feat(security-contacts): emails reachability & noise filtering [CM-1324]

backend/src/osspckgs/migrations/V1784073600__security_contacts_reachability.sql

@@ -0,0 +1,2 @@
+ALTER TABLE security_contacts ADD COLUMN IF NOT EXISTS reachable           BOOLEAN NOT NULL DEFAULT TRUE;
+ALTER TABLE security_contacts ADD COLUMN IF NOT EXISTS reachability_reason TEXT;

services/apps/packages_worker/src/security-contacts/reconcile.ts

@@ -1,3 +1,5 @@
+import { classifyEmailReachability, type EmailReachabilityReason } from '@crowd/common'
+
 import { scoreContact } from './score'
 import {
   ContactChannel,
@@ -56,6 +58,15 @@
   return false
 }
 
+function classifyReachability(c: RawContact): {
+  reachable: boolean
+  reachabilityReason: EmailReachabilityReason | null
+} {
+  if (c.channel !== 'email') return { reachable: true, reachabilityReason: null }
+  const r = classifyEmailReachability(c.value)
+  return { reachable: r.reachable, reachabilityReason: r.reason }
+}
+
 function normalizeValue(channel: ContactChannel, value: string): string {
   const v = value.trim()
   return channel === 'email' || channel === 'github-handle' ? v.toLowerCase() : v
@@ -130,7 +141,7 @@
 
   const scored: ScoredContact[] = merged.map((c) => {
     const contact = { ...c, provenance: dedupeProvenance(c.provenance) }
-    return { ...contact, ...scoreContact(contact, now) }
+    return { ...contact, ...scoreContact(contact, now), ...classifyReachability(contact) }
   })
 
   scored.sort(

services/apps/packages_worker/src/security-contacts/types.ts

@@ -1,3 +1,4 @@
+import type { EmailReachabilityReason } from '@crowd/common'
 import type { SecurityContactConfidence } from '@crowd/data-access-layer/src/osspckgs/api'
 
 export type ContactChannel = 'email' | 'github-pvr' | 'url' | 'github-handle' | 'web-form'
@@ -30,6 +31,8 @@ export interface RawContact {
 export interface ScoredContact extends RawContact {
   score: number
   confidence: SecurityContactConfidence
+  reachable: boolean
+  reachabilityReason: EmailReachabilityReason | null
 }
 
 export interface RepoPolicies {

services/apps/packages_worker/src/security-contacts/writeContacts.ts

@@ -30,7 +30,18 @@ export async function writeContacts(
       await tx.result(
         prepareBulkInsert(
           'security_contacts',
-          ['repo_id', 'channel', 'value', 'role', 'name', 'score', 'confidence', 'provenance'],
+          [
+            'repo_id',
+            'channel',
+            'value',
+            'role',
+            'name',
+            'score',
+            'confidence',
+            'provenance',
+            'reachable',
+            'reachability_reason',
+          ],
           contacts.map((c) => ({
             repo_id: repoId,
             channel: c.channel,
@@ -40,13 +51,17 @@ export async function writeContacts(
             score: c.score,
             confidence: c.confidence,
             provenance: JSON.stringify(c.provenance),
+            reachable: c.reachable,
+            reachability_reason: c.reachabilityReason,
           })),
           `(repo_id, channel, value) DO UPDATE SET
              role = EXCLUDED.role,
              name = EXCLUDED.name,
              score = EXCLUDED.score,
              confidence = EXCLUDED.confidence,
              provenance = EXCLUDED.provenance,
+             reachable = EXCLUDED.reachable,
+             reachability_reason = EXCLUDED.reachability_reason,
              last_refreshed = NOW(),
              updated_at = NOW(),
              deleted_at = NULL`,