feat(cooldown): respect trusted_packages in dependency cooldown (#342)

* feat(cooldown): respect trusted_packages in dependency cooldown

Trusted packages are now treated as a superset waiver that bypasses every
PMG control (malware analysis, cooldown, and any future controls). A
globally trusted package is automatically exempt from the cooldown window
and no longer needs a duplicate entry in dependency_cooldown.skip.

The skip list remains the narrower, cooldown-only waiver for packages
that must bypass the cooldown wait but still be malware-scanned.

* refactor(cooldown): tag skip reason and audit-log skipped packages

Address review feedback on #342:

- Restore cooldownSkip to a pure single-list function (SRP); the merge
  into trusted_packages now happens in a separate mergeCooldownSkip step,
  driven by the exported CooldownSkip wrapper.
- Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage /
  CooldownSkipList) on both SkipAll and per-version entries, so callers
  can tell apart the broad waiver from the cooldown-only one. When both
  lists match the same package, trusted_packages wins.
- Add audit.LogCooldownSkipped and emit it from the npm and PyPI
  interceptors on the SkipAll path, alongside the existing info log,
  carrying the source list as the reason.

* refactor(cooldown): inline list merge, audit per-version exemptions

Address further review feedback:

- Drop the separate mergeCooldownSkip helper; cooldownSkip now writes
  into a shared *CooldownSkipInfo and is called twice from CooldownSkip
  (cooldown skip list first, trusted_packages on top so trusted entries
  override the reason on overlap).
- Audit log every exemption, not just SkipAll: a new auditCooldownSkip
  helper in proxy/interceptors/cooldown.go emits one event per match
  (package-wide or per-version), each tagged with its source list.
  LogCooldownSkipped gains a version argument for the per-version case.
- Cover the trusted_packages reason path in TestCooldownSkip.

* fix(cooldown): avoid double-auditing trusted package exemptions

auditCooldownSkip now only emits EventTypeCooldownSkipped for entries
that came from dependency_cooldown.skip. Trusted-package exemptions
already get an EventTypeInstallTrustedAllowed event at tarball-download
time (proxy/interceptors/base_registry.go), so emitting a cooldown event
for them too would double-count the same waiver.

* emit trusted and cooldown skip events to cloud

* fix tests

* refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll

Address PR review feedback:
- Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo
  instead of mutating an input pointer.
- Add mergeCooldownSkip to combine per-list results with trusted_packages
  taking precedence on overlap.
- CooldownSkip now consults trusted_packages first and returns immediately
  on a package-wide trusted exemption (DC skip list cannot add anything).
- Extend tests to cover disjoint pinned entries across both lists and the
  case where DC version-less subsumes a trusted pinned entry.

* fix(audit): address cooldown review feedback

* fix(cooldown): audit cooldown skips at download time with concrete version

Backend rejects PackageVersion messages without a version, and audit logs
should reflect the runtime fact (a specific version was skipped) rather
than the config rule. Move the audit emission from metadata-request
handling to download-request handling, where the concrete version is
known, and require version in LogCooldownSkipped.

* chore(audit): drop dead scope assignment in LogCooldownSkipped

* refactor(cooldown): move skip-list logic into cooldown handlers

Registry interceptors no longer compute CooldownSkip or branch on SkipAll;
they just call HandleMetadataRequest. The npm and pypi cooldown handlers
own the skip lookup, the package-wide exemption short-circuit, and (for
pypi) the canonical-name denormalization. Also align LogCooldownSkipped
with other LogXxx signatures by taking *packagev1.PackageVersion.

