limn-review 0.1.123

package/dist/api/routes/threads.js

@@ -0,0 +1,118 @@
+import { getAccessToken, getAccountUserId } from '../../auth/account.js';
+import { getThreadDetail, getThreadWriteContext, stampThreadRepliedState, stampThreadResolved, upsertLocalReply, } from '../../db/queries.js';
+import { addReviewThreadReply, setReviewThreadResolved, } from '../../github/mutations.js';
+import { hydrateThreadDetail } from '../../sync/hydrate-detail.js';
+import { notePrChangedForPr } from '../../sync/pr-settle.js';
+import { accountIdOf } from '../plugins/auth.js';
+const idParamSchema = {
+    params: {
+        type: 'object',
+        required: ['id'],
+        properties: { id: { type: 'integer' } },
+    },
+};
+const replySchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['body'],
+        additionalProperties: false,
+        properties: { body: { type: 'string' } },
+    },
+};
+const resolveSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['resolved'],
+        additionalProperties: false,
+        properties: { resolved: { type: 'boolean' } },
+    },
+};
+export async function threadRoutes(app) {
+    app.get('/api/threads/:id', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const accountId = accountIdOf(req);
+        const thread = await getThreadDetail(id, accountId);
+        if (!thread) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Thread ${id} not found` };
+        }
+        return hydrateThreadDetail(thread, accountId);
+    });
+    // Reply to an existing review thread. GraphQL addPullRequestReviewThreadReply,
+    // then optimistically stamp the new comment locally so it shows before sync.
+    app.post('/api/threads/:id/reply', { schema: replySchema }, async (req, reply) => {
+        const { id } = req.params;
+        const { body } = req.body;
+        const accountId = accountIdOf(req);
+        const ctx = await getThreadWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Thread ${id} not found` };
+        }
+        try {
+            const token = await getAccessToken(accountId);
+            const gh = await addReviewThreadReply(token, ctx.threadNodeId, body);
+            const authorId = await getAccountUserId(accountId);
+            const rowId = await upsertLocalReply(ctx.prId, id, authorId, gh);
+            // Bump the parent thread off 'untouched' so its badge reflects the reply
+            // before the next sync re-derives.
+            await stampThreadRepliedState(id);
+            // The stamp moved a board-visible fact (the thread's state, so the Pending thread
+            // cards): raise the SPA change signal BEFORE replying, so the write's own ordered
+            // `['repos']` read already sees it (sync/pr-settle.ts). Never throws.
+            await notePrChangedForPr(accountId, ctx.prId);
+            const result = {
+                id: rowId,
+                authorId,
+                body: gh.body,
+                diffHunk: null,
+                createdAt: new Date(gh.createdAt).toISOString(),
+                url: gh.url,
+            };
+            return result;
+        }
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : String(err),
+            };
+        }
+    });
+    // Resolve (resolved=true) or unresolve (resolved=false) a review thread, then
+    // stamp the local derivedState so the UI reflects it before the next sync.
+    app.post('/api/threads/:id/resolve', { schema: resolveSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const { resolved } = req.body;
+        const accountId = accountIdOf(req);
+        const ctx = await getThreadWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Thread ${id} not found` };
+        }
+        try {
+            const token = await getAccessToken(accountId);
+            const gh = await setReviewThreadResolved(token, ctx.threadNodeId, resolved);
+            // Ownership already confirmed above, so the stamp is non-null.
+            const derivedState = await stampThreadResolved(id, resolved, accountId);
+            // Same as the reply: the stamp is board-visible, so signal it before replying.
+            await notePrChangedForPr(accountId, ctx.prId);
+            const result = {
+                threadId: id,
+                isResolved: gh.isResolved,
+                derivedState: derivedState ?? (resolved ? 'resolved' : 'untouched'),
+            };
+            return result;
+        }
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : String(err),
+            };
+        }
+    });
+}
+//# sourceMappingURL=threads.js.map

package/dist/api/routes/timeline.js

@@ -0,0 +1,150 @@
+import { config } from '../../config.js';
+import { getTimeline, resolveWorkspaceScope } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+const DAY_MS = 24 * 60 * 60 * 1000;
+// Local copies of the shared value constants. `@pierre-review/shared` is a
+// types-only workspace package that is NOT shipped in the published tarball, so
+// the backend must not import runtime values from it (only `import type`, which
+// `verbatimModuleSyntax` erases). Keep these in sync with packages/shared.
