE FROM managed_dependency_file_review WHERE review_id = ? AND file = ?').run(reviewId, entry.file)
+  } else if (existing.length > 0) {
+    const entryId = existing[0]!.id
+    await db.prepare('UPDATE managed_dependency_file_review SET comment = ?, status = ?, time = ? WHERE id = ?')
+      .run(entry.comment, entry.status, now, entryId)
+    if (existing.length > 1) {
+      await db.prepare(`DELETE FROM managed_dependency_file_review
+        WHERE review_id = ? AND file = ? AND id <> ?`).run(reviewId, entry.file, entryId)
+    }
+  } else {
+    await db.prepare('INSERT INTO managed_dependency_file_review (id, review_id, file, comment, status, time) VALUES (?, ?, ?, ?, ?, ?)')
+      .run(randomUUID(), reviewId, entry.file, entry.comment, entry.status, now)
+  }
+}
+
+export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
+  const read = (id: string) => db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ?`).get(id)
+  return {
+    listOwnDependencyReviews: (user, before) => listOwn(db, user, before),
+    async listOwnDependencyReviewsById(user, ids) {
+      if (ids.length === 0) return []
+      return expandReviews(db, await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE user_id = ? AND id IN (${ids.map(() => '?').join(',')})
+        ORDER BY time, id`).all(user, ...ids), user)
+    },
+    listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
+    async getLatestOwnDependencyReview(user, target) {
+      const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
+        WHERE user_id = ? AND ${targetWhere} ORDER BY time DESC, id DESC LIMIT 1`)
+        .get(user, target.ecosystem, target.package, target.version, target.integrity, target.patchHash ?? '')
+      return row ? (await expandReviews(db, [row], user))[0]! : null
+    },
+    async discardDependencyReview(sessionId, reviewId, revision) {
+      const user = await actor(db, sessionId)
+      const { changes } = await db.prepare(`DELETE FROM managed_dependency_review
+        WHERE id = ? AND user_id = ? AND revision = ? AND published_at IS NULL`).run(reviewId, user.id, revision)
+      if (Number(changes) !== 1) conflict()
+    },
+    listDependencyReviewEnabledTeams: async () => (await db.prepare('SELECT id FROM managed_team WHERE dependency_review = 1 ORDER BY id').all() as { id: string }[]).map(row => row.id),
+    async setTeamDependencyReview(sessionId, teamId, enabled) {
+      await actor(db, sessionId, true)
+      if (!await db.prepare('SELECT id FROM managed_team WHERE id = ?').get(teamId)) return false
+      await db.prepare('UPDATE managed_team SET dependency_review = ? WHERE id = ?').run(enabled ? 1 : 0, teamId)
+      return true
+    },
+    listDependencyReviewTeams: user => teams(db, user),
+    listDependencyReviews: (context, user, allBases = false) => listContext(db, context, user, allBases),
+    async changeDependencyReview(context, sessionId, change, now, tarballs) {
+      const user = await actor(db, sessionId)
+      if (change.action !== 'revoke' && change.action !== 'publish') await requireReviewer(db, user.id)
+      let id = change.reviewId
+      let current: DependencyReview | undefined
+      if (id) {
+        current = await db.prepare(`SELECT ${columns} FROM managed_dependency_review WHERE id = ? AND user_id = ? AND ${contextWhere}`)
+          .get(id, user.id, ...values(context)) as DependencyReview | undefined
+        if (!current || current.revision !== change.revision) return conflict()
+      }
+      const unpublished = () => db.prepare(`SELECT id FROM managed_dependency_review WHERE user_id = ? AND ${contextWhere} AND published_at IS NULL`)
+        .get(user.id, ...values(context)) as Promise<{ id: string } | undefined>
+      const create = async () => {
+        if (await unpublished()) return conflict()
+        const next = randomUUID()
+        await db.prepare(`INSERT INTO managed_dependency_review
+          (id, user_id, user_login, ecosystem, package, version, integrity, patch_hash, base_package, base_version, base_integrity, shasum, base_shasum, patch_source, time, revision)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), ...shasums(tarballs), now)
+        return next
+      }
+      if (change.action === 'start') {
+        id = await create()
+      } else if (change.action === 'continue') {
+        if (!current?.publishedAt) return conflict()
+        id = await create()
+        await db.prepare('UPDATE managed_dependency_review SET comment = ? WHERE id = ?').run(current.comment, id)
+        const entries = await db.prepare('SELECT id, file, comment, status, time FROM managed_dependency_file_review WHERE review_id = ? ORDER BY time, id').all(current.id) as ReviewEntry[]
+        for (const entry of fileEntries(entries)) {
+          await db.prepare(`INSERT INTO managed_dependency_file_review
+          (id, review_id, file, comment, status, time) VALUES (?, ?, ?, ?, ?, ?)`)
+          .run(randomUUID(), id, entry.file, entry.comment, entry.status, entry.time)
+        }
+      } else if (change.action === 'revoke') {
+        if (!current || current.publishedAt === null || current.revokedAt !== null) return conflict()
+        await db.prepare('UPDATE managed_dependency_review SET revoked_at = ?, revision = revision + 1 WHERE id = ?').run(now, id)
+      } else if (change.action === 'publish') {
+        await publish(db, current, user.id, change, now, tarballs)
+      } else {
+        if (current?.publishedAt != null) return conflict()
+        if (change.entry.status === null && !change.entryId) throw new ManagedMutationError(400, 'bad-review')
+        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, shasum = ?, base_shasum = ?, patch_source = ?, revision = revision + 1 WHERE id = ?').run(now, ...shasums(tarballs), id)
+        else { if (change.entryId) return conflict(); id = await create() }
+        await saveFile(db, id, change.entry, change.entryId, now)
+      }
+      return (await expandReviews(db, [await read(id!)], user.id))[0]!
