[simonchrz]

Part of #617, items 3 and 4. Draft because the filter sites wait for #533, as asked there.

• FillVersionPublishedAt stores a version's publish time without overwriting one already stored (DO UPDATE ... WHERE versions.published_at IS NULL), so the filters can call it without a read first.
• Package page: a version held back by cooldown is marked with when it becomes available. A version with no artifact row, only seen in metadata, is listed only while it is held back. That covers the rows the download checks already create.
• /api/package/{ecosystem}/{name} returns cooldown in the configuration's syntax ("3d", "0" for an exempted package), and the version response has available_at on a held-back version. Both omitempty, timestamps formatted like published_at.

One difference from your answer: a version counts as fetched when it has any artifact row, also one evicted since, so evicting a release doesn't drop it from the list.

Still to do once #533 merges: the shared helper the cooldown filters call for each version they hold back, and the calls at the filter sites. The helper also needs to create the package row, or the page of a package nobody downloaded is a 404.

Tested with the DB tests on SQLite and Postgres and a request through /ui/package/npm/lodash with fetched, held-back and expired versions.

[simonchrz]

Leaving this in draft for now to keep the review queue short. It can wait until you want it, or I'll close it if it doesn't fit.

[andrew]

Thanks, the package page side reads well, and listing metadata-only versions only while they're held back is what I was after. It's useful before #533 lands too, since the download checks already write publish times for npm, pypi, composer, go and maven.

available_at on /api/package/{ecosystem}/{name}/{version} isn't tested. TestAPIPackageCooldown calls packageCooldown directly, and nothing goes through getVersion. Please add a test through HandlePackagePath with a stubbed http.DefaultTransport, like swift_vulns_test.go does, checking that a recently published version gets cooldown and available_at in the JSON and an old one has no available_at.

FillVersionPublishedAt has no caller outside its tests yet, and its comment says the cooldown filters call it, which isn't true on this branch. I'd drop it and its tests from this PR and add them with the shared filter helper once #533 is in, so it lands with its caller.

Two comments in api.go restate the code and can go: the one on newAPIHandler and the one on apiTimeFormat.

[simonchrz]

Done in 683455a:

• TestAPIVersionAvailableAt goes through HandlePackagePath and checks that a version published an hour ago gets cooldown: "3d" and available_at, and one published four days ago has no available_at. A stubbed http.DefaultTransport doesn't reach the version lookup: the registries client clones the transport when it's built and dials through safehttp's address check. So APIHandler now takes the enrichment calls it uses as a small interface, and the test answers them with a fake.
• FillVersionPublishedAt and its test are gone.
• Removed the comments on newAPIHandler and apiTimeFormat.