Merge branch 'feat/CM-361-part-1' into feat/CM-361-part-2

Author: skwowet

backend/src/api/public/v1/akrites/openapi.yaml

@@ -397,6 +397,31 @@ components:
           type: integer
           description: Total packages marked as critical (is_critical = true).
 
+    SecurityContactConfidence:
+      type: string
+      enum: [PRIMARY, SECONDARY, FALLBACK, NONE]
+
+    SecurityContact:
+      type: object
+      required: [channel, value, role, confidence, score]
+      properties:
+        channel:
+          type: string
+          enum: [email, github-pvr, url, github-handle, web-form]
+        value:
+          type: string
+          example: security@expressjs.com
+        role:
+          type: string
+          enum: [security-team, maintainer, admin, committer, org-owner]
+        confidence:
+          $ref: '#/components/schemas/SecurityContactConfidence'
+        score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 1
+
     Advisory:
       type: object
       required: [osvId, severity, resolution, isCritical]
@@ -522,8 +547,32 @@ components:
             securityContacts:
               type: array
               nullable: true
+              description: >-
+                null when the linked repo has not yet been swept by the security-contacts
+                pipeline; empty array when swept with no contacts found. Provenance and
+                internal scoring metadata are never included.
               items:
-                type: string
+                $ref: '#/components/schemas/SecurityContact'
+            packageConfidence:
+              allOf:
+                - $ref: '#/components/schemas/SecurityContactConfidence'
+              nullable: true
+              description: Confidence band of the highest-scoring contact in securityContacts.
+            securityPolicies:
+              type: object
+              properties:
+                securityPolicyUrl:
+                  type: string
+                  nullable: true
+                vulnerabilityReportingUrl:
+                  type: string
+                  nullable: true
+                bugBountyUrl:
+                  type: string
+                  nullable: true
+                pvrEnabled:
+                  type: boolean
+                  nullable: true
             advisories:
               type: array
               items:

backend/src/api/public/v1/packages/getPackage.ts

@@ -6,6 +6,7 @@ import {
   getAdvisoriesByPackageId,
   getPackageDetailByPurl,
   getStewardshipSummary,
+  securityContactConfidenceBand,
 } from '@crowd/data-access-layer'
 
 import { getPackagesQx } from '@/db/packagesDb'
@@ -50,6 +51,21 @@ export async function getPackage(req: Request, res: Response): Promise<void> {
   const mappingConfidence =
     pkg.repoMappingConfidence != null ? Number(pkg.repoMappingConfidence) : null
 
+  const securityContacts =
+    pkg.contactsLastRefreshed == null
+      ? null
+      : (pkg.securityContacts ?? []).map((c) => ({
+          channel: c.channel,
+          value: c.value,
+          role: c.role,
+          confidence: c.confidence,
+          score: Number(c.score),
+        }))
+  const packageConfidence =
+    securityContacts && securityContacts.length > 0
+      ? securityContactConfidenceBand(Math.max(...securityContacts.map((c) => c.score)))
+      : null
+
   ok(res, {
     purl: pkg.purl,
     name: pkg.name,
@@ -92,15 +108,22 @@ export async function getPackage(req: Request, res: Response): Promise<void> {
     signalCoverageHealth: snakeToCamelKeys(pkg.signalCoverageHealth),
     assessment: null,
     security: {
-      securityContacts: null,
+      securityContacts,
+      packageConfidence,
+      securityPolicies: {
+        securityPolicyUrl: pkg.securityPolicyUrl ?? null,
+        vulnerabilityReportingUrl: pkg.vulnerabilityReportingUrl ?? null,
+        bugBountyUrl: pkg.bugBountyUrl ?? null,
+        pvrEnabled: pkg.pvrEnabled ?? null,
+      },
       advisories: advisories.map((a) => ({
         osvId: a.osvId,
         severity: a.severity,
         resolution: a.resolution,
         isCritical: a.isCritical,
       })),
       cvd: {
-        isPvrEnabled: null,
+        isPvrEnabled: pkg.pvrEnabled ?? null,
         tier0Steward: null,
         criticalVulnerabilityFlag: pkg.hasCriticalVulnerability,
       },

backend/src/database/repositories/memberRepository.ts

@@ -244,6 +244,10 @@ class MemberRepository {
 
     const subprojectIds = await getSegmentSubprojectIds(qx, currentSegments)
 
+    if (subprojectIds.length === 0) {
+      return
+    }
+
     await seq.query(bulkDeleteMemberSegments, {
       replacements: {
         memberIds,

backend/src/database/repositories/organizationRepository.ts

@@ -192,6 +192,10 @@ class OrganizationRepository {
     const qx = SequelizeRepository.getQueryExecutor(options)
     const subprojectIds = await getSegmentSubprojectIds(qx, currentSegments)
 
