feat(cooldown): respect trusted_packages in dependency cooldown (#342)

* feat(cooldown): respect trusted_packages in dependency cooldown

Trusted packages are now treated as a superset waiver that bypasses every
PMG control (malware analysis, cooldown, and any future controls). A
globally trusted package is automatically exempt from the cooldown window
and no longer needs a duplicate entry in dependency_cooldown.skip.

The skip list remains the narrower, cooldown-only waiver for packages
that must bypass the cooldown wait but still be malware-scanned.

* refactor(cooldown): tag skip reason and audit-log skipped packages

Address review feedback on #342:

- Restore cooldownSkip to a pure single-list function (SRP); the merge
  into trusted_packages now happens in a separate mergeCooldownSkip step,
  driven by the exported CooldownSkip wrapper.
- Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage /
  CooldownSkipList) on both SkipAll and per-version entries, so callers
  can tell apart the broad waiver from the cooldown-only one. When both
  lists match the same package, trusted_packages wins.
- Add audit.LogCooldownSkipped and emit it from the npm and PyPI
  interceptors on the SkipAll path, alongside the existing info log,
  carrying the source list as the reason.

* refactor(cooldown): inline list merge, audit per-version exemptions

Address further review feedback:

- Drop the separate mergeCooldownSkip helper; cooldownSkip now writes
  into a shared *CooldownSkipInfo and is called twice from CooldownSkip
  (cooldown skip list first, trusted_packages on top so trusted entries
  override the reason on overlap).
- Audit log every exemption, not just SkipAll: a new auditCooldownSkip
  helper in proxy/interceptors/cooldown.go emits one event per match
  (package-wide or per-version), each tagged with its source list.
  LogCooldownSkipped gains a version argument for the per-version case.
- Cover the trusted_packages reason path in TestCooldownSkip.

* fix(cooldown): avoid double-auditing trusted package exemptions

auditCooldownSkip now only emits EventTypeCooldownSkipped for entries
that came from dependency_cooldown.skip. Trusted-package exemptions
already get an EventTypeInstallTrustedAllowed event at tarball-download
time (proxy/interceptors/base_registry.go), so emitting a cooldown event
for them too would double-count the same waiver.

* emit trusted and cooldown skip events to cloud

* fix tests

* refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll

Address PR review feedback:
- Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo
  instead of mutating an input pointer.
- Add mergeCooldownSkip to combine per-list results with trusted_packages
  taking precedence on overlap.
- CooldownSkip now consults trusted_packages first and returns immediately
  on a package-wide trusted exemption (DC skip list cannot add anything).
- Extend tests to cover disjoint pinned entries across both lists and the
  case where DC version-less subsumes a trusted pinned entry.

* fix(audit): address cooldown review feedback

* fix(cooldown): audit cooldown skips at download time with concrete version

Backend rejects PackageVersion messages without a version, and audit logs
should reflect the runtime fact (a specific version was skipped) rather
than the config rule. Move the audit emission from metadata-request
handling to download-request handling, where the concrete version is
known, and require version in LogCooldownSkipped.

* chore(audit): drop dead scope assignment in LogCooldownSkipped

* refactor(cooldown): move skip-list logic into cooldown handlers

Registry interceptors no longer compute CooldownSkip or branch on SkipAll;
they just call HandleMetadataRequest. The npm and pypi cooldown handlers
own the skip lookup, the package-wide exemption short-circuit, and (for
pypi) the canonical-name denormalization. Also align LogCooldownSkipped
with other LogXxx signatures by taking *packagev1.PackageVersion.

