From 7d29b5116d51a2f4ae5f90b1ef33a4b1454edebd Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Fri, 24 Jul 2026 20:23:09 +0900
Subject: fix(composer-repository): initialize wrapper before delegating
 loadPackages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For a simple, non-lazy composer repository (no providers-url/
metadata-url/providers-lazy-url), load_packages() delegates to
self.inner.load_packages() (PHP: parent::loadPackages()). PHP's
ArrayRepository::loadPackages() calls $this->getPackages(), which
virtual-dispatches through ComposerRepository::getPackages() down to
ComposerRepository::initialize() (the real HTTP/file fetch).

Composition doesn't get that dispatch for free: self.inner is a bare
ArrayRepository, so self.inner.load_packages() ends up calling
ArrayRepository::initialize() — a no-op stub that just sets an empty
package list — instead of ComposerRepository::initialize(). The
repository's packages.json fetched and parsed successfully, but the
result was silently discarded, so the repo always looked empty.

get_packages() already carries the identical guard with the same
diagnosis in its own comment; load_packages() was just missing it.
Documented the same latent gap in find_package/find_packages/count/
has_package, which call into ArrayRepository the same unguarded way
but aren't known to be exercised by any test yet.
---
 crates/shirabe/src/repository/composer_repository.rs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'crates/shirabe/src/repository')

diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 66d530c4..84d8fbf7 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -79,6 +79,15 @@ pub struct ProviderListingEntry {
 
 #[derive(Debug)]
 pub struct ComposerRepository {
+    // TODO(phase-c): PHP's ArrayRepository methods that aren't overridden here (findPackage,
+    // findPackages, count, hasPackage) call $this->getPackages(), which virtual-dispatches back
+    // to ComposerRepository::getPackages() (see its "embedded inheritance does not dispatch back
+    // to the wrapper" comment below, and the identical guard in load_packages()). Composition
+    // doesn't get that dispatch for free: self.inner.find_package()/find_packages()/count()/
+    // has_package() below call ArrayRepository::initialize() (a no-op stub) instead, and will
+    // silently see an empty package list if called before get_packages()/load_packages() has
+    // run once on this instance. Not yet known to be hit by any test; audit call sites and add
+    // the same `if !self.inner.is_initialized() { self.initialize()?; }` guard where needed.
     inner: ArrayRepository,
     /// Weak reference to the outermost repository handle wrapping this `ComposerRepository`,
     /// injected via `set_self_handle`. Used to wire package -> repository back-references.
@@ -592,6 +601,13 @@ impl ComposerRepository {
         let has_providers = self.has_providers()?;
 
         if !has_providers && !self.has_partial_packages()? && self.lazy_providers_url.is_none() {
+            // PHP relies on ArrayRepository::loadPackages() invoking the virtual getPackages()
+            // (which in turn invokes the virtual initialize()), both overridden by
+            // ComposerRepository. Embedded inheritance does not dispatch back to the wrapper, so
+            // initialize the wrapper explicitly before delegating; see get_packages() above.
+            if !self.inner.is_initialized() {
+                self.initialize()?;
+            }
             let inner_result = self.inner.load_packages(
                 package_name_map,
                 acceptable_stabilities,
-- 
cgit v1.3.1