From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Sun, 2 Aug 2026 20:11:51 +0900
Subject: fix(repository): resolve remaining late-binding hazards from the
 audit

Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository
hazards where inner-composition delegation skipped PHP's late-bound virtual
dispatch:

- ComposerRepository::has_package now builds its packageMap through the
  late-bound getPackages() equivalent, so lazy-providers repos surface the
  LogicException and available-packages repos load their package list, as in
  PHP, instead of silently answering false from the raw array.

- RepositoryInterface::get_repo_name returns anyhow::Result<String>: PHP's
  getRepoName() counts through the late-bound initialize(), which is fallible
  in file-reading subclasses. FilesystemRepository and PackageRepository now
  run that initialization instead of freezing the inner array repository to an
  empty state (which also made a later write() truncate installed.json).
  Supporting changes keep the initialization chain callable from &self:
  JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository
  dev_mode became a Cell, and WritableArrayRepository dev_package_names a
  RefCell.

- PlatformRepository::new routes constructor packages through its own
  add_package so the override handling and full platform initialization run
  as they do via PHP's parent constructor; the inner find_package/add_package
  delegations inside add_package (and ComposerRepository::add_package) gained
  the same is_initialized guard, since the constructor path would otherwise
  freeze the repository.

Same defect class as 7db937af, 97b5211a and 3e367f78.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 crates/shirabe/src/dependency_resolver/problem.rs | 27 ++++++++++++-----------
 1 file changed, 14 insertions(+), 13 deletions(-)

(limited to 'crates/shirabe/src/dependency_resolver')

diff --git a/crates/shirabe/src/dependency_resolver/problem.rs b/crates/shirabe/src/dependency_resolver/problem.rs
index a944ff0c..40f21d19 100644
--- a/crates/shirabe/src/dependency_resolver/problem.rs
+++ b/crates/shirabe/src/dependency_resolver/problem.rs
@@ -907,7 +907,7 @@ impl Problem {
                 RepositorySet::ALLOW_SHADOWED_REPOSITORIES,
             )?;
             if !all_repos_packages.is_empty() {
-                return Ok(Self::compute_check_for_lower_prio_repo(
+                return Self::compute_check_for_lower_prio_repo(
                     pool,
                     is_verbose,
                     package_name,
@@ -915,7 +915,7 @@ impl Problem {
                     &all_repos_packages,
                     "minimum-stability",
                     constraint,
-                ));
+                );
             }
 
             return Ok((
@@ -950,7 +950,7 @@ impl Problem {
                 RepositorySet::ALLOW_SHADOWED_REPOSITORIES,
             )?;
             if !all_repos_packages.is_empty() {
-                return Ok(Self::compute_check_for_lower_prio_repo(
+                return Self::compute_check_for_lower_prio_repo(
                     pool,
                     is_verbose,
                     package_name,
@@ -958,7 +958,7 @@ impl Problem {
                     &all_repos_packages,
                     "constraint",
                     constraint,
-                ));
+                );
             }
 
             let mut suffix = String::new();
@@ -1267,7 +1267,7 @@ impl Problem {
         all_repos_packages: &Vec<BasePackageHandle>,
         reason: &str,
         constraint: Option<&AnyConstraint>,
-    ) -> (String, String) {
+    ) -> anyhow::Result<(String, String)> {
         let mut next_repo_packages: Vec<BasePackageHandle> = Vec::new();
         let mut next_repo: Option<crate::repository::RepositoryInterfaceHandle> = None;
         for package in all_repos_packages {
@@ -1289,7 +1289,7 @@ impl Problem {
         if !higher_repo_packages.is_empty() {
             let top_package = higher_repo_packages.first().unwrap();
             if top_package.as_root().is_some() {
-                return (
+                return Ok((
                     format!(
                         "- Root composer.json requires {}{}, it is ",
                         package_name,
@@ -1304,11 +1304,11 @@ impl Problem {
                             constraint,
                             false
                         ),
-                        next_repo.get_repo_name(),
+                        next_repo.get_repo_name()?,
                         top_package.get_pretty_name(),
                         top_package.get_pretty_version()
                     ),
-                );
+                ));
             }
         }
 
@@ -1339,7 +1339,7 @@ impl Problem {
                 }
             }
 
-            return (
+            return Ok((
                 format!(
                     "- Root composer.json requires {}{}, ",
                     package_name,
@@ -1359,10 +1359,10 @@ impl Problem {
                     if singular { "is" } else { "are" },
                     suggestion
                 ),
-            );
+            ));
         }
 
-        (
+        Ok((
             format!(
                 "- Root composer.json requires {}{}, it is ",
                 package_name,
@@ -1377,7 +1377,7 @@ impl Problem {
                     constraint,
                     false
                 ),
-                next_repo.get_repo_name(),
+                next_repo.get_repo_name()?,
                 Self::get_package_list(
                     higher_repo_packages,
                     is_verbose,
@@ -1389,10 +1389,11 @@ impl Problem {
                     .first()
                     .and_then(|p| p.get_repository())
                     .map(|r| r.get_repo_name())
+                    .transpose()?
                     .unwrap_or_default(),
                 reason
             ),
-        )
+        ))
     }
 
     /// Turns a constraint into text usable in a sentence describing a request
-- 
cgit v1.3.1