mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
c3a3518c36
* feat: Show cooldown report for pinned version installs When a user installs a package with an explicit version (e.g. npm install foo@1.2.3) and that version falls within the dependency cooldown window, the cooldown block is now recorded and shown in the report. Previously, the report only appeared when ALL versions of a package were in cooldown (remaining == 0), causing pinned version installs to fail with a confusing "version not found" error from the package manager instead of a clear cooldown explanation. Introduces InterceptorContext to carry per-execution data (pinned versions) from the CLI command through the interceptor layer, keeping it separate from long-lived dependencies like the analyzer and cache. * fix: Normalize PyPI pinned version keys for cooldown lookup CLI-provided package names (e.g. Flask_Cors) don't match the URL-parsed form (flask-cors). Normalize keys once at construction time so cooldown lookups match correctly. * fix: Handle dots in PyPI package name normalization per PEP 503 denormalizePyPIPackageName already documented [-_.] replacement but only handled underscores. Now also replaces dots with hyphens so names like zope.interface match the URL-parsed form zope-interface. * refactor: Extract shared cooldown stats recording into helper Deduplicate identical stats-recording blocks from npm_cooldown.go and pypi_cooldown.go into recordCooldownStats in cooldown.go. * fix: Distinguish explicit version pins from auto-resolved versions PyPI parsers resolve all packages to concrete versions (even without a user-specified constraint), so HasVersion() was always true. Add IsExplicitVersion to PackageInstallTarget, set it only when the user provided an explicit constraint. Use it in proxy_flow.go to avoid false pinned-version cooldown reports.
89 lines
2.5 KiB
Go
89 lines
2.5 KiB
Go
package interceptors
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
|
|
"github.com/safedep/pmg/analyzer"
|
|
"github.com/safedep/pmg/proxy"
|
|
)
|
|
|
|
// InterceptorContext carries per-execution data from the CLI command into
|
|
// the interceptor layer. Unlike the factory's long-lived dependencies
|
|
// (analyzer, cache, stats), this holds context specific to the current run.
|
|
type InterceptorContext struct {
|
|
PinnedVersions map[string]string
|
|
}
|
|
|
|
// InterceptorFactory creates ecosystem-specific interceptors for the proxy
|
|
type InterceptorFactory struct {
|
|
analyzer analyzer.PackageVersionAnalyzer
|
|
cache AnalysisCache
|
|
statsCollector *AnalysisStatsCollector
|
|
confirmationChan chan *ConfirmationRequest
|
|
execContext InterceptorContext
|
|
}
|
|
|
|
// NewInterceptorFactory creates a new interceptor factory with shared dependencies
|
|
func NewInterceptorFactory(
|
|
analyzer analyzer.PackageVersionAnalyzer,
|
|
cache AnalysisCache,
|
|
statsCollector *AnalysisStatsCollector,
|
|
confirmationChan chan *ConfirmationRequest,
|
|
execContext InterceptorContext,
|
|
) *InterceptorFactory {
|
|
return &InterceptorFactory{
|
|
analyzer: analyzer,
|
|
cache: cache,
|
|
statsCollector: statsCollector,
|
|
confirmationChan: confirmationChan,
|
|
execContext: execContext,
|
|
}
|
|
}
|
|
|
|
// CreateInterceptor creates an interceptor for the specified ecosystem
|
|
// Returns an error if the ecosystem is not supported for proxy-based interception
|
|
func (f *InterceptorFactory) CreateInterceptor(ecosystem packagev1.Ecosystem) (proxy.Interceptor, error) {
|
|
switch ecosystem {
|
|
case packagev1.Ecosystem_ECOSYSTEM_NPM:
|
|
return NewNpmRegistryInterceptor(
|
|
f.analyzer,
|
|
f.cache,
|
|
f.statsCollector,
|
|
f.confirmationChan,
|
|
f.execContext,
|
|
), nil
|
|
|
|
case packagev1.Ecosystem_ECOSYSTEM_PYPI:
|
|
return NewPypiRegistryInterceptor(
|
|
f.analyzer,
|
|
f.cache,
|
|
f.statsCollector,
|
|
f.confirmationChan,
|
|
f.execContext,
|
|
), nil
|
|
|
|
default:
|
|
return nil, fmt.Errorf("proxy-based interception not yet supported for ecosystem: %s", ecosystem.String())
|
|
}
|
|
}
|
|
|
|
// SupportedEcosystems returns a list of ecosystems that support proxy-based interception
|
|
func SupportedEcosystems() []packagev1.Ecosystem {
|
|
return []packagev1.Ecosystem{
|
|
packagev1.Ecosystem_ECOSYSTEM_NPM,
|
|
packagev1.Ecosystem_ECOSYSTEM_PYPI,
|
|
}
|
|
}
|
|
|
|
// IsSupported checks if an ecosystem supports proxy-based interception
|
|
func IsSupported(ecosystem packagev1.Ecosystem) bool {
|
|
for _, supported := range SupportedEcosystems() {
|
|
if ecosystem == supported {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|