feat(package-repository): filter advisories by affected version constraint

Implement the previously stubbed phase-b TODO so getSecurityAdvisories
skips advisories whose affected_versions do not match the requested
package constraint. Share the package VersionParser with
PartialSecurityAdvisory::create across both PackageRepository and
ComposerRepository instead of a separate semver parser instance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

3 files changed, 15 insertions, 17 deletions

diff --git a/crates/shirabe/src/advisory/partial_security_advisory.rs b/crates/shirabe/src/advisory/partial_security_advisory.rs
index c134385..8815103 100644
--- a/crates/shirabe/src/advisory/partial_security_advisory.rs
+++ b/crates/shirabe/src/advisory/partial_security_advisory.rs
@@ -2,6 +2,7 @@
 
 use crate::advisory::PartialOrFullSecurityAdvisory;
 use crate::advisory::SecurityAdvisory;
+use crate::package::version::VersionParser;
 use anyhow::Result;
 use chrono::{DateTime, TimeZone, Utc};
 use indexmap::IndexMap;
@@ -9,7 +10,6 @@ use shirabe_external_packages::composer::pcre::Preg;
 use shirabe_php_shim::{PhpMixed, UnexpectedValueException};
 use shirabe_semver::constraint::AnyConstraint;
 use shirabe_semver::constraint::SimpleConstraint;
-use shirabe_semver::version_parser::VersionParser;
 
 fn serialize_constraint<S: serde::Serializer>(
     c: &AnyConstraint,
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 5ef156c..74f1426 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -915,13 +915,12 @@ impl ComposerRepository {
         }
 
         let parser = VersionParser::new();
-        let semver_parser = shirabe_semver::version_parser::VersionParser;
         let repo_name = self.get_repo_name();
         let create = |data: &IndexMap<String, PhpMixed>,
                       name: &str,
                       package_constraint_map: &IndexMap<String, AnyConstraint>|
          -> anyhow::Result<Option<PartialOrFullSecurityAdvisory>> {
-            let advisory = PartialSecurityAdvisory::create(name, data, &semver_parser)?;
+            let advisory = PartialSecurityAdvisory::create(name, data, &parser)?;
             let is_full = matches!(advisory, PartialOrFullSecurityAdvisory::Full(_));
             if !allow_partial_advisories && !is_full {
                 let data_mixed = PhpMixed::Array(
diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index 83e13d0..c264eaf 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -92,14 +92,13 @@ impl AdvisoryProviderInterface for PackageRepository {
         allow_partial_advisories: bool,
     ) -> anyhow::Result<SecurityAdvisoryResult> {
         let parser = VersionParser::new();
-        let semver_parser = shirabe_semver::version_parser::VersionParser;
-        let _ = parser;
 
         let mut advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>> = IndexMap::new();
         for (package_name, package_advisories) in &self.security_advisories {
-            if !package_constraint_map.contains_key(package_name.as_str()) {
+            let Some(package_constraint) = package_constraint_map.get(package_name) else {
                 continue;
-            }
+            };
+
             let list = match package_advisories {
                 PhpMixed::List(list) => list,
                 _ => continue,
@@ -110,14 +109,11 @@ impl AdvisoryProviderInterface for PackageRepository {
                     PhpMixed::Array(m) => m.iter().map(|(k, v)| (k.clone(), *v.clone())).collect(),
                     _ => continue,
                 };
-                let advisory = match PartialSecurityAdvisory::create(
-                    package_name,
-                    &data_map,
-                    &semver_parser,
-                ) {
-                    Ok(a) => a,
-                    Err(_) => continue,
-                };
+                let advisory =
+                    match PartialSecurityAdvisory::create(package_name, &data_map, &parser) {
+                        Ok(a) => a,
+                        Err(_) => continue,
+                    };
                 if !allow_partial_advisories
                     && matches!(advisory, PartialOrFullSecurityAdvisory::Partial(_))
                 {
@@ -131,8 +127,11 @@ impl AdvisoryProviderInterface for PackageRepository {
                         code: 0,
                     }));
                 }
-                // TODO(phase-b): affected_versions is a method, not a field, and matches() return type may differ
-                let _ = (&advisory, &package_constraint_map);
+
+                if !advisory.affected_versions().matches(package_constraint) {
+                    continue;
+                }
+
                 items.push(advisory);
             }
             advisories.insert(package_name.clone(), items);