From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Sun, 2 Aug 2026 20:11:51 +0900
Subject: fix(repository): resolve remaining late-binding hazards from the
 audit

Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository
hazards where inner-composition delegation skipped PHP's late-bound virtual
dispatch:

- ComposerRepository::has_package now builds its packageMap through the
  late-bound getPackages() equivalent, so lazy-providers repos surface the
  LogicException and available-packages repos load their package list, as in
  PHP, instead of silently answering false from the raw array.

- RepositoryInterface::get_repo_name returns anyhow::Result<String>: PHP's
  getRepoName() counts through the late-bound initialize(), which is fallible
  in file-reading subclasses. FilesystemRepository and PackageRepository now
  run that initialization instead of freezing the inner array repository to an
  empty state (which also made a later write() truncate installed.json).
  Supporting changes keep the initialization chain callable from &self:
  JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository
  dev_mode became a Cell, and WritableArrayRepository dev_package_names a
  RefCell.

- PlatformRepository::new routes constructor packages through its own
  add_package so the override handling and full platform initialization run
  as they do via PHP's parent constructor; the inner find_package/add_package
  delegations inside add_package (and ComposerRepository::add_package) gained
  the same is_initialized guard, since the constructor path would otherwise
  freeze the repository.

Same defect class as 7db937af, 97b5211a and 3e367f78.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/repository/writable_array_repository.rs    | 24 ++++++++++++----------
 1 file changed, 13 insertions(+), 11 deletions(-)

(limited to 'crates/shirabe/src/repository/writable_array_repository.rs')

diff --git a/crates/shirabe/src/repository/writable_array_repository.rs b/crates/shirabe/src/repository/writable_array_repository.rs
index f5db2bd9..bd685652 100644
--- a/crates/shirabe/src/repository/writable_array_repository.rs
+++ b/crates/shirabe/src/repository/writable_array_repository.rs
@@ -13,7 +13,9 @@ use shirabe_semver::constraint::AnyConstraint;
 #[derive(Debug)]
 pub struct WritableArrayRepository {
     inner: ArrayRepository,
-    pub(crate) dev_package_names: Vec<String>,
+    // RefCell so that FilesystemRepository::initialize can stay `&self` (late-bound
+    // initialization out of shared contexts such as getRepoName).
+    pub(crate) dev_package_names: std::cell::RefCell<Vec<String>>,
     dev_mode: Option<bool>,
 }
 
@@ -21,7 +23,7 @@ impl WritableArrayRepository {
     pub fn new(packages: Vec<crate::package::PackageInterfaceHandle>) -> anyhow::Result<Self> {
         Ok(Self {
             inner: ArrayRepository::new(packages)?,
-            dev_package_names: Vec::new(),
+            dev_package_names: std::cell::RefCell::new(Vec::new()),
             dev_mode: None,
         })
     }
@@ -36,12 +38,12 @@ impl WritableArrayRepository {
         self.inner.base_count()
     }
 
-    pub fn set_dev_package_names(&mut self, dev_package_names: Vec<String>) {
-        self.dev_package_names = dev_package_names;
+    pub fn set_dev_package_names(&self, dev_package_names: Vec<String>) {
+        *self.dev_package_names.borrow_mut() = dev_package_names;
     }
 
-    pub fn get_dev_package_names(&self) -> &Vec<String> {
-        &self.dev_package_names
+    pub fn get_dev_package_names(&self) -> Vec<String> {
+        self.dev_package_names.borrow().clone()
     }
 
     pub fn write(
@@ -66,7 +68,7 @@ impl WritableArrayRepository {
     }
 
     pub fn add_package(
-        &mut self,
+        &self,
         package: crate::package::PackageInterfaceHandle,
     ) -> anyhow::Result<()> {
         self.inner.add_package(package)
@@ -84,7 +86,7 @@ impl WritableArrayRepository {
         Ok(())
     }
 
-    pub fn initialize(&mut self) -> anyhow::Result<()> {
+    pub fn initialize(&self) -> anyhow::Result<()> {
         self.inner.initialize();
         Ok(())
     }
@@ -123,8 +125,8 @@ impl WritableArrayRepository {
         self.inner.get_packages()
     }
 
-    pub fn get_repo_name(&self) -> String {
-        self.inner.get_repo_name()
+    pub fn get_repo_name(&self) -> anyhow::Result<String> {
+        RepositoryInterface::get_repo_name(&self.inner)
     }
 }
 
@@ -188,7 +190,7 @@ impl RepositoryInterface for WritableArrayRepository {
         self.inner.get_providers(package_name)
     }
 
-    fn get_repo_name(&self) -> String {
+    fn get_repo_name(&self) -> anyhow::Result<String> {
         self.inner.get_repo_name()
     }
 
-- 
cgit v1.3.1