+const EVENT_TYPES = [
+    'pr_opened',
+    'pr_merged',
+    'pr_closed',
+    'pr_reopened',
+    'pr_ready_for_review',
+    'review_submitted',
+    'review_comment',
+    'pr_comment',
+    'commit_pushed',
+];
+const PR_STATUSES = ['draft', 'open', 'merged', 'closed'];
+const REVIEW_FILTER_STATES = [
+    'approved',
+    'changes_requested',
+    'commented',
+    'dismissed',
+];
+// `repoIds` → the `narrow` argument of `resolveWorkspaceScope` (never a scope in its own right);
+// `prIds`/`userIds`/`allowBotIds` keep their own meanings. Empty/absent → null = no narrowing.
+function parseIntList(raw) {
+    if (!raw)
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isFinite(n));
+    return ids.length > 0 ? ids : null;
+}
+function parseTypes(raw) {
+    if (!raw)
+        return null;
+    const allowed = new Set(EVENT_TYPES);
+    const types = raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => allowed.has(s));
+    return types.length > 0 ? types : null;
+}
+// Absent (undefined) → null = no status filter (show all). Present, even empty
+// ("") → an explicit (possibly empty) set, so deselecting every status shows
+// nothing rather than falling back to "all".
+function parseStatuses(raw) {
+    if (raw === undefined)
+        return null;
+    const allowed = new Set(PR_STATUSES);
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => allowed.has(s));
+}
+// Absent (undefined) → null = no review-verdict filter (show all). Present, even
+// empty ("") → an explicit (possibly empty) set, so deselecting every verdict hides
+// all review markers rather than falling back to "all". Mirrors parseStatuses.
+function parseReviewStates(raw) {
+    if (raw === undefined)
+        return null;
+    const allowed = new Set(REVIEW_FILTER_STATES);
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => allowed.has(s));
+}
+function parseDate(raw, fallback) {
+    if (!raw)
+        return fallback;
+    const d = new Date(raw);
+    return Number.isNaN(d.getTime()) ? fallback : d;
+}
+// ---- Window clamp ----
+// `from`/`to` are free-form client dates, and getTimeline's cost scales with the span: it
+// loads every matching PR and event in the range. `?from=1970-01-01&to=2100-01-01` therefore
+// asked for the account's ENTIRE retained dataset in one JSON body — a cheap way for one
+// authenticated request to exhaust the heap of a process that, in cloud, serves every tenant.
+//
+// Nothing legitimate needs a wide window: the SPA's widest preset is 90 days, and the server
+// only retains `config.retentionDays` (default 180) of history anyway, so anything beyond
+// that is asking for rows that cannot exist. The clamp is silent and generous rather than a
+// 400, because a stale bookmark with an old `from=` should still render a board.
+//
+// Belt-and-braces: db/queries.ts additionally caps the ROW COUNT and reports `truncated`,
+// because a legitimately-sized window can still be huge for a tenant watching 100 busy repos.
+function clampWindow(from, to, now, maxSpanDays) {
+    // A reversed range would produce an empty board with no explanation — normalise it.
+    let start = from;
+    let end = to;
+    if (start.getTime() > end.getTime())
+        [start, end] = [end, start];
+    // Never look further ahead than "now" (+1 day of slack for clock skew / timezones).
+    const maxEnd = now.getTime() + DAY_MS;
+    if (end.getTime() > maxEnd)
+        end = new Date(maxEnd);
+    // Never look further back than the retention horizon — there is no data there.
+    const earliest = end.getTime() - maxSpanDays * DAY_MS;
+    if (start.getTime() < earliest)
+        start = new Date(earliest);
+    return { from: start, to: end };
+}
+export async function timelineRoutes(app) {
+    // The widest span a request may ask for: the retention horizon (there is nothing older
+    // to return), with a floor so a deployment that disables retention (RETENTION_DAYS=0)
+    // still gets a bound rather than an unbounded one.
+    const maxSpanDays = config.retentionDays > 0 ? config.retentionDays : 365;
+    // `?workspace=<id>` is the board's scope; `?repoIds=` only narrows WITHIN it.
+    //
+    // The board carried repo ids alone while `null` meant "every repo of the account". Under a
+    // workspace scope that is two bugs: an EMPTY workspace sends no ids and the server would render
+    // the whole account, and two workspaces both sending no ids produce the same query string, so
+    // React Query serves one board under the other's cache key. `resolveWorkspaceScope` returns
+    // `membership ∩ (?repoIds= ?? membership)` — always a concrete array, `[]` for an empty
+    // workspace, which `getTimeline` renders as an empty board rather than everything.
