feat(cooldown): respect trusted_packages in dependency cooldown (#342)

* feat(cooldown): respect trusted_packages in dependency cooldown

Trusted packages are now treated as a superset waiver that bypasses every
PMG control (malware analysis, cooldown, and any future controls). A
globally trusted package is automatically exempt from the cooldown window
and no longer needs a duplicate entry in dependency_cooldown.skip.

The skip list remains the narrower, cooldown-only waiver for packages
that must bypass the cooldown wait but still be malware-scanned.

* refactor(cooldown): tag skip reason and audit-log skipped packages

Address review feedback on #342:

- Restore cooldownSkip to a pure single-list function (SRP); the merge
  into trusted_packages now happens in a separate mergeCooldownSkip step,
  driven by the exported CooldownSkip wrapper.
- Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage /
  CooldownSkipList) on both SkipAll and per-version entries, so callers
  can tell apart the broad waiver from the cooldown-only one. When both
  lists match the same package, trusted_packages wins.
- Add audit.LogCooldownSkipped and emit it from the npm and PyPI
  interceptors on the SkipAll path, alongside the existing info log,
  carrying the source list as the reason.

* refactor(cooldown): inline list merge, audit per-version exemptions

Address further review feedback:

- Drop the separate mergeCooldownSkip helper; cooldownSkip now writes
  into a shared *CooldownSkipInfo and is called twice from CooldownSkip
  (cooldown skip list first, trusted_packages on top so trusted entries
  override the reason on overlap).
- Audit log every exemption, not just SkipAll: a new auditCooldownSkip
  helper in proxy/interceptors/cooldown.go emits one event per match
  (package-wide or per-version), each tagged with its source list.
  LogCooldownSkipped gains a version argument for the per-version case.
- Cover the trusted_packages reason path in TestCooldownSkip.

* fix(cooldown): avoid double-auditing trusted package exemptions

auditCooldownSkip now only emits EventTypeCooldownSkipped for entries
that came from dependency_cooldown.skip. Trusted-package exemptions
already get an EventTypeInstallTrustedAllowed event at tarball-download
time (proxy/interceptors/base_registry.go), so emitting a cooldown event
for them too would double-count the same waiver.

* emit trusted and cooldown skip events to cloud

* fix tests

* refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll

Address PR review feedback:
- Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo
  instead of mutating an input pointer.
- Add mergeCooldownSkip to combine per-list results with trusted_packages
  taking precedence on overlap.
- CooldownSkip now consults trusted_packages first and returns immediately
  on a package-wide trusted exemption (DC skip list cannot add anything).
- Extend tests to cover disjoint pinned entries across both lists and the
  case where DC version-less subsumes a trusted pinned entry.

* fix(audit): address cooldown review feedback

* fix(cooldown): audit cooldown skips at download time with concrete version

Backend rejects PackageVersion messages without a version, and audit logs
should reflect the runtime fact (a specific version was skipped) rather
than the config rule. Move the audit emission from metadata-request
handling to download-request handling, where the concrete version is
known, and require version in LogCooldownSkipped.

* chore(audit): drop dead scope assignment in LogCooldownSkipped

* refactor(cooldown): move skip-list logic into cooldown handlers

Registry interceptors no longer compute CooldownSkip or branch on SkipAll;
they just call HandleMetadataRequest. The npm and pypi cooldown handlers
own the skip lookup, the package-wide exemption short-circuit, and (for
pypi) the canonical-name denormalization. Also align LogCooldownSkipped
with other LogXxx signatures by taking *packagev1.PackageVersion.

* fix: Simplify audit logging for dependency cooldown skip

* refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages

* fix: Code review fixes

* fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped

---------

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>

proxy/interceptors/cooldown_test.go

@@ -4,9 +4,85 @@ import (
 	"testing"
 	"time"
 
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	pmgconfig "github.com/safedep/pmg/config"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestCooldownExemptVersions(t *testing.T) {
+	setTrustedPackagesForTest(t, []pmgconfig.TrustedPackage{
+		{Purl: "pkg:npm/pkg@2.0.0"},
+		{Purl: "pkg:npm/pkg@3.0.0"}, // both trusted and skip-listed below
+	})
+
+	now := time.Now()
+	day := 24 * time.Hour
+	dates := map[string]time.Time{
+		"1.0.0": now.Add(-1 * day),   // in window, skip-listed -> audited
+		"2.0.0": now.Add(-1 * day),   // in window, trusted -> exempt, not audited
+		"3.0.0": now.Add(-1 * day),   // in window, trusted + skip-listed -> trusted wins
+		"4.0.0": now.Add(-100 * day), // skip-listed but out of window -> not exempt
+		"5.0.0": now.Add(-1 * day),   // in window, neither -> stripped
+	}
+	skip := pmgconfig.CooldownSkipInfo{Versions: map[string]bool{
+		"1.0.0": true,
+		"3.0.0": true,
+		"4.0.0": true,
+	}}
+
+	exempt := cooldownExemptVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "pkg", skip, dates, 5)
+
+	assert.ElementsMatch(t, []string{"1.0.0", "2.0.0", "3.0.0"}, keysOf(exempt.all))
+	// Only the in-window, skip-listed, non-trusted version is audited.
+	assert.Equal(t, []string{"1.0.0"}, exempt.skipListed)
+}
+
+// An out-of-window skip-listed version, or a zero-day cooldown, must not be
+// reported as a cooldown bypass: nothing was actually within an active window.
+func TestCooldownExemptVersions_NoActiveWindow(t *testing.T) {
+	setTrustedPackagesForTest(t, nil)
+
+	now := time.Now()
+	day := 24 * time.Hour
+	dates := map[string]time.Time{"1.0.0": now.Add(-100 * day)}
+	skip := pmgconfig.CooldownSkipInfo{Versions: map[string]bool{"1.0.0": true}}
+
+	oldVersion := cooldownExemptVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "pkg", skip, dates, 5)
+	assert.Empty(t, oldVersion.skipListed)
+	assert.Empty(t, oldVersion.all)
+
+	freshDates := map[string]time.Time{"1.0.0": now.Add(-1 * day)}
+	zeroDay := cooldownExemptVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "pkg", skip, freshDates, 0)
+	assert.Empty(t, zeroDay.skipListed)
+	assert.Empty(t, zeroDay.all)
+}
+
+// A whole-package skip (version-less entry) exempts every version but must not
+// produce per-version audit events — it is a single package-level waiver.
+func TestCooldownExemptVersions_SkipAll(t *testing.T) {
+	setTrustedPackagesForTest(t, nil)
+
+	now := time.Now()
+	day := 24 * time.Hour
+	dates := map[string]time.Time{
+		"1.0.0": now.Add(-1 * day),
+		"2.0.0": now.Add(-1 * day),
+	}
+	skip := pmgconfig.CooldownSkipInfo{SkipAll: true}
+
+	exempt := cooldownExemptVersions(packagev1.Ecosystem_ECOSYSTEM_NPM, "pkg", skip, dates, 5)
+	assert.ElementsMatch(t, []string{"1.0.0", "2.0.0"}, keysOf(exempt.all))
+	assert.Empty(t, exempt.skipListed, "whole-package skip must not emit per-version events")
+}
+
+func keysOf(m map[string]bool) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
 func TestCooldownIsWithinWindow(t *testing.T) {
 	now := time.Now()
 	day := 24 * time.Hour