@preventive/triage 1.0.0-alpha.50 → 1.0.0-alpha.52

package/common/managed/finding-detail.d.ts

@@ -1,2 +1,3 @@
 export const FINDING_DETAIL_FIELDS: readonly string[]
-export function liteReportData(data: unknown): unknown
+export function liteReportData(data: unknown, options?: { fold?: boolean }): unknown
+export function liteWorkspace<T extends { filename: string; data: unknown }>(reports: readonly T[], links: readonly (readonly string[])[]): { reports: T[]; folded: boolean }

package/common/managed/finding-detail.js

@@ -1,17 +1,24 @@
-import { findingTitle } from '@preventive/report'
+import { findingTitle, reportEntries, revalidateKindOf } from '@preventive/report'
+import { managedTeamRevalidationConflicted } from './team-app.js'
+import { liteName } from './lite-name.js'
 
 // A finding's detail: what its popup, the views besides the board and an
 // export read, and the board does not. Its narrative and evidence, the hash
-// its Code button finds a bundle by, and the export it names. A team's
+// its Code button finds a bundle by, the export it names, the facts its card
+// and an export tell (write-md-finding.js PLAIN_FIELDS, CODE_FIELDS, but for
+// `priority`, which the board sorts and filters by), and the run meta its
+// card's run line and a report's header read (its `model` and `type`, which
+// the board's filters read, stay). A team's
 // reports are first sent without it (server-managed/team-reports.ts), the
 // board drawn from them, and their findings filled in from the whole reports
 // (ui/view/managed-details.js).
-export const FINDING_DETAIL_FIELDS = Object.freeze(['description', 'evidence', 'impact', 'reproduction', 'recommendation',
-  'confidenceReason', 'revalidateVerdict', 'revalidateRecommendation', 'fileHash', 'exportName', 'methodName'])
+export const FINDING_DETAIL_FIELDS = Object.freeze([
+  'description', 'evidence', 'impact', 'reproduction', 'recommendation', 'confidenceReason', 'revalidateVerdict', 'revalidateRecommendation',
+  'fileHash', 'exportName', 'methodName',
+  'severityReason', 'commitHash', 'auditedCommit', 'detectedAt', 'committedAt', 'dateCreated', 'status', 'branch', 'pocStatus', 'parent', 'slug', 'reportPath',
+  'category', 'discoveredIn', 'effort', 'exportsMode',
+])
 const DETAIL = new Set(FINDING_DETAIL_FIELDS)
-// More of a name than a board card's three lines show.
-const NAME_CHARS = 200
-
 // A finding without its detail. One without a title of its own is named by its
 // description's first line (findingTitle), which it keeps as its description,
 // as much of it as a card shows.
@@ -20,13 +27,37 @@ function liteFinding(finding) {
   const lite = Object.fromEntries(Object.entries(finding).filter(([key]) => !DETAIL.has(key)))
   const titled = typeof finding.title === 'string' && finding.title.trim() !== ''
   const title = titled ? '' : findingTitle(finding)
-  if (title) lite.description = title.length > NAME_CHARS ? `${title.slice(0, NAME_CHARS - 1)}…` : title
+  if (title) lite.description = liteName(title)
   return lite
 }
 
-// A report's data, its findings without their detail.
-export function liteReportData(data) {
+const isPass = finding => revalidateKindOf(finding) === 'revalidation'
+
+// A report's data, its findings without their detail. A workspace opening in
+// App mode shows of an entry holding the revalidation pass's row that row
+// alone (ui/view/group.js foldedTabs): with `fold`, such an entry is sent as
+// the pass's rows, the rows beneath them left for the whole reports
+// (ui/view/managed-details.js).
+export function liteReportData(data, { fold = false } = {}) {
   const key = Array.isArray(data?.findings) ? 'findings' : Array.isArray(data?.groups) ? 'groups' : null
   if (!key) return data
-  return { ...data, [key]: data[key].map(entry => Array.isArray(entry) ? entry.map(liteFinding) : liteFinding(entry)) }
+  const entries = data[key].map(entry => {
+    if (!Array.isArray(entry)) return liteFinding(entry)
+    const shown = fold && entry.length > 1 && entry.some(isPass) ? entry.filter(isPass) : entry
+    return shown.map(liteFinding)
+  })
+  return { ...data, [key]: entries }
+}
+
+const rows = data => (reportEntries(data) ?? []).flat().length
+
+// A team's reports as its board is first sent them (server-managed/team-reports.ts),
+// each `liteReportData`, folded where nothing in the workspace contradicts the
+// revalidation pass, which opens a view of it in App mode
+// (ui/view/render.js configureReportRevalidation); `folded` where that left
+// rows out.
+export function liteWorkspace(reports, links) {
+  const fold = !managedTeamRevalidationConflicted(Object.assign(reports.map(({ filename, data }) => ({ filename, data })), { links }))
+  const lite = reports.map(report => ({ ...report, data: liteReportData(report.data, { fold }) }))
+  return { reports: lite, folded: fold && lite.some((report, index) => rows(report.data) < rows(reports[index].data)) }
 }