+    },
+  }
+}

package/server-managed/github-accounts.ts

@@ -0,0 +1,60 @@
+// GitHub accounts as GitHub's REST and GraphQL APIs name them, where a
+// repository's activity names its authors (repository-history.ts and the
+// Commits, Issues, Agents and Pulse tabs' readers).
+import { githubGraphql } from './github-graphql.ts'
+
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+
+// An account as GitHub names it: its login, else null, and its numeric id
+// where GitHub names one with it.
+export interface NamedAccount { login: string | null; id: number | null }
+export function accountOf(account: { login?: unknown; id?: unknown } | null | undefined): NamedAccount {
+  const login = typeof account?.login === 'string' && LOGIN.test(account.login) ? account.login : null
+  const id = account?.id
+  return { login, id: login && Number.isSafeInteger(id) && (id as number) > 0 ? id as number : null }
+}
+
+// An actor (the author of an issue or a pull request, one who merged one) as
+// GitHub's GraphQL API names it: its login, and its account's numeric id, a
+// user's or a GitHub App's bot's.
+export const ACTOR = 'login ... on User { databaseId } ... on Bot { databaseId }'
+export type GraphAccount = { login?: unknown; databaseId?: unknown } | null | undefined
+export const actorOf = (actor: GraphAccount) => accountOf({ login: actor?.login, id: actor?.databaseId })
+
+// A commit's author's account, as GitHub's GraphQL API names it: the user
+// GitHub knows its address for; else, as GitHub's REST API does, the account
+// whose noreply address its address is, `<id>+<login>@users.noreply.github.com`:
+// a GitHub App's bot's, which is no user (GraphQL's `user` is a User's, never
+// a bot's). One by GitHub's older no-reply address, `<login>@users.noreply.github.com`,
+// naming no id, its user looked up by its login (repository-history.ts linkNoreplyUsers).
+const NOREPLY = /^([1-9]\d{0,11})\+([^@]+)@users\.noreply\.github\.com$/iu
+export type GraphActor = { email?: unknown; user?: GraphAccount | null }
+export function commitAccount(author: GraphActor | null | undefined): NamedAccount {
+  const user = actorOf(author?.user)
+  const noreply = user.id === null && typeof author?.email === 'string' ? NOREPLY.exec(author.email) : null
+  return noreply ? accountOf({ login: noreply[2], id: Number(noreply[1]) }) : user
+}
+
+// GitHub's no-reply address of old, `<login>@users.noreply.github.com`, which
+// names no id: GitHub links the commits it authors to the account of its
+// login, as its REST API names them, but its GraphQL API names no user for it.
+const NOREPLY_LOGIN = /^([A-Za-z\d][A-Za-z\d-]{0,38})@users\.noreply\.github\.com$/iu
+const MAX_NOREPLY_LOGINS = 100
+
+// Commits' authors and co-authors (`actors`), as GitHub's GraphQL API names
+// them, those it names no user for by such an address named the user of its
+// login, as GitHub links them: those logins, as many as MAX_NOREPLY_LOGINS,
+// looked up in one query, where any is.
+export async function linkNoreplyUsers(actors: (GraphActor | null | undefined)[], token: string, fetchImpl: typeof fetch): Promise<void> {
+  const unnamed = actors.flatMap(actor => {
+    const login = actor && !actor.user && typeof actor.email === 'string' ? NOREPLY_LOGIN.exec(actor.email)?.[1]?.toLowerCase() : undefined
+    return login ? [{ actor: actor!, login }] : []
+  })
+  const logins = [...new Set(unnamed.map(({ login }) => login))].slice(0, MAX_NOREPLY_LOGINS)
+  if (logins.length === 0) return
+  const query = `query(${logins.map((_, at) => `$l${at}: String!`).join(', ')}) { ${logins.map((_, at) => `u${at}: user(login: $l${at}) { login databaseId }`).join(' ')} }`
+  const data = await githubGraphql(query, Object.fromEntries(logins.map((login, at) => [`l${at}`, login])), token, fetchImpl,
+    error => error?.type === 'NOT_FOUND') as Record<string, GraphAccount> | null
+  const users = new Map(logins.map((login, at) => [login, data?.[`u${at}`] ?? null]))
+  for (const { actor, login } of unnamed) actor.user = users.get(login) ?? null
+}

package/server-managed/github-actions.ts

@@ -0,0 +1,71 @@
+// GitHub as a risk scan resolves actions with (risk ActionsSource), read with
+// an admin's own token, or none for public repositories alone: what GitHub
+// has none of reads as none, anything else is thrown as a GithubApiError.
