feat: stewardship api unmock (CM-1218)#4195
Conversation
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2d2aa85. Configure here.
| if (unstewardedOnly && p.stewardship !== 'unassigned') return false | ||
| if (staleOnly) { | ||
| const lastRelease = MOCK_DETAILS[p.purl]?.general.riskSignals.lastRelease | ||
| if (!lastRelease || new Date(lastRelease) >= staleThreshold) return false |
There was a problem hiding this comment.
Ignored list query filters
Medium Severity
GET /packages still validates and echoes lifecycle and busFactor1Only, but those values are no longer passed into listPackagesForApi, so results stay unfiltered while the response filters object implies they were applied.
Reviewed by Cursor Bugbot for commit 2d2aa85. Configure here.
|
|
||
| // health, openVulns are v2 fields — fall back to name sort | ||
| const sortExpr = opts.sortBy === 'impact' ? 'p.impact' : 'LOWER(p.name)' | ||
| const sortDir = opts.sortDir === 'desc' ? 'DESC' : 'ASC' |
There was a problem hiding this comment.
Sort metadata does not match
Medium Severity
When sortBy is health or openVulns, the query orders by package name, yet listPackages still returns the requested sortBy in the response sort field.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2d2aa85. Configure here.
ulemons
changed the title
There was a problem hiding this comment.
Pull request overview
This PR wires the public v1 Packages/Stewardship API endpoints to the real packages-db (instead of in-memory mocks) by introducing a packages DB connection helper in the backend and a new DAL module (osspckgs/api) that queries package metrics, listings, detail, advisories, and batch stewardship rows.
Changes:
- Add
packagesDbconfig/env wiring (CROWD_PACKAGES_DB_*) and a lazygetPackagesQx()connection helper. - Add new DAL query module
services/libs/data-access-layer/src/osspckgs/api.tsand export it through DAL entrypoints. - Update public API handlers (
/packages,/packages/metrics,/packages/detail,/packages:batch-stewardship) to fetch from the packages DB and return v1 responses (with several v2 fields intentionallynull).
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| services/libs/data-access-layer/src/osspckgs/index.ts | Re-export new OSS packages DAL API module. |
| services/libs/data-access-layer/src/osspckgs/api.ts | Introduce SQL queries backing metrics, list, detail, advisories, and batch stewardship lookup. |
| services/libs/data-access-layer/src/index.ts | Export new DAL API module from the package root. |
| backend/src/db/packagesDb.ts | Add lazy, singleton-style packages DB QueryExecutor initializer. |
| backend/src/conf/index.ts | Add PACKAGES_DB_CONFIG configuration entry. |
| backend/src/api/public/v1/packages/listPackages.ts | Replace mock listing logic with DAL-backed pagination and mapping. |
| backend/src/api/public/v1/packages/getPackagesMetrics.ts | Replace mock metrics with DAL-backed metrics query. |
| backend/src/api/public/v1/packages/getPackage.ts | Replace mock detail response with DB-backed package + advisories fetch and response mapping. |
| backend/src/api/public/v1/packages/batchGetStewardship.ts | Replace mock batch stewardship with DB-backed lookup keyed by PURL. |
| backend/config/custom-environment-variables.json | Map packagesDb config to CROWD_PACKAGES_DB_* environment variables. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const qx = await getPackagesQx() | ||
| const { rows, total } = await listPackagesForApi(qx, { | ||
| page, | ||
| pageSize, | ||
| ecosystem, | ||
| staleOnly, | ||
| unstewardedOnly, | ||
| sortBy, | ||
| sortDir, | ||
| }) |
| openVulns: null, | ||
| stewardship: (r.stewardshipStatus ?? 'unassigned') as StewardshipStatus, | ||
| stewards: null, | ||
| })) |
| ORDER BY ${sortExpr} ${sortDir} NULLS LAST | ||
| LIMIT $(limit) OFFSET $(offset) |
| export function getPackagesQx(): Promise<QueryExecutor> { | ||
| if (!_init) { | ||
| if (!PACKAGES_DB_CONFIG) { | ||
| throw new Error( | ||
| 'Packages DB is not configured — set CROWD_PACKAGES_DB_* environment variables', | ||
| ) | ||
| } | ||
| _init = getDbConnection(PACKAGES_DB_CONFIG).then(pgpQx) | ||
| } | ||
| return _init | ||
| } |
Summary
Removes all mock implementations from the 4 packages public API endpoints and replaces them with real queries against the packages DB. Also lands the stewardship schema migration and a backfill script to seed one unassigned stewardship row per critical package.
Changes
Type of change
JIRA ticket
ticket
Note
Medium Risk
New required DB dependency and changed list/filter semantics for lifecycle and bus-factor; security/advisory data now comes from live queries.
Overview
Wires the public packages/stewardship API to the packages database instead of in-memory mocks, via
CROWD_PACKAGES_DB_*config and a lazygetPackagesQx()connection helper.Adds
osspckgs/apiDAL queries for metrics, paginated critical-package listing (withstewardshipsjoin, stale/unstewarded filters, impact/name sort), batch stewardship by PURL, package detail (repo lateral join, downloads subquery), and advisories. Handlers map DB fields (e.g.impact→ impact score, stewardship status defaulting tounassigned) and leave v2 response fields null (health, lifecycle, openVulns, stewards, etc.) where the DB does not yet supply them.List endpoint behavior change:
lifecycleandbusFactor1Onlyare still accepted in query params but are no longer applied in the new DB path (only ecosystem, stale, unstewarded, sort).getPackagemoves PURL validation into Zod instead of a manualBadRequestError.Reviewed by Cursor Bugbot for commit 2d2aa85. Bugbot is set up for automated code reviews on this repo. Configure here.