package/common/managed/finding-values.d.ts

@@ -0,0 +1,2 @@
+export function findingValueIndex(): { values: unknown[]; index<T>(data: T): T }
+export function expandFindingValues<T>(data: T, values: unknown): T

package/common/managed/finding-values.js

@@ -0,0 +1,44 @@
+// A finding's `package` and `repo`: the same few across a team's many
+// findings. A team's reports are sent with each once, in the response's
+// `values`, and each finding's as its index there
+// (server-managed/team-reports.ts), put back as they are read
+// (client/managed/session.js).
+const FIELDS = ['package', 'repo']
+
+const entriesKey = data => Array.isArray(data?.findings) ? 'findings' : Array.isArray(data?.groups) ? 'groups' : null
+
+// `values`, and `index(data)`: a report's data with its findings' values as
+// their index in it, one value at one index across every report it is given.
+export function findingValueIndex() {
+  const indexes = new Map(), values = []
+  const indexOf = value => {
+    const key = JSON.stringify(value)
+    if (!indexes.has(key)) indexes.set(key, values.push(value) - 1)
+    return indexes.get(key)
+  }
+  const indexed = finding => {
+    if (!finding || typeof finding !== 'object' || !FIELDS.some(field => finding[field] != null)) return finding
+    const copy = { ...finding }
+    for (const field of FIELDS) if (finding[field] != null) copy[field] = indexOf(finding[field])
+    return copy
+  }
+  return {
+    values,
+    index(data) {
+      const key = entriesKey(data)
+      return key ? { ...data, [key]: data[key].map(entry => Array.isArray(entry) ? entry.map(indexed) : indexed(entry)) } : data
+    },
+  }
+}
+
+// A report's data, as read, its findings' values put in place of their index
+// in a response's `values`; one sent without any as it is.
+export function expandFindingValues(data, values) {
+  const key = entriesKey(data)
+  if (!key || !Array.isArray(values)) return data
+  for (const finding of data[key].flat()) {
+    if (!finding || typeof finding !== 'object') continue
+    for (const field of FIELDS) if (Number.isInteger(finding[field])) finding[field] = values[finding[field]]
+  }
+  return data
+}

package/common/managed/lite-name.d.ts

@@ -0,0 +1,2 @@
+export function liteName(name: string): string
+export function readLiteReportData<T>(data: T): T

package/common/managed/lite-name.js

@@ -0,0 +1,20 @@
+import { reportEntries } from '@preventive/report'
+
+// As much of a name as a heading takes (@preventive/report write-md-finding.js
+// HEADING_MAX), about a board card's three lines. A board's copy of a team's
+// reports (finding-detail.js) cuts one longer to end in `CUT`, an ellipsis
+// once read.
+const CUT = '...', NAME_CHARS = 120
+
+export const liteName = name => name.length > NAME_CHARS ? `${name.slice(0, NAME_CHARS - CUT.length)}${CUT}` : name
+
+// A report's data from its board's copy, as read: a name cut ends in an
+// ellipsis. One as long as a cut leaves it and ending in `CUT` is one; one
+// shorter ends as it does.
+export function readLiteReportData(data) {
+  for (const finding of (reportEntries(data) ?? []).flat()) {
+    const name = finding?.description
+    if (typeof name === 'string' && name.length === NAME_CHARS && name.endsWith(CUT)) finding.description = `${name.slice(0, -CUT.length)}…`
+  }
+  return data
+}

package/common/managed/npm-packages.d.ts

@@ -1,5 +1,7 @@
 export const MAX_TEAM_NPM_SCOPES: number
 export function isNpmPackageName(value: unknown): value is string
 export function isNpmPackageSpec(value: unknown): value is string
+export function isPatchHash(value: unknown): value is string
+export function isPatchPath(value: unknown): value is string
 export function npmPackageScope(name: string): string | null
 export function normalizeNpmScope(value: unknown): string | null

package/common/managed/npm-packages.js

@@ -1,5 +1,6 @@
 // npm package names, versions and scopes as the managed npm viewer takes
-// them, shared by its routes, the server and the Teams page.
+// them, and the pnpm patches its reviews read, shared by its routes, the
+// server and the Teams page.
 