+    if (subprojectIds.length === 0) {
+      return
+    }
+
     await seq.query(bulkDeleteOrganizationSegments, {
       replacements: {
         organizationIds,

services/apps/git_integration/src/crowdgit/database/crud.py

@@ -667,30 +667,32 @@ async def find_many_organization_ids_by_identities(identities: list[dict]) -> li
     param_index = 1
     for idx, identity in enumerate(identities):
         values_parts.append(
-            f"(${param_index}::int, ${param_index + 1}::text,"
-            f" ${param_index + 2}::boolean, ${param_index + 3}::text)"
+            f"(${param_index}::int, ${param_index + 1}::text, ${param_index + 2}::boolean,"
+            f" ${param_index + 3}::text, ${param_index + 4}::text)"
         )
         params.extend(
             [
                 idx,
                 identity["type"],
                 identity.get("verified", True),
+                identity["platform"],
                 identity["value"],
             ]
         )
-        param_index += 4
+        param_index += 5
 
     matches_by_idx: dict[int, set[str]] = {}
     rows = await query(
         f"""
-        WITH input_identities (idx, identity_type, verified, value) AS (
+        WITH input_identities (idx, identity_type, verified, platform, value) AS (
             VALUES {", ".join(values_parts)}
         )
         SELECT i.idx, oi."organizationId"
         FROM input_identities i
         LEFT JOIN "organizationIdentities" oi
             ON oi.type = i.identity_type
             AND oi.verified = i.verified
+            AND oi.platform = i.platform
             AND lower(oi.value) = lower(i.value)
         ORDER BY i.idx
         """,
@@ -708,6 +710,7 @@ async def find_many_organization_ids_by_identities(identities: list[dict]) -> li
         results.append(
             {
                 "type": identity["type"],
+                "platform": identity["platform"],
                 "value": identity["value"],
                 "verified": identity.get("verified", True),
                 "organization_id": organization_id,

services/apps/git_integration/src/crowdgit/services/affiliation/affiliation_service.py

@@ -162,20 +162,25 @@ def get_file_picker_prompt(
         - contributors grouped under the organization they belong to
         - explicit domain/email-pattern rules that the file defines for assigning
           contributors to organizations
+
+        What decides a match is the content, not the file's name or purpose. Any
+        file qualifies when it states an organization per person — including
+        governance or ownership files (e.g. OWNERS, MAINTAINERS) when they carry
+        an explicit organization/employer for each person. Try to capture these.
         </what_to_find>
 
         <what_to_reject>
-        Reject candidates whose preview does not explicitly associate contributors
-        with organizations, including:
-        - Lists of names, emails, or usernames with no stated organization
-        (e.g. AUTHORS, CONTRIBUTORS, CREDITS).
-        - Identity or alias mappings such as .mailmap.
-        - Governance or ownership files that name people but not their employer
-        (e.g. OWNERS, CODEOWNERS, MAINTAINERS without organization information).
-        - Source code, scripts, or configuration files.
-
-        Email addresses and email domains alone do not make a file a match, unless
-        the file explicitly defines those domains or patterns as affiliation rules.
+        The deciding factor is whether the file states an organization per person.
+        Reject a candidate when it only identifies people without that, including:
+        - lists of names, emails, or usernames with no organization
+          (e.g. AUTHORS, CONTRIBUTORS, CREDITS)
+        - identity or alias mappings (e.g. .mailmap)
+        - role or ownership files that name people but not their employer
+          (e.g. OWNERS, CODEOWNERS, MAINTAINERS without organization information)
+        - source code, scripts, or configuration
+
+        An email address or its domain is not an organization, unless the file
+        explicitly defines that domain or pattern as an affiliation rule.
         </what_to_reject>
 
         <candidates>
@@ -298,9 +303,16 @@ def get_extraction_prompt(self, content_to_analyze: str) -> str:
           It is valid to use an email/domain pattern only when the file itself explicitly
           defines that pattern as an affiliation rule.
         - name: the organization name the file states, else null.
-        - domain: use a domain the file states; otherwise infer it from the stated
-          organization name only when confident (e.g. "Google" -> google.com), else null.
-          Never infer a domain from an email.
+        - domain: choose the organization's domain in this order:
+          1. a domain the file explicitly states for the organization;
+          2. a domain you can infer confidently from the stated organization name
+             (e.g. "Google" -> google.com);
+          3. only when the file explicitly ties an organization to this contributor
+             AND provides that same contributor's email, the domain of that email
+             (e.g. company "Ericsson Software Technology" + "john@est.tech" -> est.tech).
+          Otherwise null. An email domain is a domain source only for an organization
+          the file has already named for that person — never use it to invent or guess
+          an organization that the file does not state.
         - isUnaffiliated: set true only when the file explicitly marks the person as
           independent / unaffiliated / personal / no employer — not as a fallback when
           the organization is merely missing. When true, set name and domain to null.
@@ -409,7 +421,7 @@ def group_parse_rows(
             if is_unaffiliated:
                 stint = AffiliationOrganizationStint(
                     name="Individual",
-                    domain="individual-noaccount.com",
+                    domain="nonameaccount.com",
                     date_start=cls._parse_optional_date(organization.date_start),
                     date_end=cls._parse_optional_date(organization.date_end),
                     is_unaffiliated=True,
@@ -607,13 +619,35 @@ def has_existing_stint(
 
