update

2026-07-25 15:08:37 -05:00
parent d5faf998f4
commit e19b23de81
7 changed files with 230 additions and 54 deletions
@@ -2,6 +2,7 @@ package app

 import (
 	"crypto/sha256"
+	"database/sql"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -15,6 +16,17 @@ const uploadFormOverhead = 1 << 20

 type byteCounter int64

+type packageUploadTarget struct {
+	Slug            string
+	DisplayName     string
+	PackageName     string
+	PackageVersion  string
+	PreviousName    string
+	PreviousVersion string
+	Enabled         bool
+	Replacing       bool
+}
+
 func (counter *byteCounter) Write(value []byte) (int, error) {
 	*counter += byteCounter(len(value))
 	return len(value), nil
@@ -67,13 +79,20 @@ func (s *Server) handleUploadPackage(w http.ResponseWriter, r *http.Request) {
 			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid package filename"})
 			return
 		}
-		if err := validateUploadFields(fields); err != nil {
+		target, status, err := s.preparePackageUpload(r, fields)
+		if err != nil {
 			_ = part.Close()
-			writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			writeJSON(w, status, map[string]string{"error": err.Error()})
 			return
 		}

-		checksum, size, status, err := s.streamPackageToGitea(r, fields, fileName, part)
+		checksum, size, status, err := s.streamPackageToGitea(
+			r,
+			target.PackageName,
+			target.PackageVersion,
+			fileName,
+			part,
+		)
 		_ = part.Close()
 		if err != nil {
 			var maxBytesError *http.MaxBytesError
@@ -85,32 +104,53 @@ func (s *Server) handleUploadPackage(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		enabled := fields["enabled"] == "1"
 		if err := s.savePackage(
 			r,
-			fields["slug"],
-			fields["display_name"],
-			fields["package_name"],
-			fields["package_version"],
+			target.Slug,
+			target.DisplayName,
+			target.PackageName,
+			target.PackageVersion,
 			fileName,
 			checksum,
-			enabled,
+			target.Enabled,
 		); err != nil {
+			_ = s.deletePackageVersion(r, target.PackageName, target.PackageVersion)
 			_ = s.audit(r.Context(), "package_upload_failed", tech.Login, nil, "", fields["slug"], s.clientIP(r), err.Error())
 			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "package uploaded but catalog update failed"})
 			return
 		}
+
+		warning := ""
+		if target.Replacing {
+			if err := s.deletePackageVersion(r, target.PreviousName, target.PreviousVersion); err != nil {
+				warning = fmt.Sprintf(
+					"Package updated, but Gitea could not remove superseded version %s: %s",
+					target.PreviousVersion,
+					err,
+				)
+				_ = s.audit(
+					r.Context(),
+					"package_cleanup_failed",
+					tech.Login,
+					nil,
+					"",
+					target.Slug,
+					s.clientIP(r),
+					warning,
+				)
+			}
+		}
 		_ = s.audit(
 			r.Context(),
-			"package_uploaded",
+			map[bool]string{true: "package_updated", false: "package_uploaded"}[target.Replacing],
 			tech.Login,
 			nil,
 			"",
-			fields["slug"],
+			target.Slug,
 			s.clientIP(r),
 			fmt.Sprintf(
 				"version=%s filename=%s bytes=%d sha256=%s enabled=%t",
-				fields["package_version"], fileName, size, checksum, enabled,
+				target.PackageVersion, fileName, size, checksum, target.Enabled,
 			),
 		)
 		writeJSON(w, http.StatusCreated, map[string]any{
@@ -118,25 +158,62 @@ func (s *Server) handleUploadPackage(w http.ResponseWriter, r *http.Request) {
 			"sha256":   checksum,
 			"bytes":    size,
 			"filename": fileName,
+			"warning":  warning,
 		})
 		return
 	}
 }

