External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add proxy_install_only config to restrict proxy to download commands

Browse Source 
Introduces proxy_install_only (default: false) which, when enabled,
skips the proxy for package manager commands that do not download
packages (e.g. npm ls, pip list), avoiding unnecessary MITM overhead.

- Add ProxyInstallOnly to Config and config template
- Add IsKnownDownloadCommand / MayDownloadPackages to ParsedCommand
- Add DownloadCommands to npm and pypi PM configs covering update,
  ci, audit, dlx, exec, x, download, run and equivalents per PM
- Extract shared runner.Execute used by both proxy flow and guard
- Proxy flow short-circuits to runner.Execute for non-download commands
  when proxy_install_only=true
This commit is contained in:
Sahilb315
2026-04-13 20:15:50 +05:30
parent 887984612c
commit da098a51a8
11 changed files with 387 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packagemanager/pypi_test.go
+81
View File
@@ -1,6 +1,7 @@
package packagemanager
import (
"strings"
"testing"
"github.com/stretchr/testify/assert"
@@ -856,3 +857,83 @@ func TestPypiConvertWildcardConstraint(t *testing.T) {
})
}
}
func TestPypiDownloadCommands(t *testing.T) {
cases := []struct {
name string
pm func() (*pypiPackageManager, error)
command string
isKnownDownloadCommand bool
isInstallationCommand bool
}{
{
name: "poetry update is a known download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry update",
isKnownDownloadCommand: true,
isInstallationCommand: false,
},
{
name: "poetry add is an installation command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPoetryPackageManagerConfig()) },
command: "poetry add django",
isKnownDownloadCommand: false,
isInstallationCommand: true,
},
{
name: "uv sync is an installation command (manifest install)",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv sync",
isKnownDownloadCommand: false,
isInstallationCommand: true,
},
{
name: "pip download is a known download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip download requests",
isKnownDownloadCommand: true,
isInstallationCommand: false,
},
{
name: "pip3 download is a known download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPip3PackageManagerConfig()) },
command: "pip3 download django",
isKnownDownloadCommand: true,
isInstallationCommand: false,
},
{
name: "uv pip download is a known download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv pip download requests",
isKnownDownloadCommand: true,
isInstallationCommand: false,
},
{
name: "uv run is a known download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultUvPackageManagerConfig()) },
command: "uv run script.py",
isKnownDownloadCommand: true,
isInstallationCommand: false,
},
{
name: "pip list is not a download command",
pm: func() (*pypiPackageManager, error) { return NewPypiPackageManager(DefaultPipPackageManagerConfig()) },
command: "pip list",
isKnownDownloadCommand: false,
isInstallationCommand: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
pm, err := tc.pm()
assert.NoError(t, err)
parsed, err := pm.ParseCommand(strings.Split(tc.command, " "))
assert.NoError(t, err)
assert.Equal(t, tc.isKnownDownloadCommand, parsed.IsKnownDownloadCommand)
assert.Equal(t, tc.isInstallationCommand, parsed.IsInstallationCommand())
assert.Equal(t, tc.isKnownDownloadCommand || tc.isInstallationCommand, parsed.MayDownloadPackages())
})
}
}