+    //
+    // ⚠ The pr-focus (`prIds`) branch inside `getTimeline` deliberately BYPASSES the repo scope: an
+    // isolate tab must load its subject PR even when the board's repo filter would hide it.
+    // Ownership is still bound by `accountId`, so that is a scope bypass, never a tenancy one.
+    app.get('/api/timeline', async (req) => {
+        const q = req.query;
+        const now = new Date();
+        const window = clampWindow(parseDate(q.from, new Date(now.getTime() - 14 * DAY_MS)), parseDate(q.to, now), now, maxSpanDays);
+        const accountId = accountIdOf(req);
+        const scope = await resolveWorkspaceScope(accountId, q.workspace, parseIntList(q.repoIds));
+        const filters = {
+            accountId,
+            // The excludeBots union reads the automated-reviewer verdict at this grain — the same
+            // resolved scope the repo narrowing came from, never a second resolution.
+            workspaceId: scope.workspaceId,
+            from: window.from,
+            to: window.to,
+            repoIds: scope.repoIds,
+            prIds: parseIntList(q.prIds),
+            userIds: parseIntList(q.userIds),
+            types: parseTypes(q.types),
+            statuses: parseStatuses(q.statuses),
+            reviewStates: parseReviewStates(q.reviewStates),
+            excludeBots: q.excludeBots === 'true',
+            allowBotIds: parseIntList(q.allowBotIds),
+            excludeStale: q.excludeStale === 'true',
+        };
+        return getTimeline(filters);
+    });
+}
+//# sourceMappingURL=timeline.js.map

package/dist/api/routes/users.js

@@ -0,0 +1,67 @@
+import { getUserStats, listUsers, resolveWorkspaceScope } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Parse a comma-separated id list into a positive-int array, or null when empty/absent ("no
+// explicit narrowing"). It is fed to `resolveWorkspaceScope` as the `narrow` argument, never used
+// as a scope in its own right. Mirrors the parser in bot-triage.ts.
+function parseIntList(raw) {
+    if (raw == null || raw.trim() === '')
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isInteger(n) && n > 0);
+    return ids.length > 0 ? ids : null;
+}
+// GET /api/users/:id/stats — all-time contribution counts for one user. `workspace` is the scope
+// (a plain integer; absent / unknown / foreign ⇒ the account's Default workspace), and `repoIds`
+// NARROWS within it rather than replacing it: `resolveWorkspaceScope` returns
+// `membership ∩ (repoIds ?? membership)`, so a repo id from another workspace simply drops out and
+// cannot measure one workspace through another's repos.
+const statsSchema = {
+    params: {
+        type: 'object',
+        required: ['id'],
+        properties: { id: { type: 'integer' } },
+    },
+    querystring: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            workspace: { type: 'string' },
+            repoIds: { type: 'string' },
+        },
+    },
+};
+// GitHub actor metadata for the Members panel / avatars.
+//
+// `users` is a GLOBAL table (a login is the same person for every tenant), but the LISTING is
+// account-scoped: `listUsers(accountId)` returns only actors that appear in the caller's own
+// synced data. Unscoped, this route handed any tenant the login, display name and avatar of
+// every user any other tenant had ever synced — including contributors to private repos the
+// caller cannot see.
+//
+// `PATCH /api/users/:id` was REMOVED. It called `setUserBot(id, isBot)`, which wrote the
+// `isBot` + sticky `isBotOverridden` flags to the global row with no ownership check, so one
+// account could permanently reclassify any enumerable user id for every other tenant. It had
+// no frontend caller — bot classification goes through the account-scoped
+// `PATCH /api/bot-reviewers/:userId` (api/routes/bot-triage.ts), which writes the per-account,
+// per-WORKSPACE `workspace_reviewers` table. See the note in db/queries.ts.
+export async function userRoutes(app) {
+    app.get('/api/users', async (req) => listUsers(accountIdOf(req)));
+    // All-time PR / review / comment counts for one user, counted only over THIS account's
+    // synced data (getUserStats binds every source to pullRequests.accountId).
