403 lines · 14.1 KB
import { first } from "../db";
import { repoDb, stmt } from "../scoped-db";
import { registerLocator } from "../scoped-db/locators";
import { scopedId } from "../scoped-db/ids";
import { accountsById } from "../people";
import { indexAdvisory } from "./advisory-packages";
import { resolveMentions } from "../mentions";
import { randomId } from "../crypto";
import { badRequest, forbidden, notFoundError } from "../errors";
import { assertBelowCap } from "../limits";
import { hasPermission, repoPermission } from "../repos";
import { renderMarkdown } from "../markdown";
import { notifyAdvisoryUpdate } from "../notify/security";
import type { Permission, RepoRow, Viewer } from "~/lib/types";

const ID_ALPHABET = "23456789cfghjmpqrvwx";
const ID_GROUPS = 3;
const ID_GROUP_LENGTH = 4;
const MAX_OPEN_REPORTS_PER_USER = 5;
const MAX_ADVISORIES_PER_REPO = 500;
const MAX_COMMENTS_PER_ADVISORY = 500;
const MAX_COLLABORATORS = 20;
const ADVISORY_PAGE = 100;

export type AdvisoryState = "triage" | "draft" | "published" | "closed";
export type Severity = "low" | "moderate" | "high" | "critical";

export type AdvisoryInput = {
  title: string;
  description: string;
  severity: Severity;
  cveId: string | null;
  cweIds: string | null;
  ecosystem: string | null;
  packageName: string | null;
  affectedVersions: string | null;
  patchedVersions: string | null;
};

type AdvisoryRow = {