fix: Proxy flow should respect trusted packages (#96)

* fix: Handle trusted packages in proxy flow

* perf: Pre-parse trusted PURLs

* fix: Code review fixes

* fix: Remove unused config

config/config.go

@@ -8,6 +8,9 @@ import (
 	"strconv"
 
 	_ "embed"
+
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	"github.com/safedep/dry/log"
 )
 
 const (
@@ -62,6 +65,13 @@ type Config struct {
 type TrustedPackage struct {
 	Purl   string `mapstructure:"purl"`
 	Reason string `mapstructure:"reason"`
+
+	// Pre-parsed PURL components (not serialized, computed at load time)
+	// These fields avoid repeated PURL parsing on every IsTrustedPackage() call
+	parsed    bool
+	ecosystem packagev1.Ecosystem
+	name      string
+	version   string
 }
 
 // RuntimeConfig is the configuration that is used at runtime. It contains static configuration
@@ -152,6 +162,10 @@ func initConfig() {
 	globalConfig.eventLogDir = eventLogDir
 
 	loadConfig()
+
+	if err := preprocessTrustedPackages(&globalConfig.Config); err != nil {
+		log.Warnf("Failed to preprocess trusted packages: %v", err)
+	}
 }
 
 // loadConfig loads the configuration from the config file.