lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-10-22 01:37:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remediate severity-ordered review findings across cache, scanners, and proxies

Browse Source 
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
        goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
      cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource

All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
This commit is contained in:
lukaszraczylo
2026-09-04 14:24:13 +01:00
parent edeb2eca0c
commit 171386f7a7
20 changed files with 790 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/metadata/gormstore/gormstore_v2.go
+15 -1
View File
@@ -265,8 +265,22 @@ func (s *GORMStoreV2) SavePackage(ctx context.Context, pkg *metadata.Package) er
return errors.Wrap(result.Error, errors.ErrCodeStorageFailure, "failed to update package")
}
// If no rows were updated, create new record
// If no rows were updated, create new record.
// RowsAffected == 0 here means no LIVE row matches the key, because
// GORM's default scope appends `deleted_at IS NULL` to the UPDATE.
// The only possible match is a soft-deleted row (e.g. after TTL/evict
// called DeletePackage). That retained row still holds the same
// `storage_key`, which has a UNIQUE index, so a plain Create would
// collide (UNIQUE constraint failed: packages.storage_key) and the
// re-fetch would permanently 502. Hard-delete any such stale row
// before creating.
if result.RowsAffected == 0 {
if err := tx.Unscoped().
Where("registry_id = ? AND name = ? AND version = ?", registryID, pkg.Name, pkg.Version).
Delete(&PackageModel{}).Error; err != nil {
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to purge stale soft-deleted package before create")
}
if err := tx.Create(model).Error; err != nil {
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to create package")
}