fix: never downgrade repo link provenance from packagist

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/persistPackageInfo.test.ts

@@ -6,7 +6,7 @@ import {
   removeDeclaredPackageRepo,
   updatePackagistPackageStats,
   upsertPackageMaintainers,
-  upsertPackageRepo,
+  upsertPackageRepoPreserveProvenance,
 } from '@crowd/data-access-layer/src/packages'
 import type { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
 
@@ -17,15 +17,15 @@ vi.mock('@crowd/data-access-layer/src/packages', () => ({
   updatePackagistPackageStats: vi.fn(),
   upsertPackageMaintainers: vi.fn().mockResolvedValue([]),
   getOrCreateRepoByUrl: vi.fn(),
-  upsertPackageRepo: vi.fn().mockResolvedValue([]),
+  upsertPackageRepoPreserveProvenance: vi.fn().mockResolvedValue([]),
   removeDeclaredPackageRepo: vi.fn().mockResolvedValue([]),
   logAuditFieldChanges: vi.fn(),
 }))
 
 const mockUpdate = vi.mocked(updatePackagistPackageStats)
 const mockMaintainers = vi.mocked(upsertPackageMaintainers)
 const mockRepoGet = vi.mocked(getOrCreateRepoByUrl)
-const mockRepoLink = vi.mocked(upsertPackageRepo)
+const mockRepoLink = vi.mocked(upsertPackageRepoPreserveProvenance)
 const mockRepoRemove = vi.mocked(removeDeclaredPackageRepo)
 const mockAudit = vi.mocked(logAuditFieldChanges)
 

services/apps/packages_worker/src/packagist/upsertPackageInfo.ts

@@ -4,7 +4,7 @@ import {
   removeDeclaredPackageRepo,
   updatePackagistPackageStats,
   upsertPackageMaintainers,
-  upsertPackageRepo,
+  upsertPackageRepoPreserveProvenance,
 } from '@crowd/data-access-layer/src/packages'
 import type { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
 
@@ -61,14 +61,18 @@ export async function persistPackagistPackageInfo(
     changedFields.push(...result.changedFields)
 
     // Step 2: Link the repo for ALL packages — 'declared'/0.8 is the manifest-declared
-    // convention shared by npm/pypi/maven/cargo. When there's no trusted repo (removed
-    // from the manifest, or no longer canonicalizable to a known host), or it now
-    // resolves to a different repo, clear any previously-declared link that no longer
-    // applies — package_repos' unique key is (package_id, repo_id), not (package_id,
-    // source), so upserting the new link alone would leave a stale one dangling.
+    // convention shared by npm/pypi/maven/cargo. Preserve-provenance: a higher-confidence
+    // link another pipeline (manual/deps_dev) already owns for this repo must not be
+    // downgraded to 'declared'/0.8 by a routine weekly refresh — matches
+    // upsertMavenPackageRepo/cargo's established GREATEST-confidence, source-preserving
+    // pattern. When there's no trusted repo (removed from the manifest, or no longer
+    // canonicalizable to a known host), or it now resolves to a different repo, clear any
+    // previously-declared link that no longer applies — package_repos' unique key is
+    // (package_id, repo_id), not (package_id, source), so upserting the new link alone
+    // would leave a stale one dangling.
     if (trustedRepo) {
       const repo = await getOrCreateRepoByUrl(t, trustedRepo.url, trustedRepo.host)
-      const linkChanged = await upsertPackageRepo(t, id, repo.id, 'declared', 0.8)
+      const linkChanged = await upsertPackageRepoPreserveProvenance(t, id, repo.id, 'declared', 0.8)
       const removedFields = await removeDeclaredPackageRepo(t, id, repo.id)
       changedFields.push(...repo.changedFields, ...linkChanged, ...removedFields)
     } else {

services/libs/data-access-layer/src/packages/repos.ts

@@ -87,3 +87,42 @@ export async function upsertPackageRepo(
   )
   return row.changed_fields
 }
+
+// Same shape as upsertPackageRepo, but never lets this write downgrade an existing
+// link: `source` is left untouched on conflict (a manual/deps_dev link keeps its
+// provenance instead of being reassigned to this caller's source) and `confidence`
+// only ever moves up via GREATEST. Matches the established pattern in
+// upsertMavenPackageRepo (osspckgs/repos.ts) and cargo/enrich.ts's inline equivalent —
+// added here as a separate function rather than changing upsertPackageRepo itself,
+// which pypi/npm/go/nuget/rubygems also call and rely on staying an unconditional set.
+export async function upsertPackageRepoPreserveProvenance(
+  qx: QueryExecutor,
+  packageId: string,
+  repoId: string,
+  source: string,
+  confidence: number,
+): Promise<string[]> {
+  const row: { changed_fields: string[] } = await qx.selectOne(
+    `WITH old AS (
+       SELECT source, confidence FROM package_repos
+        WHERE package_id = $(packageId)::bigint AND repo_id = $(repoId)::bigint
+     ),
+     ins AS (
+       INSERT INTO package_repos (package_id, repo_id, source, confidence, created_at)
+       VALUES ($(packageId)::bigint, $(repoId)::bigint, $(source), $(confidence), NOW())
+       ON CONFLICT (package_id, repo_id) DO UPDATE SET
+         confidence  = GREATEST(EXCLUDED.confidence, package_repos.confidence),
+         verified_at = NOW()
+       RETURNING source, confidence
+     )
+     SELECT array_remove(ARRAY[
+       CASE WHEN o.source IS NULL                             THEN 'package_repos.repo_id' END,
+       CASE WHEN o.source IS NULL                             THEN 'package_repos.source' END,
+       CASE WHEN o.source IS NULL
+              OR o.confidence IS DISTINCT FROM ins.confidence THEN 'package_repos.confidence' END
+     ], NULL) AS changed_fields
+     FROM ins LEFT JOIN old o ON true`,
+    { packageId, repoId, source, confidence },
+  )
+  return row.changed_fields
+}