From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Sun, 2 Aug 2026 20:11:51 +0900
Subject: fix(repository): resolve remaining late-binding hazards from the
 audit

Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository
hazards where inner-composition delegation skipped PHP's late-bound virtual
dispatch:

- ComposerRepository::has_package now builds its packageMap through the
  late-bound getPackages() equivalent, so lazy-providers repos surface the
  LogicException and available-packages repos load their package list, as in
  PHP, instead of silently answering false from the raw array.

- RepositoryInterface::get_repo_name returns anyhow::Result<String>: PHP's
  getRepoName() counts through the late-bound initialize(), which is fallible
  in file-reading subclasses. FilesystemRepository and PackageRepository now
  run that initialization instead of freezing the inner array repository to an
  empty state (which also made a later write() truncate installed.json).
  Supporting changes keep the initialization chain callable from &self:
  JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository
  dev_mode became a Cell, and WritableArrayRepository dev_package_names a
  RefCell.

- PlatformRepository::new routes constructor packages through its own
  add_package so the override handling and full platform initialization run
  as they do via PHP's parent constructor; the inner find_package/add_package
  delegations inside add_package (and ComposerRepository::add_package) gained
  the same is_initialized guard, since the constructor path would otherwise
  freeze the repository.

Same defect class as 7db937af, 97b5211a and 3e367f78.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../shirabe/src/repository/platform_repository.rs  | 25 ++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

(limited to 'crates/shirabe/src/repository/platform_repository.rs')

diff --git a/crates/shirabe/src/repository/platform_repository.rs b/crates/shirabe/src/repository/platform_repository.rs
index 30164237..f0d8b46e 100644
--- a/crates/shirabe/src/repository/platform_repository.rs
+++ b/crates/shirabe/src/repository/platform_repository.rs
@@ -100,14 +100,20 @@ impl PlatformRepository {
                 },
             );
         }
-        Ok(Self {
-            inner: ArrayRepository::new(packages)?,
+        // PHP: parent::__construct($packages) runs after the overrides are set, and the parent
+        // ctor's $this->addPackage() calls late-bind to PlatformRepository::addPackage.
+        let mut this = Self {
+            inner: ArrayRepository::new(vec![])?,
             version_parser: None,
             overrides: overrides_map,
             disabled_packages: IndexMap::new(),
             runtime,
             hhvm_detector,
-        })
+        };
+        for package in packages {
+            this.add_package(package)?;
+        }
+        Ok(this)
     }
 
     pub fn get_repo_name(&self) -> String {
@@ -1541,6 +1547,9 @@ impl PlatformRepository {
                 return Ok(());
             }
 
+            // PHP: $this->findPackage() reaches ArrayRepository::findPackage, whose
+            // getPackages() call late-binds to PlatformRepository::initialize.
+            self.ensure_initialized()?;
             let overrider = self.inner.find_package(
                 &name,
                 crate::repository::FindPackageConstraint::String("*".to_string()),
@@ -1583,7 +1592,9 @@ impl PlatformRepository {
             return Ok(());
         }
 
-        self.inner.add_package(package);
+        // PHP: parent::addPackage() calls the late-bound $this->initialize() before pushing.
+        self.ensure_initialized()?;
+        self.inner.add_package(package)?;
         Ok(())
     }
 
@@ -1611,6 +1622,8 @@ impl PlatformRepository {
         extra.insert("config.platform".to_string(), PhpMixed::Bool(true));
         package.inner.set_extra(extra);
         let package = CompletePackageHandle::from_complete_package(package);
+        // PHP: parent::addPackage() calls the late-bound $this->initialize() before pushing.
+        self.ensure_initialized()?;
         self.inner.add_package(package.clone().into())?;
 
         if package.get_name() == "php" {
@@ -1934,8 +1947,8 @@ impl crate::repository::RepositoryInterface for PlatformRepository {
         self.inner.get_providers(package_name)
     }
 
-    fn get_repo_name(&self) -> String {
-        PlatformRepository::get_repo_name(self)
+    fn get_repo_name(&self) -> anyhow::Result<String> {
+        Ok(PlatformRepository::get_repo_name(self))
     }
 
     fn as_any(&self) -> &dyn std::any::Any {
-- 
cgit v1.3.1