mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-11-09 07:39:19 -05:00
8ed0edb90a
npm metadata rewriting depended on handler.Proxy, which pulls SQL drivers, cloud SDKs and metrics into its import graph. Move the transformation into internal/metadata/npm with explicit policy, evaluation time, public URL and hosted-version inputs, and share the JSON scanner between npm and Composer through internal/jsonscan. Rebased onto main: rewritten tarball URLs are still logged once per document, now through an OnTarballsRewritten callback that reports the count.
46 lines
1.2 KiB
Go
46 lines
1.2 KiB
Go
package npm
|
|
|
|
import "github.com/Masterminds/semver/v3"
|
|
|
|
func (h *transformer) applyDenylistFiltering(metadata, versions map[string]any) {
|
|
denied := h.DeniedVersions
|
|
if len(denied) == 0 {
|
|
return
|
|
}
|
|
times, _ := metadata["time"].(map[string]any)
|
|
for version := range denied {
|
|
delete(versions, version)
|
|
delete(times, version)
|
|
}
|
|
tags, _ := metadata["dist-tags"].(map[string]any)
|
|
for tag, value := range tags {
|
|
version, _ := value.(string)
|
|
if !denied[version] {
|
|
continue
|
|
}
|
|
delete(tags, tag)
|
|
// Custom tags describe publisher intent; do not retarget them. For
|
|
// latest, use the highest remaining stable version, even in abbreviated
|
|
// packuments without publication timestamps.
|
|
if tag == "latest" {
|
|
if latest := newestStableNPMVersion(versions); latest != "" {
|
|
tags[tag] = latest
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func newestStableNPMVersion(versions map[string]any) string {
|
|
var best *semver.Version
|
|
result := ""
|
|
for version := range versions {
|
|
parsed, err := semver.StrictNewVersion(version)
|
|
if err != nil || parsed.Prerelease() != "" {
|
|
continue
|
|
}
|
|
if best == nil || parsed.GreaterThan(best) || (parsed.Equal(best) && version > result) {
|
|
best, result = parsed, version
|
|
}
|
|
}
|
|
return result
|
|
}
|