feat: Add PyPI dependency cooldown support (#221)

* refactor: Extract shared cooldown helpers to package-level functions

* feat: Add PyPI cooldown handler with PEP 691 file parsing

* feat: Add PyPI cooldown file stripping logic

* feat: Implement PyPI cooldown HandleMetadataRequest with PEP 691 filtering

* feat: Wire PyPI cooldown into pypi_registry interceptor

* update headers for no cache

* fix: Strip conditional GET headers to prevent 304 bypass in cooldown handlers

pip and npm clients cache Simple API / registry responses with ETags. On
subsequent requests they send If-None-Match, which causes the server to
return 304 Not Modified with no body. The cooldown response modifier
received an empty body, failed to parse it, and failed-open — letting
the client use its stale cached (unfiltered) response.

Fix: delete If-None-Match and If-Modified-Since from the request before
forwarding, forcing a full 200 response so the modifier always has a
body to filter.

Also removes the Content-Type guard from the PyPI modifier (the empty
Content-Type on 304 responses was a symptom of the same root cause) and
replaces Cache-Control: no-cache with the more targeted header deletion.

* docs: Add PyPI cooldown limitation for pip < 22.3 to dependency-cooldown docs

proxy/interceptors/pypi_registry.go

@@ -1,9 +1,12 @@
 package interceptors
 
 import (
+	"strings"
+
 	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
 	"github.com/safedep/dry/log"
 	"github.com/safedep/pmg/analyzer"
+	pmgconfig "github.com/safedep/pmg/config"
 	"github.com/safedep/pmg/proxy"
 )
 
@@ -35,6 +38,7 @@ var pypiRegistryDomains = registryConfigMap{
 // It embeds baseRegistryInterceptor to reuse ecosystem agnostic functionality
 type PypiRegistryInterceptor struct {
 	baseRegistryInterceptor
+	cooldownHandler *pypiCooldownHandler
 }
 
 var _ proxy.Interceptor = (*PypiRegistryInterceptor)(nil)
@@ -55,6 +59,7 @@ func NewPypiRegistryInterceptor(
 			confirmationChan: confirmationChan,
 			circuitBreaker:   newAnalyzerCircuitBreaker("malysis-analyzer-pypi"),
 		},
+		cooldownHandler: newPypiCooldownHandler(statsCollector),
 	}
 }
 
@@ -105,9 +110,15 @@ func (i *PypiRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*pro
 		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
 	}
 
-	// Only analyze actual file downloads (sdist or wheel)
-	// Metadata requests (Simple API or JSON API) are allowed through
 	if !pkgInfo.IsFileDownload() {
+		depCooldownConfig := pmgconfig.Get().Config.DependencyCooldown
+		// Only apply cooldown to Simple API requests (/simple/{pkg}/) — pip uses these
+		// for version resolution. JSON API requests (/pypi/{pkg}/json) are allowed through;
+		// they have a different response structure and pip does not use them for installs.
+		if depCooldownConfig.Enabled && strings.HasPrefix(ctx.URL.Path, "/simple/") {
+			return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days)
+		}
+
 		log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, pkgInfo.GetName())
 		return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
 	}