 // Upstream's rule (@preventive/upstream src/args.js): a scope, then a name
 // starting with none of `.`, `_` and `-`, 214 characters in all.
@@ -9,6 +10,9 @@ const PACKAGE_SPEC = /^(?=.{1,256}$)[\dA-Za-z][\w.+-]*$/u
 // npm's rule for a scope: lowercase, and not starting with `.` or `_`.
 const SCOPE = /^@[\da-z~-][\w.~-]*$/u
 export const MAX_TEAM_NPM_SCOPES = 100
+// A pnpm patch's hash as a lockfile names it: a sha256 in hex, or pnpm 9's
+// md5 in base32.
+const PATCH_HASH = /^(?:[\da-f]{64}|[2-7a-z]{26})$/u
 
 export function isNpmPackageName(value) {
   return typeof value === 'string' && PACKAGE_NAME.test(value)
@@ -18,6 +22,19 @@ export function isNpmPackageSpec(value) {
   return typeof value === 'string' && PACKAGE_SPEC.test(value)
 }
 
+export function isPatchHash(value) {
+  return typeof value === 'string' && PATCH_HASH.test(value)
+}
+
+// A path as GitHub's contents take it, as a pnpm patch's file is read
+// (server-managed/npm-patch.ts) and a file of the package it changes is
+// named: names with no empty, `.` or `..` one among them, nor control
+// characters or backslashes.
+export function isPatchPath(value) {
+  return typeof value === 'string' && value.length > 0 && value.length <= 1024 && !/[\p{Cc}\\]/u.test(value)
+    && value.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+}
+
 // `@scope` of a scoped name, lowercased as scopes are compared; null for an
 // unscoped one.
 export function npmPackageScope(name) {

package/common/managed/routes.js

@@ -1,7 +1,7 @@
 // Managed client pages only. API paths and E2E share hashes are not routes.
 import { BUNDLE_TABS } from '../bundle-tabs.js'
 import { MAX_FINDING_ID_LENGTH, isLinkableFindingId } from '../finding-id.js'
-import { isNpmPackageName, isNpmPackageSpec } from './npm-packages.js'
+import { isNpmPackageName, isNpmPackageSpec, isPatchHash, isPatchPath } from './npm-packages.js'
 
 // How Compare reviews the changes, past its Overview: `code`, beside the
 // tree of changed files. A link names the mode after the bundle or version
@@ -96,17 +96,26 @@ export function managedRoutePath(route) {
 // Search, Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
 // its file by number and its lines in the fragment, as a bundle's Code
 // does: `/code/<file>#L4`. Compare names the version compared with, then
-// its mode past the Overview: `/compare/<version>/code` or `/diff`.
+// its mode past the Overview: `/compare/<version>/code` or `/diff`. Review
+// names the version reviewed against, and, of a version as a pnpm patch
+// changes it, the patch (`patch`): its hash, and where it is read, a
+// repository by its id, a commit and its file's path there,
+// `?patch=<hash>&repo=<repo id>&commit=<commit>&path=<path>`.
 export const NPM_TABS = new Set(['overview', 'code', 'search', 'compare', 'review', 'treemap'])
+// A patch as the server reads one (server-managed/npm-patch.ts requestedPatch).
+const isPatch = patch => isPatchHash(patch?.hash) && isRepoId(patch.repoId) && COMMIT.test(patch.commit ?? '') && isPatchPath(patch.path)
 function npmPackagePath(route) {
   if (route.packageName == null) return '/npm'
   const tab = route.bundleTab ?? 'overview'
   if (!isNpmPackageName(route.packageName) || (route.packageSpec != null && !isNpmPackageSpec(route.packageSpec)) || !NPM_TABS.has(tab)
       || (route.compareSpec != null && !isNpmPackageSpec(route.compareSpec))) return null
   if (tab === 'review') {
-    if (route.reviewPackage != null && !isNpmPackageName(route.reviewPackage) || route.reviewSpec != null && !isNpmPackageSpec(route.reviewSpec)) return null
+    if (route.reviewPackage != null && !isNpmPackageName(route.reviewPackage) || route.reviewSpec != null && !isNpmPackageSpec(route.reviewSpec)
+      || route.patch != null && !isPatch(route.patch)) return null
     const base = route.reviewPackage == null ? '' : `/${route.reviewPackage}${route.reviewSpec == null ? '' : `@${route.reviewSpec}`}`
-    return `/npm/${route.packageName}${route.packageSpec == null ? '' : `@${route.packageSpec}`}/review${base}`
+    const patch = route.patch == null ? ''
+      : `?patch=${route.patch.hash}&repo=${route.patch.repoId}&commit=${route.patch.commit}&path=${route.patch.path.split('/').map(encodeURIComponent).join('/')}`
+    return `/npm/${route.packageName}${route.packageSpec == null ? '' : `@${route.packageSpec}`}/review${base}${patch}`
   }
   const file = tab === 'code' && isLineNumber(route.file) ? `/${route.file}` : ''
   const lines = file && isLineNumber(route.line)
@@ -115,15 +124,18 @@ function npmPackagePath(route) {
   return `/npm/${route.packageName}${route.packageSpec == null ? '' : `@${route.packageSpec}`}${tab === 'overview' ? '' : `/${tab}`}${file}${compare}${lines}`
 }
 