+    //
+    // There is deliberately NO ownership 404: `users` is global, so a foreign or unknown id is
+    // not an object this account can own or fail to own — it simply has no rows here and comes
+    // back all zeros. That keeps user ids non-enumerable (404 vs 200 would be an oracle) and
+    // leaks nothing, which is also why the response echoes no profile field.
+    app.get('/api/users/:id/stats', { schema: statsSchema }, async (req) => {
+        const { id } = req.params;
+        const { workspace, repoIds } = req.query;
+        const accountId = accountIdOf(req);
+        const scope = await resolveWorkspaceScope(accountId, workspace, parseIntList(repoIds));
+        const resp = await getUserStats(accountId, id, scope.repoIds);
+        return resp;
+    });
+}
+//# sourceMappingURL=users.js.map

package/dist/api/routes/webhooks.js

@@ -0,0 +1,181 @@
+// GitHub App webhook receiver — real-time sync Phase 1 (see docs/REALTIME-SYNC.md).
+//
+// A GitHub App has ONE webhook URL that receives events for every installation, so this
+// single route serves every tenant. On a PR-affecting event it resolves which watched
+// repos the change touches and fires a debounced, targeted single-PR sync (Phase 0's
+// enqueuePrSync) — near-real-time freshness at ~1 GraphQL point per change, no window
+// re-walk. It is ADDITIVE: the periodic poll (SYNC.md) stays as the backstop for dropped
+// deliveries and for accounts signed in via the OAuth App (no App install → no webhooks).
+//
+// Structure mirrors the Stripe webhook (api/routes/billing.ts): authenticity is the
+// signature, not a session (so the route is exempted from the cloud auth gate); the raw
+// body is read via an ENCAPSULATED content-type parser so the rest of the API keeps
+// normal JSON parsing. Registered in both modes; inert until GITHUB_APP_WEBHOOK_SECRET is
+// set (replies 501 unconfigured).
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { config } from '../../config.js';
+import { db, schema } from '../../db/client.js';
+import { enqueuePrSync } from '../../sync/sync-one-pr.js';
+const { repos } = schema;
+/**
+ * Verify a GitHub webhook signature (the `X-Hub-Signature-256` header) without a
+ * dependency. Format: `sha256=<hex>`, where the hex is HMAC-SHA256(secret) over the raw
+ * request bytes. Compared timing-safely. Pure so it's unit-testable without Fastify.
+ */
+export function verifyGithubSignature(rawBody, header, secret) {
+    const prefix = 'sha256=';
+    if (!header.startsWith(prefix))
+        return false;
+    const provided = header.slice(prefix.length);
+    const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
+    const providedBuf = Buffer.from(provided, 'utf-8');
+    const expectedBuf = Buffer.from(expected, 'utf-8');
+    return (providedBuf.length === expectedBuf.length &&
+        timingSafeEqual(providedBuf, expectedBuf));
+}
+function asRecord(v) {
+    return v !== null && typeof v === 'object' ? v : null;
+}
+// A positive integer `number` field off an object (a PR reference), else null.
+function prNumberOf(v) {
+    const n = asRecord(v)?.['number'];
+    return typeof n === 'number' && Number.isInteger(n) && n > 0 ? n : null;
+}
+/**
+ * Map a GitHub webhook (event type + payload) to the repo + PR numbers it should refresh.
+ * Pure — no DB, no Fastify — so the per-event extraction is unit-testable. Every handled
+ * event carries `repository.owner.login` + `repository.name`; the PR number(s) live in a
+ * per-event slot. Returns null when there's nothing to sync.
+ */
+export function extractPrTargets(eventType, payload) {
+    const p = asRecord(payload);
+    if (!p)
+        return null;
+    const repo = asRecord(p['repository']);
+    const owner = asRecord(repo?.['owner'])?.['login'];
+    const name = repo?.['name'];
+    if (typeof owner !== 'string' || typeof name !== 'string')
+        return null;
+    const numbers = new Set();
+    const addNum = (v) => {
+        const n = prNumberOf(v);
+        if (n != null)
+            numbers.add(n);
+    };
+    const addArray = (v) => {
+        if (Array.isArray(v))
+            for (const e of v)
+                addNum(e);
+    };
+    switch (eventType) {
+        // All the PR-scoped events carry the PR directly.
+        case 'pull_request':
+        case 'pull_request_review':
+        case 'pull_request_review_comment':
+        case 'pull_request_review_thread':
+            addNum(p['pull_request']);
+            break;
+        // issue_comment also fires on plain issues; only PRs carry `issue.pull_request`.
