feat: verified check scanner

server/src/main/java/org/eclipse/openvsx/scanning/VSCodeGalleryExistenceCheckConfig.java

@@ -0,0 +1,100 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ ********************************************************************************/
+package org.eclipse.openvsx.scanning;
+
+import jakarta.annotation.PostConstruct;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * Configuration for {@link VSCodeGalleryExistenceCheckScanner}, extracted, to simplify testing.
+ */
+@Configuration
+public class VSCodeGalleryExistenceCheckConfig {
+    /**
+     * Is NS verification check for upstream existing extensions enabled or not.
+     * <p>
+     * Property: {@code ovsx.scanning.gallery-existence-check.enabled}
+     * Default: {@code false}
+     */
+    @Value("${ovsx.scanning.gallery-ownership.enabled:false}")
+    private boolean enabled;
+
+    /**
+     * Is NS verification check for upstream existing extensions required or not.
+     * <p>
+     * Property: {@code ovsx.scanning.gallery-existence-check.required}
+     * Default: {@code true}
+     */
+    @Value("${ovsx.scanning.gallery-ownership.required:true}")
+    private boolean required;
+
+    /**
+     * Is NS verification check for upstream existing extensions enforced or not.
+     * <p>
+     * Property: {@code ovsx.scanning.gallery-existence-check.enforced}
+     * Default: {@code true}
+     */
+    @Value("${ovsx.scanning.gallery-ownership.enforced:true}")
+    private boolean enforced;
+
+    /**
+     * The upstream gallery API URL to perform the existence checks against.
+     * <p>
+     * Property: {@code ovsx.scanning.gallery-existence-check.gallery-url}
+     * Default: {@code ""}
+     */
+    @Value("${ovsx.scanning.gallery-ownership.gallery-url:}")
+    private String galleryUrl;
+
+    /**
+     * Default constructor.
+     */
+    public VSCodeGalleryExistenceCheckConfig() {
+    }
+
+    /**
+     * For testing.
+     */
+    public VSCodeGalleryExistenceCheckConfig(boolean enabled, boolean required, boolean enforced, String galleryUrl) {
+        this.enabled = enabled;
+        this.required = required;
+        this.enforced = enforced;
+        this.galleryUrl = galleryUrl;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public boolean isRequired() {
+        return required;
+    }
+
+    public boolean isEnforced() {
+        return enforced;
+    }
+
+    public String getGalleryUrl() {
+        return galleryUrl;
+    }
+
+    @PostConstruct
+    public void validate() {
+        if (enabled) {
+            if (galleryUrl == null || galleryUrl.isEmpty()) {
+                throw new IllegalStateException("ovsx.scanning.gallery-ownership.gallery-url must be set");
+            }
+        }
+    }
+}

server/src/main/java/org/eclipse/openvsx/scanning/VSCodeGalleryExistenceCheckScanner.java

