feat: get rubygems owners as security-contacts

Signed-off-by: Mouad BANI <mouad-mb@outlook.com>

Author: mbani01

services/apps/packages_worker/src/security-contacts/extractors/registry/rubygems.ts

@@ -1,13 +1,12 @@
 import { ExtractorResult, ProvenanceEntry, RawContact } from '../../types'
-import { extractEmails, fetchJson, registryHeaders } from '../http'
+import { extractEmails, fetchJson, isEmail, registryHeaders } from '../http'
 
 import { ParsedPurl } from './purl'
 
 const SOURCE = 'rubygems'
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
-// RubyGems hides author emails; we can only surface emails when an author string embeds one.
 // bug_tracker_uri is an issue tracker, not a security contact, so it is intentionally skipped.
 export function mapRubygems(doc: unknown, sourceUrl: string, fetchedAt: string): RawContact[] {
   if (!doc || typeof doc !== 'object') return []
@@ -34,13 +33,64 @@ export function mapRubygems(doc: unknown, sourceUrl: string, fetchedAt: string):
   return contacts
 }
 
+export function mapRubygemsOwners(
+  owners: unknown,
+  sourceUrl: string,
+  fetchedAt: string,
+): RawContact[] {
+  if (!Array.isArray(owners)) return []
+
+  const prov = (): ProvenanceEntry[] => [
+    { source: SOURCE, sourceTier: 'B', path: sourceUrl, fetchedAt },
+  ]
+  const contacts: RawContact[] = []
+  const seen = new Set<string>()
+  for (const owner of owners) {
+    const email = owner && typeof owner === 'object' ? (owner as any).email : undefined
+    if (typeof email !== 'string' || !isEmail(email)) continue
+    const key = email.toLowerCase()
+    if (seen.has(key)) continue
+    seen.add(key)
+    const handle = typeof (owner as any).handle === 'string' ? (owner as any).handle : undefined
+    contacts.push({
+      channel: 'email',
+      value: email,
+      handle,
+      role: 'maintainer',
+      tier: 'B',
+      provenance: prov(),
+    })
+  }
+  return contacts
+}
+
 export async function fetchRubygems(
   parsed: ParsedPurl,
   timeoutMs: number,
   userAgent: string,
 ): Promise<ExtractorResult> {
-  const url = `https://rubygems.org/api/v1/gems/${encodeURIComponent(parsed.name)}.json`
-  const { json } = await fetchJson(url, timeoutMs, registryHeaders(userAgent))
-  if (!json) return { contacts: [], policies: {} }
-  return { contacts: mapRubygems(json, url, new Date().toISOString()), policies: {} }
+  const gemUrl = `https://rubygems.org/api/v1/gems/${encodeURIComponent(parsed.name)}.json`
+  const ownersUrl = `https://rubygems.org/api/v1/gems/${encodeURIComponent(parsed.name)}/owners.json`
+  const fetchedAt = new Date().toISOString()
+
+  const [gemResult, ownersResult] = await Promise.all([
+    fetchJson(gemUrl, timeoutMs, registryHeaders(userAgent)),
+    fetchJson(ownersUrl, timeoutMs, registryHeaders(userAgent)).catch(() => ({
+      status: 0,
+      json: null,
+    })),
+  ])
+
+  if (!gemResult.json) return { contacts: [], policies: {} }
+
+  const contacts = mapRubygems(gemResult.json, gemUrl, fetchedAt)
+  const seen = new Set(contacts.map((c) => c.value.toLowerCase()))
+  for (const ownerContact of mapRubygemsOwners(ownersResult.json, ownersUrl, fetchedAt)) {
+    const key = ownerContact.value.toLowerCase()
+    if (seen.has(key)) continue
+    seen.add(key)
+    contacts.push(ownerContact)
+  }
+
+  return { contacts, policies: {} }
 }