+import { createClient } from '@preventive/upstream/github.js'
+import type { ActionsSource } from '../risk/index.js'
+import { GithubApiError, upstreamGithub } from './github-errors.ts'
+import { githubJson } from './github-app.ts'
+
+// How many pages of 100 tags are listed; a repository with more is told by
+// its tags one at a time.
+const MAX_TAG_PAGES = 10
+const BRANCHES_PAGE = 100
+
+const api = (name: string, suffix: string) => `https://api.github.com/repos/${name.split('/').map(encodeURIComponent).join('/')}${suffix}`
+
+// Whether upstream refused what it was asked before asking GitHub, as a ref
+// git wouldn't take: its arguments' checks say what each must be.
+const isRefused = (error: unknown) => error instanceof Error && error.name === 'AssertionError' && / must be /u.test(error.message)
+
+// What `read` answers, null where GitHub has none (a 404), or upstream
+// refused to ask.
+async function orNone<T>(read: () => Promise<T>): Promise<T | null> {
+  try {
+    return await upstreamGithub(() => read().catch((error: unknown) => { throw isRefused(error) ? new GithubApiError(404, 'github-not-found') : error }))
+  } catch (error) {
+    if (error instanceof GithubApiError && error.status === 404) return null
+    throw error
+  }
+}
+
+interface RepoObject { full_name?: unknown; default_branch?: unknown; fork?: unknown; parent?: { full_name?: unknown }; archived?: unknown; private?: unknown }
+
+export function githubActionsSource(token: string | null, fetchImpl: typeof fetch = globalThis.fetch): ActionsSource {
+  const client = createClient({ token })
+  return {
+    async repo(name) {
+      const info = await orNone(() => client.getRepo({ repo: name, followRedirect: true })) as RepoObject | null
+      if (!info) return null
+      if (typeof info.full_name !== 'string' || typeof info.default_branch !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return { fullName: info.full_name, defaultBranch: info.default_branch, archived: info.archived === true, private: info.private !== false,
+        fork: info.fork === true ? (typeof info.parent?.full_name === 'string' ? info.parent.full_name : '') : null }
+    },
+    tags(name) {
+      // More than MAX_TAG_PAGES pages, which upstream refuses to list whole.
+      return upstreamGithub(() => client.listRepoTags({ repo: name, maxPages: MAX_TAG_PAGES })
+        .catch((error: unknown) => { if (error instanceof Error && /more than \d+ pages/u.test(error.message)) return null; throw error }))
+    },
+    tag: async (name, tag) => (await orNone(() => client.getRepoTag({ repo: name, tag })))?.oid ?? null,
+    branch: async (name, branch) => (await orNone(() => client.getRepoHead({ repo: name, branch })))?.oid ?? null,
+    async branches(name) {
+      const listed = await githubJson(api(name, `/branches?per_page=${BRANCHES_PAGE}`), token, fetchImpl)
+      if (!Array.isArray(listed)) throw new GithubApiError(502, 'github-malformed')
+      const branches = (listed as { name?: unknown; commit?: { sha?: unknown } }[]).flatMap(item => typeof item?.name === 'string'
+        && typeof item.commit?.sha === 'string' && /^[\da-f]{40}$/u.test(item.commit.sha) ? [{ branch: item.name, oid: item.commit.sha }] : [])
+      return { branches, complete: listed.length < BRANCHES_PAGE }
+    },
+    // `base...sha`: `sha` is `base` or in its history where GitHub tells it
+    // behind or identical, a commit of a fork in the same network too.
+    async contains(name, base, sha) {
+      if (!/^[\da-f]{40}$/u.test(sha)) return null
+      let compared
+      try { compared = await githubJson(api(name, `/compare/${base.split('/').map(encodeURIComponent).join('/')}...${sha}?per_page=1`), token, fetchImpl) as { status?: unknown } } catch (error) {
+        if (error instanceof GithubApiError && (error.status === 404 || error.message === 'github-status-422')) return null
+        throw error
+      }
+      if (typeof compared?.status !== 'string') throw new GithubApiError(502, 'github-malformed')
+      return compared.status === 'behind' || compared.status === 'identical'
+    },
+    file: (name, path, commit) => orNone(() => client.getRepoFile({ repo: name, path, ref: commit })),
+  }
+}