@@ -0,0 +1,171 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ ********************************************************************************/
+package org.eclipse.openvsx.scanning;
+
+import java.util.List;
+import java.util.Optional;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.persistence.EntityManager;
+import org.jspecify.annotations.NonNull;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestClientException;
+import org.springframework.web.client.RestTemplate;
+
+import org.eclipse.openvsx.adapter.ExtensionQueryParam;
+import org.eclipse.openvsx.adapter.ExtensionQueryResult;
+import org.eclipse.openvsx.adapter.IVSCodeService;
+import org.eclipse.openvsx.entities.Extension;
+import org.eclipse.openvsx.entities.ExtensionVersion;
+import org.eclipse.openvsx.repositories.RepositoryService;
+import org.eclipse.openvsx.util.NamingUtil;
+import org.eclipse.openvsx.util.UrlUtil;
+
+/**
+ * Scanner that blocks publishing to a namespace/extension identifier that already exists on the
+ * upstream VS Code Marketplace, unless the publishing NS is verified (has owner not only
+ * contributors) namespace. Guards against namespace-squatting relative to the upstream
+ * gallery identity.
+ */
+@Component
+public class VSCodeGalleryExistenceCheckScanner implements Scanner {
+
+    public static final String TYPE = "vscode-gallery-ownership";
+
+    private final VSCodeGalleryExistenceCheckConfig config;
+    private final RestTemplate restTemplate;
+    private final RepositoryService repositories;
+    private final EntityManager entityManager;
+    private final ScannerRegistry scannerRegistry;
+
+    public VSCodeGalleryExistenceCheckScanner(
+            VSCodeGalleryExistenceCheckConfig config,
+            RestTemplate restTemplate,
+            RepositoryService repositories,
+            EntityManager entityManager,
+            ScannerRegistry scannerRegistry
+    ) {
+        this.config = config;
+        this.restTemplate = restTemplate;
+        this.repositories = repositories;
+        this.entityManager = entityManager;
+        this.scannerRegistry = scannerRegistry;
+    }
+
+    @PostConstruct
+    void register() {
+        if (config.isEnabled()) {
+            scannerRegistry.registerScanner(this);
+        }
+    }
+
+    @Override
+    @NonNull
+    public String getScannerType() {
+        return TYPE;
+    }
+
+    @Override
+    public boolean isRequired() {
+        return config.isRequired();
+    }
+
+    @Override
+    public boolean enforcesThreats() {
+        return config.isEnforced();
+    }
+
+    @Override
+    public boolean isAsync() {
+        return false;
+    }
+
+    @Override
+    public Scanner.@NonNull Invocation startScan(@NonNull Command command) throws ScannerException {
+        var extVersion = entityManager.find(ExtensionVersion.class, command.extensionVersionId());
+        if (extVersion == null) {
+            throw new ScannerException("ExtensionVersion not found: " + command.extensionVersionId());
+        }
+
+        var extension = extVersion.getExtension();
+        var namespace = extension.getNamespace();
+
+        Optional<Boolean> upstreamExists = upstreamExists(extension);
+        if (upstreamExists.isEmpty()) {
+            throw new ScannerException("Failed to perform " + TYPE);
+        } else {
+            boolean upstreamDoesExists = upstreamExists.orElseThrow();
+            if (!upstreamDoesExists) {
+                return new Scanner.Invocation.Completed(Scanner.Result.clean());
+            }
+        }
+
+        var publishedWith = extVersion.getPublishedWith();
+        var user = publishedWith != null ? publishedWith.getUser() : null;
+        if (user != null && repositories.isVerified(namespace, user)) {
+            return new Scanner.Invocation.Completed(
+                    Scanner.Result.clean(
+                            "Extension exists on the VS Code Marketplace; namespace confirmed as verified."));
+        }
+
+        var threat = new Scanner.Threat(
+                "vscode-gallery-namespace-conflict",
+                "'" + NamingUtil.toExtensionId(extension) + "' already exists on the VS Code Marketplace, " +
+                        "and the publishing user is not an owner of namespace '" + namespace.getName() + "'.",
+                "high");
+        return new Scanner.Invocation.Completed(Scanner.Result.withThreats(List.of(threat)));
+    }
+
+    /**
+     * Method reaching upstream; if return Optional is empty, check is not definitive (ie. remote end is down or
+     * unreachable). It will return non-empty optional wrapped boolean only if it has definitive answer, whether
+     * remote end have or does not have extension.
+     */
+    private Optional<Boolean> upstreamExists(Extension extension) {
+        var requestUrl = UrlUtil.createApiUrl(config.getGalleryUrl(), "extensionquery");
+        var requestData = new ExtensionQueryParam(
+                List.of(
+                        new ExtensionQueryParam.Filter(
+                                List.of(
+                                        new ExtensionQueryParam.Criterion(
+                                                ExtensionQueryParam.Criterion.FILTER_TARGET,
+                                                "Microsoft.VisualStudio.Code"),
+                                        new ExtensionQueryParam.Criterion(
+                                                ExtensionQueryParam.Criterion.FILTER_EXTENSION_NAME,
+                                                NamingUtil.toExtensionId(extension))),
+                                1,
+                                1,
+                                0,
+                                0)),
+                0);
+        var headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        headers.set(HttpHeaders.ACCEPT, "application/json;api-version=" + IVSCodeService.GALLERY_API_VERSION);
+        try {
+            var result = restTemplate
+                    .postForObject(requestUrl, new HttpEntity<>(requestData, headers), ExtensionQueryResult.class);
+            if (result != null && result.results() != null && !result.results().isEmpty()) {
+                var item = result.results().getFirst();
+                if (item.extensions() != null && !item.extensions().isEmpty()) {
+                    return Optional.of(Boolean.TRUE);
+                }
+            }
+            return Optional.of(Boolean.FALSE);
+        } catch (RestClientException e) {
+            return Optional.empty(); // ie upstream is down or whatever; we have no definite answer
+        }
+    }
+}