feat: populate time property for NPM package (#13799)

Of each version we know when it was uploaded, with that information we
can populate the `time` property. We're missing two fields (`modified`
and `created`) which we can only derive and don't really have a good
global state. The problem with deriving, any deletion would no longer be
tracker so the created time of a package could change by deleting the
oldest version. And modification time would not reflect anything was
deleted. Therefore not populating the fields, this looks to be good
enough for pnpm as it only relies on these fields if the individual
package versions' times are not populated.

Resolves forgejo/forgejo#13709

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13799
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

Author: Gusted

routers/api/packages/npm/api.go

@@ -1,4 +1,5 @@
 // Copyright 2021 The Gitea Authors. All rights reserved.
+// Copyright 2026 The Forgejo Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package npm
@@ -8,21 +9,24 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net/url"
-	"sort"
+	"slices"
+	"time"
 
 	packages_model "forgejo.org/models/packages"
 	npm_module "forgejo.org/modules/packages/npm"
 	"forgejo.org/modules/setting"
 )
 
 func createPackageMetadataResponse(registryURL string, pds []*packages_model.PackageDescriptor) *npm_module.PackageMetadata {
-	sort.Slice(pds, func(i, j int) bool {
-		return pds[i].SemVer.LessThan(pds[j].SemVer)
+	slices.SortFunc(pds, func(a, b *packages_model.PackageDescriptor) int {
+		return a.SemVer.Compare(b.SemVer)
 	})
 
+	time := make(map[string]time.Time)
 	versions := make(map[string]*npm_module.PackageMetadataVersion)
 	distTags := make(map[string]string)
 	for _, pd := range pds {
+		time[pd.SemVer.String()] = pd.Version.CreatedUnix.AsTime()
 		versions[pd.SemVer.String()] = createPackageMetadataVersion(registryURL, pd)
 
 		for _, pvp := range pd.VersionProperties {
@@ -42,6 +46,7 @@ func createPackageMetadataResponse(registryURL string, pds []*packages_model.Pac
 		DistTags:    distTags,
 		Description: metadata.Description,
 		Readme:      metadata.Readme,
+		Time:        time,
 		Homepage:    metadata.ProjectURL,
 		Author:      npm_module.User{Name: metadata.Author},
 		License:     metadata.License,

tests/integration/api_packages_npm_test.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 
 	auth_model "forgejo.org/models/auth"
 	"forgejo.org/models/db"
@@ -19,6 +20,7 @@ import (
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/packages/npm"
 	"forgejo.org/modules/setting"
+	"forgejo.org/modules/timeutil"
 	"forgejo.org/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -90,6 +92,8 @@ func TestPackageNpm(t *testing.T) {
 
 	t.Run("Upload", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
+		timeutil.MockSet(time.Unix(47176870, 0))
+		defer timeutil.MockUnset()
 
 		req := NewRequestWithBody(t, "PUT", root, strings.NewReader(buildUpload(packageVersion))).
 			AddTokenAuth(token)
@@ -186,6 +190,9 @@ func TestPackageNpm(t *testing.T) {
 		assert.Contains(t, result.DistTags, packageTag)
 		assert.Equal(t, packageVersion, result.DistTags[packageTag])
 		assert.Equal(t, packageAuthor, result.Author.Name)
+		if assert.Len(t, result.Time, 1) {
+			assert.WithinDuration(t, time.Now(), result.Time[packageVersion], time.Minute)
+		}
 		assert.Contains(t, result.Versions, packageVersion)
 		pmv := result.Versions[packageVersion]
 		assert.Equal(t, fmt.Sprintf("%s@%s", packageName, packageVersion), pmv.ID)