Minimum package age for npm

[SanderDeclerck]

This implements the minimum package age for npm.

• Implement minimum package age filtering with non-configurable 24hrs treshold
• Configure minimum package age treshold through user tags
• Report back what has been blocked

Parsing and updating the npm info response

A few things are needed here:

• We'll need to replace the application/vnd.npm.install-v1+json request header with application/json
  • Otherwise, the response won't contain release times of the package versions.
• Remove packages that were released in the past 24 hours from the response
  • And update dist-tags that contain these versions (calculating a new latest if that one was removed)
• If the response was modified by our proxy:
  • Remove response headers that triggers caching: etag, last-modified, cache-control
  • This is done to allow the same package to be downloaded 24hrs later (etag would prevent this)
  • And to allow to --safe-chain-skip-minimum-package-age, which would not work for 5 minutes because of the cache-control

Passing preferences from safe-chain to the proxy

Safe-chain has 2 flags related to the minimum package age (and more will come):

• Threshold for suppression: --safe-chain-minimum-package-age-hours=XXX
• Don't suppress packages: --safe-chain-skip-minimum-package-age

This data will need to be passed with proxy username tags and being used by the proxy.

This can be done with user tags:

• min-pkg-age (can be set to 0 to skip the feature altogether)

Allow to report back to safe-chain

When the npm command was intercepted by safe-chain, we'll need a way to get information about:

• Were there packages suppressed
• Names of the suppressed packages

[GlenDC]

I think for proxy you are fine with just the 'min_pkg_age' flag and have that skip option be the default as it will be none anyway. But if you decide differently you can easily add the skip bool flag which can be a no value label.

Btw I noticed just now that I made a typo in the readme:

It's min_pkg_age, not min-pkg-age. '-' is the label separator.