mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
c3a3518c36
* feat: Show cooldown report for pinned version installs When a user installs a package with an explicit version (e.g. npm install foo@1.2.3) and that version falls within the dependency cooldown window, the cooldown block is now recorded and shown in the report. Previously, the report only appeared when ALL versions of a package were in cooldown (remaining == 0), causing pinned version installs to fail with a confusing "version not found" error from the package manager instead of a clear cooldown explanation. Introduces InterceptorContext to carry per-execution data (pinned versions) from the CLI command through the interceptor layer, keeping it separate from long-lived dependencies like the analyzer and cache. * fix: Normalize PyPI pinned version keys for cooldown lookup CLI-provided package names (e.g. Flask_Cors) don't match the URL-parsed form (flask-cors). Normalize keys once at construction time so cooldown lookups match correctly. * fix: Handle dots in PyPI package name normalization per PEP 503 denormalizePyPIPackageName already documented [-_.] replacement but only handled underscores. Now also replaces dots with hyphens so names like zope.interface match the URL-parsed form zope-interface. * refactor: Extract shared cooldown stats recording into helper Deduplicate identical stats-recording blocks from npm_cooldown.go and pypi_cooldown.go into recordCooldownStats in cooldown.go. * fix: Distinguish explicit version pins from auto-resolved versions PyPI parsers resolve all packages to concrete versions (even without a user-specified constraint), so HasVersion() was always true. Add IsExplicitVersion to PackageInstallTarget, set it only when the user provided an explicit constraint. Use it in proxy_flow.go to avoid false pinned-version cooldown reports.
72 lines
2.6 KiB
Go
72 lines
2.6 KiB
Go
package interceptors
|
|
|
|
import "time"
|
|
|
|
// cooldownIsWithinWindow reports whether a version published at publishDate is still
|
|
// within the cooldown window of cooldownDays. Returns withinCooldown, daysSincePublish,
|
|
// and daysRemaining.
|
|
func cooldownIsWithinWindow(publishDate time.Time, cooldownDays int) (withinCooldown bool, daysSincePublish int, daysRemaining int) {
|
|
daysSincePublish = int(time.Since(publishDate).Hours() / 24)
|
|
if daysSincePublish < 0 {
|
|
daysSincePublish = 0
|
|
}
|
|
daysRemaining = cooldownDays - daysSincePublish
|
|
if daysRemaining < 0 {
|
|
daysRemaining = 0
|
|
}
|
|
return daysSincePublish < cooldownDays, daysSincePublish, daysRemaining
|
|
}
|
|
|
|
// cooldownOldestVersion returns the version with the earliest publish date.
|
|
// When all versions are in cooldown, this is the one closest to exiting the window.
|
|
func cooldownOldestVersion(dates map[string]time.Time) (string, time.Time) {
|
|
var oldest string
|
|
var oldestTime time.Time
|
|
for version, publishDate := range dates {
|
|
if oldestTime.IsZero() || publishDate.Before(oldestTime) {
|
|
oldest = version
|
|
oldestTime = publishDate
|
|
}
|
|
}
|
|
return oldest, oldestTime
|
|
}
|
|
|
|
// recordCooldownStats records a cooldown block event. When all versions are blocked
|
|
// (remaining == 0), it reports the oldest version (closest to exiting cooldown).
|
|
// Otherwise, if a pinned version was stripped, it reports that specific version.
|
|
func recordCooldownStats(statsCollector *AnalysisStatsCollector, packageName string, pinnedVersion string, dates map[string]time.Time, remaining int, cooldownDays int) {
|
|
if statsCollector == nil {
|
|
return
|
|
}
|
|
|
|
if remaining == 0 {
|
|
oldestVer, oldestDate := cooldownOldestVersion(dates)
|
|
if oldestVer != "" {
|
|
_, daysAgo, daysLeft := cooldownIsWithinWindow(oldestDate, cooldownDays)
|
|
statsCollector.RecordCooldownBlocked(packageName, oldestVer, oldestDate, daysAgo, daysLeft, cooldownDays)
|
|
}
|
|
} else if pinnedVersion != "" {
|
|
if pinnedDate, ok := dates[pinnedVersion]; ok {
|
|
if withinCooldown, daysAgo, daysLeft := cooldownIsWithinWindow(pinnedDate, cooldownDays); withinCooldown {
|
|
statsCollector.RecordCooldownBlocked(packageName, pinnedVersion, pinnedDate, daysAgo, daysLeft, cooldownDays)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// cooldownLatestEligibleVersion returns the most recently published version not in tooNew.
|
|
func cooldownLatestEligibleVersion(dates map[string]time.Time, tooNew map[string]bool) string {
|
|
var latest string
|
|
var latestTime time.Time
|
|
for version, publishDate := range dates {
|
|
if tooNew[version] {
|
|
continue
|
|
}
|
|
if publishDate.After(latestTime) {
|
|
latest = version
|
|
latestTime = publishDate
|
|
}
|
|
}
|
|
return latest
|
|
}
|