Merge branch 'main' into cm-361-affiliation-registry-migration

Author: skwowet

backend/.env.dist.local

@@ -195,7 +195,7 @@ OSSPCKGS_GCP_CREDENTIALS_B64=e30=
 # maven/all.zip 404s). The allowlist check and DB storage normalize to lowercase
 # internally per ADR-0001 §OSV "Ecosystem normalization", so downstream stays lowercase.
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
-OSV_ECOSYSTEMS=npm,Maven,cargo
+OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000

backend/src/api/public/v1/ossprey/packageList.ts

@@ -20,33 +20,38 @@ const LIFECYCLE_SET = new Set<string>(LIFECYCLE_VALUES)
 
 const boolParam = z.preprocess((v) => v === 'true', z.boolean()).default(false)
 
-const querySchema = z.object({
-  page: z.coerce.number().int().min(1).default(1),
-  pageSize: z.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(25),
-  ecosystem: z.string().trim().optional(),
-  lifecycle: z.enum(LIFECYCLE_VALUES).optional(),
-  name: z.string().trim().optional(),
-  purl: purlFilterSchema,
-  status: z
-    .enum([
-      'unassigned',
-      'open',
-      'assessing',
-      'active',
-      'needs_attention',
-      'escalated',
-      'blocked',
-      'inactive',
-    ])
-    .optional(),
-  healthBand: z.enum(HEALTH_BAND_VALUES).optional(),
-  vulnSeverity: z.enum(['any', 'high', 'critical', 'none']).optional(),
-  staleOnly: boolParam,
-  unstewardedOnly: boolParam,
-  busFactor1Only: boolParam,
-  sortBy: z.enum(['name', 'risk', 'impact', 'openVulns', 'health']).default('risk'),
-  sortDir: z.enum(['asc', 'desc']).default('desc'),
-})
+const querySchema = z
+  .object({
+    page: z.coerce.number().int().min(1).default(1),
+    pageSize: z.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(25),
+    ecosystem: z.string().trim().optional(),
+    lifecycle: z.enum(LIFECYCLE_VALUES).optional(),
+    name: z.string().trim().optional(),
+    purl: purlFilterSchema,
+    status: z
+      .enum([
+        'unassigned',
+        'open',
+        'assessing',
+        'active',
+        'needs_attention',
+        'escalated',
+        'blocked',
+        'inactive',
+      ])
+      .optional(),
+    healthBand: z.enum(HEALTH_BAND_VALUES).optional(),
+    vulnSeverity: z.enum(['any', 'high', 'critical', 'none']).optional(),
+    staleOnly: boolParam,
+    unstewardedOnly: boolParam,
+    busFactor1Only: boolParam,
+    sortBy: z.enum(['name', 'risk', 'impact', 'openVulns', 'health']).default('risk'),
+    sortDir: z.enum(['asc', 'desc']).optional(),
+  })
+  .transform((data) => ({
+    ...data,
+    sortDir: data.sortDir ?? (data.sortBy === 'name' || data.sortBy === 'health' ? 'asc' : 'desc'),
+  }))
 
 export async function packageListHandler(req: Request, res: Response): Promise<void> {
   const params = validateOrThrow(querySchema, req.query)

backend/src/api/public/v1/packages/mockData.ts

@@ -50,7 +50,7 @@ import {
   includeMemberToSegments,
 } from '@crowd/data-access-layer/src/members/segments'
 import { IDbMemberData } from '@crowd/data-access-layer/src/members/types'
-import { optionsQx } from '@crowd/data-access-layer/src/queryExecutor'
+import { optionsBgQx, optionsQx } from '@crowd/data-access-layer/src/queryExecutor'
 import {
   fetchManySegments,
   getSegmentMergeSuggestionCounts,
@@ -1259,7 +1259,7 @@ class MemberRepository {
     let memberResponse = null
 
     const qx = optionsQx(options)
-    const bgQx = optionsQx({ ...options, transaction: null })
+    const bgQx = optionsBgQx(options)
 
     memberResponse = await queryMembersAdvanced(qx, bgQx, options.redis, {
       filter: { id: { eq: id } },

backend/src/database/repositories/memberRepository.ts

@@ -0,0 +1 @@
+ALTER TABLE packages ADD COLUMN IF NOT EXISTS total_downloads bigint;