* fix: Simplify audit logging for dependency cooldown skip

* refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages

* fix: Code review fixes

* fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped

---------

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>

internal/audit/audit.go

@@ -87,7 +87,7 @@ func LogMalwareBlocked(pv *packagev1.PackageVersion, reason, analysisID, referen
 		AnalysisID:     analysisID,
 		IsMalware:      isMalware,
 		IsVerified:     isVerified,
-		Details: map[string]interface{}{
+		Details: map[string]any{
 			"reason":        reason,
 			"analysis_id":   analysisID,
 			"reference_url": referenceURL,
@@ -121,7 +121,7 @@ func LogInstallAllowed(pv *packagev1.PackageVersion, packageCount int) {
 		Type:           EventTypeInstallAllowed,
 		Message:        fmt.Sprintf("Installation allowed for %s@%s (%d packages analyzed)", pkgName(pv), pkgVersion(pv), packageCount),
 		PackageVersion: pv,
-		Details: map[string]interface{}{
+		Details: map[string]any{
 			"packages_analyzed": packageCount,
 		},
 		PackageCount: packageCount,
@@ -163,7 +163,7 @@ func LogInstallStarted(packageManager string, args []string) {
 	logEvent(AuditEvent{
 		Type:    EventTypeInstallStarted,
 		Message: fmt.Sprintf("Starting package installation with %s", packageManager),
-		Details: map[string]interface{}{
+		Details: map[string]any{
 			"package_manager": packageManager,
 			"arguments":       args,
 		},
@@ -177,8 +177,8 @@ func LogInstallStarted(packageManager string, args []string) {
 }
 
 // LogProxyHostObserved records an outbound host observed by the proxy that is not a known registry.
-func LogProxyHostObserved(hostname, method, reason string, details map[string]interface{}) {
-	base := map[string]interface{}{
+func LogProxyHostObserved(hostname, method, reason string, details map[string]any) {
+	base := map[string]any{
 		"hostname": hostname,
 		"method":   method,
 		"reason":   reason,
@@ -211,12 +211,30 @@ func LogDependencyCooldown(pv *packagev1.PackageVersion, publishDate time.Time,
 	}
 }
 
+// CooldownSkipReason is the only source that produces a dependency_cooldown_skipped
+// event; trusted-package exemptions surface as install_trusted_allowed instead.
+const CooldownSkipReason = "dependency_cooldown.skip"
+
+// LogCooldownSkipped records that a specific package version was exempted from
+// the dependency cooldown window by the dependency_cooldown.skip list.
+func LogCooldownSkipped(pv *packagev1.PackageVersion) {
+	logEvent(AuditEvent{
+		Type:           EventTypeCooldownSkipped,
+		Message:        fmt.Sprintf("Cooldown skipped for %s@%s", pkgName(pv), pkgVersion(pv)),
+		PackageVersion: pv,
+		Reason:         CooldownSkipReason,
+		Details: map[string]any{
+			"reason": CooldownSkipReason,
+		},
+	})
+}
+
 // LogSandboxOverride records that runtime sandbox policy overrides were applied.
 func LogSandboxOverride(sandboxProfile string, overrides []map[string]string) {
 	logEvent(AuditEvent{
 		Type:    EventTypeSandboxOverride,
 		Message: fmt.Sprintf("Sandbox runtime overrides applied (%d rules)", len(overrides)),
-		Details: map[string]interface{}{
+		Details: map[string]any{
 			"sandbox_profile":           sandboxProfile,
 			"sandbox_runtime_overrides": overrides,
 		},
@@ -234,7 +252,7 @@ func LogError(message string, err error) {
 	}
 
 	if err != nil {
-		event.Details = map[string]interface{}{
+		event.Details = map[string]any{
 			"error": err.Error(),
 		}
 	}
@@ -280,9 +298,9 @@ func LogSessionComplete(outcome Outcome, flowType FlowType) {
 	})
 }
 
-func mergeDetails(base, extra map[string]interface{}) map[string]interface{} {
+func mergeDetails(base, extra map[string]any) map[string]any {
 	if base == nil {
-		base = make(map[string]interface{})
+		base = make(map[string]any)
 	}
 	for k, v := range extra {
 		base[k] = v