-func validateUploadFields(fields map[string]string) error {
+func (s *Server) preparePackageUpload(
+	r *http.Request,
+	fields map[string]string,
+) (packageUploadTarget, int, error) {
+	var target packageUploadTarget
 	if !validSlug(fields["slug"]) {
-		return errors.New("invalid package slug")
-	}
-	if fields["display_name"] == "" || len(fields["display_name"]) > 255 {
-		return errors.New("invalid display name")
-	}
-	if !validRegistrySegment(fields["package_name"], 255) {
-		return errors.New("invalid registry package name")
+		return target, http.StatusBadRequest, errors.New("invalid package ID")
 	}
 	if !validRegistrySegment(fields["package_version"], 100) {
-		return errors.New("invalid package version")
+		return target, http.StatusBadRequest, errors.New("invalid package version")
 	}
-	return nil
+
+	target.Slug = fields["slug"]
+	target.PackageVersion = fields["package_version"]
+	target.Enabled = fields["enabled"] == "1"
+
+	err := s.db.QueryRowContext(
+		r.Context(),
+		`SELECT display_name, package_name, package_version
+		   FROM packages
+		  WHERE slug = ?`,
+		target.Slug,
+	).Scan(&target.DisplayName, &target.PackageName, &target.PreviousVersion)
+	switch {
+	case err == nil:
+		if fields["mode"] == "create" {
+			return target, http.StatusConflict, errors.New("that package ID already exists; use Update package")
+		}
+		if target.PackageVersion == target.PreviousVersion {
+			return target, http.StatusConflict, errors.New("new version must differ from the current version")
+		}
+		target.PreviousName = target.PackageName
+		target.Replacing = true
+	case errors.Is(err, sql.ErrNoRows):
+		if fields["mode"] == "update" {
+			return target, http.StatusNotFound, errors.New("package ID was not found")
+		}
+		target.DisplayName = fields["display_name"]
+		if target.DisplayName == "" || len(target.DisplayName) > 255 {
+			return target, http.StatusBadRequest, errors.New("invalid display name")
+		}
+		target.PackageName = target.Slug
+	default:
+		return target, http.StatusInternalServerError, errors.New("unable to read package catalog")
+	}
+
+	if !validRegistrySegment(target.PackageName, 255) {
+		return target, http.StatusInternalServerError, errors.New("catalog contains an invalid registry package name")
+	}
+	return target, http.StatusOK, nil
 }

 func validRegistrySegment(value string, maxLength int) bool {
@@ -157,7 +234,8 @@ func validRegistrySegment(value string, maxLength int) bool {

 func (s *Server) streamPackageToGitea(
 	r *http.Request,
-	fields map[string]string,
+	packageName string,
+	packageVersion string,
 	fileName string,
 	source io.Reader,
 ) (string, int64, int, error) {
@@ -166,8 +244,8 @@ func (s *Server) streamPackageToGitea(
 		fmt.Sprintf(
 			"/api/packages/%s/generic/%s/%s/%s",
 			url.PathEscape(s.cfg.GiteaPackageOwner),
-			url.PathEscape(fields["package_name"]),
-			url.PathEscape(fields["package_version"]),
+			url.PathEscape(packageName),
+			url.PathEscape(packageVersion),
 			url.PathEscape(fileName),
 		),
 	)
@@ -204,3 +282,40 @@ func (s *Server) streamPackageToGitea(
 	}
 	return hex.EncodeToString(hasher.Sum(nil)), int64(size), http.StatusCreated, nil
 }
+
+func (s *Server) deletePackageVersion(
+	r *http.Request,
+	packageName string,
+	packageVersion string,
+) error {
+	registryURL := joinURL(
+		s.cfg.GiteaURL,
+		fmt.Sprintf(
+			"/api/packages/%s/generic/%s/%s",
+			url.PathEscape(s.cfg.GiteaPackageOwner),
+			url.PathEscape(packageName),
+			url.PathEscape(packageVersion),
+		),
+	)
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodDelete, registryURL, nil)
+	if err != nil {
+		return errors.New("unable to prepare registry cleanup")
+	}
+	request.SetBasicAuth(s.cfg.GiteaWriteUser, s.cfg.GiteaWriteToken)
+
+	response, err := s.packageClient.Do(request)
+	if err != nil {
+		return errors.New("package registry cleanup failed")
+	}
+	defer response.Body.Close()
+	_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 8192))
+
+	switch response.StatusCode {
+	case http.StatusNoContent, http.StatusNotFound:
+		return nil
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return errors.New("package registry rejected the publisher credentials")
+	default:
+		return fmt.Errorf("package registry returned %s", response.Status)
+	}
+}