fix: remediate severity-ordered review findings across cache, scanners, and proxies

- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
        goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
      cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource

All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.

pkg/scanner/scanner.go

@@ -377,7 +377,7 @@ func (m *Manager) mergeResults(results []*metadata.ScanResult, scannerNames []st
 	// Convert map to slice and count severities
 	for _, vuln := range vulnMap {
 		merged.Vulnerabilities = append(merged.Vulnerabilities, *vuln)
-		severityCounts[strings.ToUpper(vuln.Severity)]++
+		severityCounts[metadata.NormalizeSeverity(vuln.Severity)]++
 	}
 
 	// Update counts
@@ -409,6 +409,21 @@ func (m *Manager) compareSeverity(s1, s2 string) int {
 	return v1 - v2
 }
 
+// normalizeBypassPackageName reduces a stored package cache key to the
+// natural registry/package identifier used in admin bypass targets.
+// Go module packages are stored with a cache key of
+// "modulePath/@v/version.zip" (and .info/.mod variants); the admin-facing
+// target uses the bare module path, e.g. "go/github.com/foo/[email protected]".
+// npm/pypi names are stored unchanged, so this is a no-op for them.
+func normalizeBypassPackageName(registry, name string) string {
+	if registry == "go" {
+		if idx := strings.Index(name, "/@v/"); idx >= 0 {
+			return name[:idx]
+		}
+	}
+	return name
+}
+
 // CheckVulnerabilities checks if a package exceeds vulnerability thresholds
 func (m *Manager) CheckVulnerabilities(ctx context.Context, registry, packageName, version string) (bool, string, error) {
 	if !m.enabled {
@@ -423,8 +438,9 @@ func (m *Manager) CheckVulnerabilities(ctx context.Context, registry, packageNam
 	}
 
 	// Check if entire package is bypassed
-	packageKey := fmt.Sprintf("%s/%s@%s", registry, packageName, version)
-	packageKeyNoVersion := fmt.Sprintf("%s/%s", registry, packageName)
+	bypassName := normalizeBypassPackageName(registry, packageName)
+	packageKey := fmt.Sprintf("%s/%s@%s", registry, bypassName, version)
+	packageKeyNoVersion := fmt.Sprintf("%s/%s", registry, bypassName)
 
 	for _, bypass := range bypasses {
 		if bypass.Type == metadata.BypassTypePackage && bypass.Active {
@@ -499,7 +515,7 @@ func (m *Manager) CheckVulnerabilities(ctx context.Context, registry, packageNam
 				Msg("CVE bypassed by admin")
 			continue
 		}
-		severityCounts[strings.ToUpper(vuln.Severity)]++
+		severityCounts[metadata.NormalizeSeverity(vuln.Severity)]++
 	}
 
 	// Check against thresholds

pkg/scanner/scanner_test.go

@@ -254,3 +254,79 @@ func TestBroadcaster_NilBroadcasterSafe(t *testing.T) {
 	err := mgr.ScanPackage(context.Background(), "npm", "x", "1", "/tmp/dummy")
 	require.NoError(t, err)
 }
+
+// stubBypassStore returns a package bypass and a clean scan result for a
+// Go cache-key package, to exercise FIX-H4 bypass-name normalization.
+type stubBypassStore struct {
+	*stubMetadataStore
+	scan     *metadata.ScanResult
+	bypasses []*metadata.CVEBypass
+}
+
+func (m *stubBypassStore) GetActiveCVEBypasses(context.Context) ([]*metadata.CVEBypass, error) {
+	return m.bypasses, nil
+}
+
+func (m *stubBypassStore) GetScanResult(context.Context, string, string, string) (*metadata.ScanResult, error) {
+	return m.scan, nil
+}
+
+// TestCheckVulnerabilities_GoPackageBypassNaturalTarget verifies a package
+// bypass targeting the natural Go module path matches a package stored under
+// its cache-key name (modulePath/@v/version.zip).
+func TestCheckVulnerabilities_GoPackageBypassNaturalTarget(t *testing.T) {
+	store := &stubBypassStore{
+		stubMetadataStore: &stubMetadataStore{},
+		bypasses: []*metadata.CVEBypass{
+			{
+				ID:     "b1",
+				Type:   metadata.BypassTypePackage,
+				Target: "go/github.com/foo/[email protected]",
+				Active: true,
+			},
+		},
+		scan: &metadata.ScanResult{
+			ID: "r", Scanner: "stub", ScannedAt: time.Now(), Status: metadata.ScanStatusClean,
+		},
+	}
+	mgr := newTestManager(t, store)
+
+	// The package is stored under the cache-key name; the version is passed
+	// separately. The bypass target uses the natural module path.
+	blocked, reason, err := mgr.CheckVulnerabilities(
+		context.Background(), "go", "github.com/foo/bar/@v/v1.2.3.zip", "v1.2.3")
+	require.NoError(t, err)
+	assert.False(t, blocked, "package bypass should unblock the Go package")
+	assert.Equal(t, "", reason)
+}
+
+// TestCheckVulnerabilities_GoPackageBypassNotFound verifies a package bypass
+// targeting a different module does NOT unblock the Go package. Its stored
+// scan result is clean, so CheckVulnerabilities returns not-blocked anyway;
+// to make the package-block path observable we use a scan result with a
+// high-severity vulnerability and zero thresholds (block any non-zero).
+func TestCheckVulnerabilities_GoPackageBypassNotFound(t *testing.T) {
+	store := &stubBypassStore{
+		stubMetadataStore: &stubMetadataStore{},
+		bypasses: []*metadata.CVEBypass{
+			{
+				ID:     "b1",
+				Type:   metadata.BypassTypePackage,
+				Target: "go/github.com/other/[email protected]",
+				Active: true,
+			},
+		},
+		scan: &metadata.ScanResult{
+			ID: "r", Scanner: "stub", ScannedAt: time.Now(), Status: metadata.ScanStatusVulnerable,
+			Vulnerabilities: []metadata.Vulnerability{
+				{ID: "CVE-1", Severity: "HIGH"},
+			},
+		},
+	}
+	mgr := newTestManager(t, store)
+
+	blocked, _, err := mgr.CheckVulnerabilities(
+		context.Background(), "go", "github.com/foo/bar/@v/v1.2.3.zip", "v1.2.3")
+	require.NoError(t, err)
+	assert.True(t, blocked, "a non-matching bypass should not unblock the package")
+}