From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Sun, 2 Aug 2026 20:11:51 +0900
Subject: fix(repository): resolve remaining late-binding hazards from the
 audit

Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository
hazards where inner-composition delegation skipped PHP's late-bound virtual
dispatch:

- ComposerRepository::has_package now builds its packageMap through the
  late-bound getPackages() equivalent, so lazy-providers repos surface the
  LogicException and available-packages repos load their package list, as in
  PHP, instead of silently answering false from the raw array.

- RepositoryInterface::get_repo_name returns anyhow::Result<String>: PHP's
  getRepoName() counts through the late-bound initialize(), which is fallible
  in file-reading subclasses. FilesystemRepository and PackageRepository now
  run that initialization instead of freezing the inner array repository to an
  empty state (which also made a later write() truncate installed.json).
  Supporting changes keep the initialization chain callable from &self:
  JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository
  dev_mode became a Cell, and WritableArrayRepository dev_package_names a
  RefCell.

- PlatformRepository::new routes constructor packages through its own
  add_package so the override handling and full platform initialization run
  as they do via PHP's parent constructor; the inner find_package/add_package
  delegations inside add_package (and ComposerRepository::add_package) gained
  the same is_initialized guard, since the constructor path would otherwise
  freeze the repository.

Same defect class as 7db937af, 97b5211a and 3e367f78.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 crates/shirabe/src/repository/installed_repository.rs | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'crates/shirabe/src/repository/installed_repository.rs')

diff --git a/crates/shirabe/src/repository/installed_repository.rs b/crates/shirabe/src/repository/installed_repository.rs
index 08b1f36b..36ad510c 100644
--- a/crates/shirabe/src/repository/installed_repository.rs
+++ b/crates/shirabe/src/repository/installed_repository.rs
@@ -367,8 +367,12 @@ impl InstalledRepository {
                 || repository.is::<RootPackageRepository>()
                 || repository.is::<PlatformRepository>(),
             "An InstalledRepository can not contain a repository of type {} ({})",
-            repository.get_repo_name(),
-            repository.get_repo_name()
+            repository
+                .get_repo_name()
+                .expect("getRepoName failed while reporting an invalid repository"),
+            repository
+                .get_repo_name()
+                .expect("getRepoName failed while reporting an invalid repository")
         );
 
         self.inner.add_repository(repository);
@@ -380,14 +384,14 @@ impl RepositoryInterface for InstalledRepository {
         self.inner.count()
     }
 
-    fn get_repo_name(&self) -> String {
+    fn get_repo_name(&self) -> anyhow::Result<String> {
         let names: Vec<String> = self
             .inner
             .get_repositories()
             .iter()
             .map(|repo| repo.get_repo_name())
-            .collect();
-        format!("installed repo ({})", names.join(", "))
+            .collect::<anyhow::Result<_>>()?;
+        Ok(format!("installed repo ({})", names.join(", ")))
     }
 
     fn has_package(&mut self, package: PackageInterfaceHandle) -> anyhow::Result<bool> {
-- 
cgit v1.3.1