feat: add new 4 endpoints (CM-1236)

[ulemons]

Summary

Implements the backend query and aggregation endpoints needed to power the three main OSSPREY Admin Dashboard V2 views: Overview, Triage Board, and Risk Matrix (CM-1235 scope extension). All endpoints are mounted under GET /v1/ossprey/ and protected by Auth0 JWT via the existing oauth2Middleware.

Changes

• GET /v1/ossprey/metrics — returns KPI bar data: total/critical package counts, coverage % (critical packages with active stewardship), steward counts by status (needsAttention, escalated, unassignedCritical); all counts scoped to is_critical = true for consistency
• GET /v1/ossprey/packages — paginated package list with full filter support (ecosystem, lifecycle, name, status, healthBand, vulnSeverity incl. new none value, staleOnly, unstewardedOnly, busFactor1Only); returns per-row maxVulnSeverity, healthBand, lastActivity, stewards, latestReleaseAt;
• GET /v1/ossprey/packages/scatter — returns all critical packages with criticalityScore (impact × 100), healthScore (scorecard × 10), and healthBand for the Risk Matrix scatter plot; registered before /packages to avoid Express treating scatter as a path param
• GET /v1/ossprey/activity — paginated stewardship activity feed across all packages; actorName currently echoes actorUserId (Auth0 sub) pending cross-DB resolution from crowd.dev users table
• DAL api.ts — adds getOsspreyMetrics, computeHealthBand (exported), listPackagesForScatter; extends listPackagesForApi with includeStewards and includeLastActivity optional flags (both default off to avoid unnecessary joins on the existing public /v1/packages endpoint); fixes getPackageStatusCounts to handle vulnSeverity='none'
• DAL stewardships.ts — adds listStewardshipActivity with window-function total + COUNT fallback pattern (same as package list)
• listPackages.ts — adds 'none' to vulnSeverityValues for consistency with the updated DAL type
• Triage Board — no dedicated endpoint needed; frontend fires GET /v1/ossprey/packages?status= per column in parallel

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

Ticket

---

Note

Medium Risk
New authenticated read surface over stewardship and package aggregates, including a non-paginated scatter query that could be heavy at ~2k rows; no write-path changes.

Overview
Adds Auth0-protected GET /v1/ossprey/* routes for OSSPREY Admin Dashboard V2: metrics (KPI bar), packages (filtered list + statusCounts), packages/scatter (risk matrix), and activity (paginated stewardship feed), plus an OpenAPI spec for those paths.

The data-access layer gains getOsspreyMetrics, listPackagesForScatter, computeHealthBand, and listStewardshipActivity, and extends listPackagesForApi with optional steward/last-activity joins, maxVulnSeverity, and vulnSeverity=none (aligned on existing /v1/packages query validation). OSSPREY package list responses add healthBand and richer row fields; activity actorName still mirrors actorUserId until cross-DB name resolution exists.

^{Reviewed by Cursor Bugbot for commit 06fd0a8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds OSSPREY Admin Dashboard V2 backend support by introducing new Auth0-protected /v1/ossprey/* public API endpoints plus DAL query helpers for metrics, package list/scatter, and stewardship activity feed.

Changes:

• Added /v1/ossprey router with endpoints for metrics, packages list, scatter data, and activity feed.
• Extended the packages DAL to support new filters (vulnSeverity=none), richer package list rows (stewards + last activity), and scatter-point aggregation.
• Added a stewardship activity feed DAL query with pagination total support.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
services/libs/data-access-layer/src/osspckgs/stewardships.ts	Adds DAL method to list stewardship activity feed rows with total count.
services/libs/data-access-layer/src/osspckgs/api.ts	Adds OSSPREY metrics + scatter DAL, new severity filter, health band helper, and optional joins for stewards/last activity.
backend/src/api/public/v1/packages/listPackages.ts	Extends vulnSeverity query enum to include none.
backend/src/api/public/v1/ossprey/packageScatter.ts	New /v1/ossprey/packages/scatter handler returning scatter points.
backend/src/api/public/v1/ossprey/packageList.ts	New /v1/ossprey/packages handler with filtering + status counts.
backend/src/api/public/v1/ossprey/metrics.ts	New /v1/ossprey/metrics handler.
backend/src/api/public/v1/ossprey/index.ts	Registers OSSPREY public v1 routes under /v1/ossprey.
backend/src/api/public/v1/ossprey/activityFeed.ts	New /v1/ossprey/activity handler backed by DAL activity feed query.
backend/src/api/public/v1/index.ts	Mounts /v1/ossprey behind existing Auth0 middleware.
backend/src/api/ossprey/packageScatter.ts	Adds legacy /ossprey/packages/scatter handler.
backend/src/api/ossprey/packageList.ts	Adds legacy /ossprey/packages handler.
backend/src/api/ossprey/openapi.yaml	Adds an OpenAPI spec for legacy /ossprey/* endpoints.
backend/src/api/ossprey/metrics.ts	Adds legacy /ossprey/metrics handler.
backend/src/api/ossprey/index.ts	Adds legacy /ossprey/* route registration module.
backend/src/api/ossprey/activityFeed.ts	Adds legacy /ossprey/activity handler.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e9817dc. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.