From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 2 Aug 2026 20:11:51 +0900 Subject: fix(repository): resolve remaining late-binding hazards from the audit Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository hazards where inner-composition delegation skipped PHP's late-bound virtual dispatch: - ComposerRepository::has_package now builds its packageMap through the late-bound getPackages() equivalent, so lazy-providers repos surface the LogicException and available-packages repos load their package list, as in PHP, instead of silently answering false from the raw array. - RepositoryInterface::get_repo_name returns anyhow::Result: PHP's getRepoName() counts through the late-bound initialize(), which is fallible in file-reading subclasses. FilesystemRepository and PackageRepository now run that initialization instead of freezing the inner array repository to an empty state (which also made a later write() truncate installed.json). Supporting changes keep the initialization chain callable from &self: JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository dev_mode became a Cell, and WritableArrayRepository dev_package_names a RefCell. - PlatformRepository::new routes constructor packages through its own add_package so the override handling and full platform initialization run as they do via PHP's parent constructor; the inner find_package/add_package delegations inside add_package (and ComposerRepository::add_package) gained the same is_initialized guard, since the constructor path would otherwise freeze the repository. Same defect class as 7db937af, 97b5211a and 3e367f78. Co-Authored-By: Claude Fable 5 --- crates/shirabe/src/command/bump_command.rs | 2 +- crates/shirabe/src/command/config_command.rs | 4 ++-- crates/shirabe/src/command/package_discovery_trait.rs | 2 ++ crates/shirabe/src/command/remove_command.rs | 2 +- crates/shirabe/src/command/repository_command.rs | 2 +- 5 files changed, 7 insertions(+), 5 deletions(-) (limited to 'crates/shirabe/src/command') diff --git a/crates/shirabe/src/command/bump_command.rs b/crates/shirabe/src/command/bump_command.rs index 78b1f627..a4518b0b 100644 --- a/crates/shirabe/src/command/bump_command.rs +++ b/crates/shirabe/src/command/bump_command.rs @@ -72,7 +72,7 @@ impl BumpCommand { return Ok(Self::ERROR_GENERIC); } - let mut composer_json = JsonFile::new(composer_json_path.clone(), None, None)?; + let composer_json = JsonFile::new(composer_json_path.clone(), None, None)?; let contents = match file_get_contents(composer_json.get_path()) { Some(c) => c, None => { diff --git a/crates/shirabe/src/command/config_command.rs b/crates/shirabe/src/command/config_command.rs index 7e8b82e9..129b6614 100644 --- a/crates/shirabe/src/command/config_command.rs +++ b/crates/shirabe/src/command/config_command.rs @@ -1569,7 +1569,7 @@ impl ConfigCommand { let mut config = Factory::create_config(None, None)?; // load configuration - let mut config_file = JsonFile::new( + let config_file = JsonFile::new( this.get_composer_config_file(input_handle.clone(), &config)?, None, None, @@ -1581,7 +1581,7 @@ impl ConfigCommand { } // load auth-configuration - let mut auth_config_file = JsonFile::new( + let auth_config_file = JsonFile::new( this.get_auth_config_file(input_handle.clone(), &config)?, None, None, diff --git a/crates/shirabe/src/command/package_discovery_trait.rs b/crates/shirabe/src/command/package_discovery_trait.rs index 229d84e9..cfd2d302 100644 --- a/crates/shirabe/src/command/package_discovery_trait.rs +++ b/crates/shirabe/src/command/package_discovery_trait.rs @@ -589,10 +589,12 @@ pub trait PackageDiscoveryTrait: BaseCommand { all_repos_package .get_repository() .map(|r| r.get_repo_name()) + .transpose()? .unwrap_or_default(), package .get_repository() .map(|r| r.get_repo_name()) + .transpose()? .unwrap_or_default(), ), code: 0, diff --git a/crates/shirabe/src/command/remove_command.rs b/crates/shirabe/src/command/remove_command.rs index e611542f..77deaf14 100644 --- a/crates/shirabe/src/command/remove_command.rs +++ b/crates/shirabe/src/command/remove_command.rs @@ -285,7 +285,7 @@ impl Command for RemoveCommand { let file = Factory::get_composer_file()?; - let mut json_file = JsonFile::new(file.clone(), None, None)?; + let json_file = JsonFile::new(file.clone(), None, None)?; let composer_data = json_file.read()?; let composer_backup = std::fs::read_to_string(json_file.get_path())?; diff --git a/crates/shirabe/src/command/repository_command.rs b/crates/shirabe/src/command/repository_command.rs index d23e114c..ab2cf2d4 100644 --- a/crates/shirabe/src/command/repository_command.rs +++ b/crates/shirabe/src/command/repository_command.rs @@ -165,7 +165,7 @@ impl RepositoryCommand { >, > = std::rc::Rc::new(std::cell::RefCell::new(input.clone())); let config = crate::factory::Factory::create_config(None, None)?; - let mut config_file = JsonFile::new( + let config_file = JsonFile::new( this.get_composer_config_file(input_handle, &config)?, None, None, -- cgit v1.3.1