* fix: Simplify audit logging for dependency cooldown skip

* refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages

* fix: Code review fixes

* fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped

---------

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>

config/cooldown_skip_test.go

@@ -7,6 +7,40 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func setGlobalForTest(t *testing.T, cfg *Config) {
+	t.Helper()
+	prev := globalConfig
+	globalConfig = &RuntimeConfig{Config: *cfg}
+	t.Cleanup(func() { globalConfig = prev })
+}
+
+func TestIsTrustedPackageRef(t *testing.T) {
+	cfg := &Config{TrustedPackages: []TrustedPackage{
+		{Purl: "pkg:npm/all-versions"},
+		{Purl: "pkg:npm/pinned@1.0.0"},
+	}}
+	_ = preprocessTrustedPackages(cfg)
+	setGlobalForTest(t, cfg)
+
+	assert.True(t, IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_NPM, "all-versions", "9.9.9"))
+	assert.True(t, IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_NPM, "pinned", "1.0.0"))
+	assert.False(t, IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_NPM, "pinned", "2.0.0"))
+	assert.False(t, IsTrustedPackageRef(packagev1.Ecosystem_ECOSYSTEM_NPM, "other", "1.0.0"))
+}
+
+func TestIsTrustedPackageAllVersions(t *testing.T) {
+	cfg := &Config{TrustedPackages: []TrustedPackage{
+		{Purl: "pkg:npm/all-versions"},
+		{Purl: "pkg:npm/pinned@1.0.0"},
+	}}
+	_ = preprocessTrustedPackages(cfg)
+	setGlobalForTest(t, cfg)
+
+	assert.True(t, IsTrustedPackageAllVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "all-versions"))
+	assert.False(t, IsTrustedPackageAllVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "pinned"))
+	assert.False(t, IsTrustedPackageAllVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "absent"))
+}
+
 func TestCooldownSkip(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -117,42 +151,14 @@ func TestCooldownSkipInfo_ExemptsVersion(t *testing.T) {
 	assert.False(t, none.ExemptsVersion("1.0.0"))
 }
 
-// TestCooldownSkipAndTrustedPackagesAreIndependent verifies the cooldown skip
-// list and the top-level trusted_packages do not leak into each other: a
-// cooldown-skipped package is NOT trusted for malware analysis, and a
-// malware-trusted package is NOT cooldown-skipped.
-func TestCooldownSkipAndTrustedPackagesAreIndependent(t *testing.T) {
+func TestCooldownSkipIsSkipListOnly(t *testing.T) {
 	cfg := &Config{
-		TrustedPackages: []TrustedPackage{
-			{Purl: "pkg:npm/malware-trusted", Reason: "waives analysis only"},
-		},
-		DependencyCooldown: DependencyCooldownConfig{
-			Skip: []TrustedPackage{
-				{Purl: "pkg:npm/cooldown-skipped", Reason: "waives cooldown only"},
-			},
-		},
+		TrustedPackages:    []TrustedPackage{{Purl: "pkg:npm/trusted-only"}},
+		DependencyCooldown: DependencyCooldownConfig{Skip: []TrustedPackage{{Purl: "pkg:npm/cooldown-only"}}},
 	}
 	_ = preprocessTrustedPackages(cfg)
+	setGlobalForTest(t, cfg)
 
-	cooldownSkipped := &packagev1.PackageVersion{
-		Package: &packagev1.Package{Name: "cooldown-skipped", Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM},
-		Version: "1.0.0",
-	}
-	malwareTrusted := &packagev1.PackageVersion{
-		Package: &packagev1.Package{Name: "malware-trusted", Ecosystem: packagev1.Ecosystem_ECOSYSTEM_NPM},
-		Version: "1.0.0",
-	}
-
-	// Cooldown-skipped package is still malware-analyzed (not in trusted_packages).
-	assert.False(t, isTrustedPackageVersion(cfg.TrustedPackages, cooldownSkipped),
-		"cooldown-skipped package must NOT waive malware analysis")
-	assert.True(t, cooldownSkip(cfg.DependencyCooldown.Skip, packagev1.Ecosystem_ECOSYSTEM_NPM, "cooldown-skipped").SkipAll,
-		"cooldown-skipped package must skip the cooldown window")
-
-	// Malware-trusted package is still subject to cooldown (not in the skip list).
-	assert.True(t, isTrustedPackageVersion(cfg.TrustedPackages, malwareTrusted),
-		"malware-trusted package must waive malware analysis")
-	skip := cooldownSkip(cfg.DependencyCooldown.Skip, packagev1.Ecosystem_ECOSYSTEM_NPM, "malware-trusted")
-	assert.False(t, skip.SkipAll, "malware-trusted package must NOT skip cooldown")
-	assert.Nil(t, skip.Versions)
+	assert.False(t, CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_NPM, "trusted-only").SkipAll, "trusted_packages must not leak into CooldownSkip")
+	assert.True(t, CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_NPM, "cooldown-only").SkipAll)
 }