-function parseNpmRoute(path, hash) {
+function parseNpmRoute(path, hash, search) {
   const review = /^\/npm\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?\/review(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?)?$/u.exec(path)
   if (review) {
     if (!isNpmPackageName(review[1]) || review[2] != null && !isNpmPackageSpec(review[2])
       || review[3] != null && !isNpmPackageName(review[3]) || review[4] != null && !isNpmPackageSpec(review[4])) return null
     // The full dependency form is canonical; a bare version is a shortcut.
     const versionOnly = review[3] && /^\d+\.\d+\.\d+(?:[-+].*)?$/u.test(review[3]) && review[4] == null
+    const patch = search.has('patch')
+      ? { hash: search.get('patch'), repoId: /^[1-9]\d*$/u.test(search.get('repo') ?? '') ? Number(search.get('repo')) : null, commit: search.get('commit'), path: search.get('path') } : null
+    if (patch && !isPatch(patch)) return null
     return { view: 'npm', packageName: review[1], packageSpec: review[2] ?? null, bundleTab: 'review',
-      ...(review[3] ? { reviewPackage: versionOnly ? review[1] : review[3], reviewSpec: versionOnly ? review[3] : review[4] ?? null } : {}) }
+      ...(review[3] ? { reviewPackage: versionOnly ? review[1] : review[3], reviewSpec: versionOnly ? review[3] : review[4] ?? null } : {}), ...(patch ? { patch } : {}) }
   }
   const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|search|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
   if (!match) return undefined
@@ -256,7 +268,7 @@ export function parseManagedRoute(url) {
     if (bundleTab !== 'code' || bundle[5] || !/^[1-9]\d*$/u.test(bundle[4]) || !Number.isSafeInteger(file)) return null
     return { ...route, file, ...codeLines(url.hash) }
   }
-  const npm = parseNpmRoute(path, url.hash)
+  const npm = parseNpmRoute(path, url.hash, url.searchParams)
   if (npm !== undefined) return npm
   const code = parseRepositoryCodeRoute(url)
   if (code !== undefined) return code

package/common/managed/team-app.d.ts

@@ -3,3 +3,4 @@
 export type TeamAppMetadata = { appMode: true; appFindings: number } | { appMode: false; appReports?: number; findings?: number }
 export function managedTeamAppMetadata(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] },
   options?: { countFindings?: boolean }): TeamAppMetadata
+export function managedTeamRevalidationConflicted(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): boolean

package/common/managed/team-app.js

@@ -2,6 +2,7 @@ import { inheritReportMeta, isAppFinding, reportEntries } from '@preventive/repo
 import { collectDuplicates } from '../../client/linked-findings.js'
 import { hasRevalidateStamp } from '../finding-filters.js'
 import { workspaceAppMetadata } from '../workspace-app.js'
+import { mergeReportGroups } from '../workspace-groups.js'
 
 // The same classification as local workspaces, using only the complete,
 // server-filtered published workspace: the reports of one team response and
@@ -9,6 +10,21 @@ import { workspaceAppMetadata } from '../workspace-app.js'
 // catalog, so the sidebar opens a team collapsed to its App findings at once.
 // The server backfills finding IDs before building these envelopes.
 export function managedTeamAppMetadata(workspace, options = {}) {
+  const { reports, duplicates } = viewReports(workspace)
+  return workspaceAppMetadata(reports, id => [...duplicates.get(id) ?? []], options)
+}
+
+// Whether copies of one finding in the workspace disagree on what the
+// revalidation pass said, which takes the App lens off a view of it
+// (ui/view/render.js configureReportRevalidation). Asked of all its rows, so
+// that a view of any of its reports holds none either.
+export function managedTeamRevalidationConflicted(workspace) {
+  return mergeReportGroups(viewReports(workspace).reports).conflicts.size > 0
+}
+
+// The workspace's reports as a view holds them (ui/view/ingest.js), with the
+// duplicates its links name.
+function viewReports(workspace) {
   const duplicates = new Map(), reports = []
   collectDuplicates(workspace.links ?? [], duplicates)
   for (const { filename, data } of workspace) {
@@ -27,5 +43,5 @@ export function managedTeamAppMetadata(workspace, options = {}) {
     }))
     reports.push({ fileName: filename, groups })
   }
-  return workspaceAppMetadata(reports, id => [...duplicates.get(id) ?? []], options)
+  return { reports, duplicates }
 }