+        case 'issue_comment': {
+            const issue = asRecord(p['issue']);
+            if (issue && issue['pull_request'] != null)
+                addNum(issue);
+            break;
+        }
+        // CI events carry the associated PRs (same-repo only) — this is how a check
+        // finishing (which never bumps a PR's updatedAt) drives a refresh.
+        case 'check_run':
+            addArray(asRecord(p['check_run'])?.['pull_requests']);
+            break;
+        case 'check_suite':
+            addArray(asRecord(p['check_suite'])?.['pull_requests']);
+            break;
+        // ping / push / installation / anything else → no targeted PR (a push to a PR's head
+        // arrives separately as pull_request `synchronize`, which the case above handles).
+        default:
+            return null;
+    }
+    if (numbers.size === 0)
+        return null;
+    return { owner, name, prNumbers: [...numbers] };
+}
+export async function webhookRoutes(app) {
+    // A STABLE logger for the detached (debounced) syncs — the request-scoped req.log is
+    // gone by the time enqueuePrSync's timer fires. Mirrors scheduler.ts's adapter.
+    const log = {
+        info: (m, ...a) => app.log.info(a.length ? { a } : {}, m),
+        warn: (m, ...a) => app.log.warn(a.length ? { a } : {}, m),
+        error: (m, ...a) => app.log.error(a.length ? { a } : {}, m),
+    };
+    // The signature signs the exact bytes, so this route needs the RAW body. Fastify's
+    // content-type parsers are ENCAPSULATED, so registering the buffer parser in this
+    // nested scope affects ONLY /api/webhooks/github — the rest of the API keeps normal
+    // JSON parsing (proven by webhooks.test.ts's sibling-route case).
+    await app.register(async (scope) => {
+        scope.addContentTypeParser('application/json', { parseAs: 'buffer' }, (_req, body, done) => {
+            done(null, body);
+        });
+        // GitHub posts unauthenticated (exempted from the auth gate); authenticity is the
+        // signature. Never 500 on a data mismatch — GitHub retries non-2xx.
+        scope.post('/api/webhooks/github', async (req, reply) => {
+            if (!config.githubAppWebhookSecret) {
+                return reply.code(501).send({ error: 'github webhooks not configured' });
+            }
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw)) {
+                return reply.code(400).send({ error: 'expected a JSON body' });
+            }
+            const sig = req.headers['x-hub-signature-256'];
+            if (typeof sig !== 'string' ||
+                !verifyGithubSignature(raw, sig, config.githubAppWebhookSecret)) {
+                return reply.code(401).send({ error: 'invalid signature' });
+            }
+            const eventType = req.headers['x-github-event'];
+            if (typeof eventType !== 'string') {
+                return reply.code(400).send({ error: 'missing X-GitHub-Event' });
+            }
+            // GitHub pings a newly-configured webhook once — ack it.
+            if (eventType === 'ping')
+                return { received: true, queued: 0 };
+            let payload;
+            try {
+                payload = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                return reply.code(400).send({ error: 'invalid JSON' });
+            }
+            const target = extractPrTargets(eventType, payload);
+            if (!target)
+                return { received: true, queued: 0 };
+            // Route by (owner, name) across ALL accounts watching this repo. `repos` is keyed
+            // (accountId, owner, name), so one webhook fans out to every tenant's copy — each
+            // synced with ITS OWN token inside syncOnePr (isolation is structural). No
+            // installation→account table is needed.
+            const rows = await db
+                .select({ id: repos.id })
+                .from(repos)
+                .where(and(eq(repos.owner, target.owner), eq(repos.name, target.name)))
+                .execute();
+            let queued = 0;
+            for (const row of rows) {
+                for (const prNumber of target.prNumbers) {
+                    // Debounced + coalesced + reservation-guarded: a burst for one PR collapses to
+                    // a single targeted sync (Phase 0). Fire-and-forget; syncOnePr swallows errors.
+                    enqueuePrSync(row.id, prNumber, log);
+                    queued += 1;
+                }
+            }
+            if (queued > 0) {
+                req.log.info({
+                    repo: `${target.owner}/${target.name}`,
+                    event: eventType,
+                    prs: target.prNumbers,
+                    watchers: rows.length,
+                }, 'github webhook → queued targeted sync');
+            }
+            return { received: true, queued };
+        });
+    });
+}
+//# sourceMappingURL=webhooks.js.map