Adds sha checksum to composer URL

Adds SHA hash to the package json URL.
This will allow for future handling
of the sha which is currently missing from
the url.

app/presenters/packages/composer/packages_presenter.rb

@@ -11,7 +11,7 @@ module Packages
       end
 
       def root
-        path = api_v4_group___packages_composer_package_name_path({ id: @group.id, package_name: '%package%', format: '.json' }, true)
+        path = api_v4_group___packages_composer_package_name_path({ id: @group.id, package_name: '%package%$%hash%', format: '.json' }, true)
         { 'packages' => [], 'provider-includes' => { 'p/%hash%.json' => { 'sha256' => provider_sha } }, 'providers-url' => path }
       end
 

changelogs/unreleased/290288-add-sha-to-composer.yml

+---
+title: Adds sha checksum to composer URL
+merge_request: 49511
+author:
+type: added

lib/api/composer_packages.rb

@@ -38,6 +38,8 @@ module API
           packages = ::Packages::Composer::PackagesFinder.new(current_user, user_group).execute
 
           if params[:package_name].present?
+            params[:package_name], params[:sha] = params[:package_name].split('$')
+
             packages = packages.with_name(params[:package_name])
           end
 
@@ -93,6 +95,7 @@ module API
 
       get ':id/-/packages/composer/*package_name', requirements: COMPOSER_ENDPOINT_REQUIREMENTS, file_path: true do
         not_found! if packages.empty?
+        not_found! if params[:sha].blank?
 
         presenter.package_versions
       end

spec/presenters/packages/composer/packages_presenter_spec.rb

@@ -67,7 +67,7 @@ RSpec.describe ::Packages::Composer::PackagesPresenter do
       {
         'packages' => [],
         'provider-includes' => { 'p/%hash%.json' => { 'sha256' => /^\h+$/ } },
-        'providers-url' => "/api/v4/group/#{group.id}/-/packages/composer/%package%.json"
+        'providers-url' => "/api/v4/group/#{group.id}/-/packages/composer/%package%$%hash%.json"
       }
     end
 

spec/requests/api/composer_packages_spec.rb

@@ -167,7 +167,8 @@ RSpec.describe API::ComposerPackages do
 
   describe 'GET /api/v4/group/:id/-/packages/composer/*package_name.json' do
     let(:package_name) { 'foobar' }
-    let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}.json" }
+    let(:sha) { '$1234' }
+    let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}#{sha}.json" }
 
     subject { get api(url), headers: headers }
 
@@ -206,6 +207,16 @@ RSpec.describe API::ComposerPackages do
           it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
         end
       end
+
+      context 'without a sha' do
+        let(:sha) { '' }
+
+        include_context 'Composer api group access', 'PRIVATE', :developer, true do
+          include_context 'Composer user type', :developer, true do
+            it_behaves_like 'process Composer api request', :developer, :not_found, true
+          end
+        end
+      end
     end
 
     it_behaves_like 'rejects Composer access with unknown group id'