     @staticmethod
     def affiliation_stint_key(
-        contributor: AffiliationContributor, domain: str
-    ) -> tuple[str, str, str] | None:
-        domain = domain.lower()
+        contributor: AffiliationContributor,
+        organization: AffiliationOrganizationStint,
+    ) -> tuple[str, str, str, date | None, date | None, bool] | None:
+        domain = organization.domain.lower()
+        date_start = organization.date_start
+        date_end = organization.date_end
+        if isinstance(date_start, datetime):
+            date_start = date_start.date()
+        if isinstance(date_end, datetime):
+            date_end = date_end.date()
+
         if contributor.email:
-            return ("email", contributor.email.lower(), domain)
+            return (
+                "email",
+                contributor.email.lower(),
+                domain,
+                date_start,
+                date_end,
+                organization.is_unaffiliated,
+            )
         if contributor.github:
-            return ("github", contributor.github.lower(), domain)
+            return (
+                "github",
+                contributor.github.lower(),
+                domain,
+                date_start,
+                date_end,
+                organization.is_unaffiliated,
+            )
         return None
 
     async def exclude_parent_repo_affiliations(
@@ -633,16 +667,15 @@ async def exclude_parent_repo_affiliations(
             key
             for entry in parent_snapshot
             for organization in entry.organizations
-            if (key := self.affiliation_stint_key(entry.contributor, organization.domain))
+            if (key := self.affiliation_stint_key(entry.contributor, organization))
         }
 
         fork_entries: list[AffiliationContributorEntry] = []
         for entry in extracted_affiliations:
             organizations = [
                 organization
                 for organization in entry.organizations
-                if (key := self.affiliation_stint_key(entry.contributor, organization.domain))
-                is None
+                if (key := self.affiliation_stint_key(entry.contributor, organization)) is None
                 or key not in parent_stint_keys
             ]
             if organizations:
@@ -720,6 +753,7 @@ async def apply_affiliations(
                 organization_identity_inputs.append(
                     {
                         "type": "primary-domain",
+                        "platform": "email",
                         "value": organization.domain,
                         "verified": True,
                     }

services/apps/packages_worker/src/nuget/normalize.ts

@@ -19,6 +19,13 @@ function isPrerelease(version: string): boolean {
   return version.includes('-')
 }
 
+// NuGet stamps unlisted versions with 1900-01-01T00:00:00Z as a sentinel — treat as absent.
+function parsePublishedDate(published: string | undefined): Date | null {
+  if (!published) return null
+  const date = new Date(published)
+  return !isNaN(date.getTime()) && date.getUTCFullYear() > 1900 ? date : null
+}
+
 const SCM_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.org']
 
 function normalizeRepoUrl(url: string | undefined): string | null {
@@ -105,25 +112,15 @@ export function normalizeNuGetPackage(
     status = 'active'
   }
 
-  // NuGet stamps unlisted versions with 1900-01-01T00:00:00Z as a sentinel — exclude them.
   const publishedDates = allEntries
-    .filter((e) => e.published)
-    .map((e) => new Date(e.published as string))
-    .filter((d) => !isNaN(d.getTime()) && d.getUTCFullYear() > 1900)
+    .map((e) => parsePublishedDate(e.published))
+    .filter((d): d is Date => d !== null)
     .sort((a, b) => a.getTime() - b.getTime())
 
   const firstReleaseAt = publishedDates.length > 0 ? publishedDates[0] : null
 
   const latestEntry4Date = latestListedEntry ?? latestEntry
-  const latestReleaseAtRaw = latestEntry4Date?.published
-    ? new Date(latestEntry4Date.published)
-    : null
-  const latestReleaseAt =
-    latestReleaseAtRaw &&
-    !isNaN(latestReleaseAtRaw.getTime()) &&
-    latestReleaseAtRaw.getUTCFullYear() > 1900
-      ? latestReleaseAtRaw
-      : null
+  const latestReleaseAt = parsePublishedDate(latestEntry4Date?.published)
 
   const totalDownloads = searchResult?.totalDownloads ?? 0
 
@@ -144,7 +141,7 @@ export function normalizeNuGetPackage(
     const { licenses: vLicenses } = parseLicense(entry.licenseExpression, entry.licenseUrl)
     return {
       number: ver,
-      publishedAt: entry.published ? new Date(entry.published) : null,
+      publishedAt: parsePublishedDate(entry.published),
       isLatest: ver === latestVersion,
       isPrerelease: isPrerelease(ver),
       isYanked: entry.listed === false,