Sort maven metadata results by recent file

When the maven package finder finds more than one
versionless package, it returns the one
with the most recent file.

app/finders/packages/maven/package_finder.rb

 # frozen_string_literal: true
+
 module Packages
   module Maven
     class PackageFinder
@@ -32,7 +33,17 @@ module Packages
       end
 
       def packages_with_path
-        base.only_maven_packages_with_path(path)
+        matching_packages = base.only_maven_packages_with_path(path)
+        matching_packages = matching_packages.order_by_package_file if versionless_package?(matching_packages)
+
+        matching_packages
+      end
+
+      def versionless_package?(matching_packages)
+        return if matching_packages.empty?
+
+        # if one matching package is versionless, they all are.
+        matching_packages.first&.version.nil?
       end
 
       # Produces a query that retrieves packages from a single project.

app/models/packages/package.rb

@@ -112,6 +112,7 @@ class Packages::Package < ApplicationRecord
   scope :order_project_name_desc, -> { joins(:project).reorder('projects.name DESC') }
   scope :order_project_path, -> { joins(:project).reorder('projects.path ASC, id ASC') }
   scope :order_project_path_desc, -> { joins(:project).reorder('projects.path DESC, id DESC') }
+  scope :order_by_package_file, -> { joins(:package_files).order('packages_package_files.created_at ASC') }
 
   def self.for_projects(projects)
     return none unless projects.any?

changelogs/unreleased/285334-maven-cross-group-sort.yml

+---
+title: Maven will return the most recent maven-metadata.xml file if there are multiple
+  matches accross different projects
+merge_request: 50700
+author:
+type: fixed

spec/finders/packages/maven/package_finder_spec.rb

 # frozen_string_literal: true
+
 require 'spec_helper'
 
 RSpec.describe ::Packages::Maven::PackageFinder do
@@ -52,5 +53,29 @@ RSpec.describe ::Packages::Maven::PackageFinder do
         expect { subject }.to raise_error(ActiveRecord::RecordNotFound)
       end
     end
+
+    context 'versionless maven-metadata.xml package' do
+      let_it_be(:sub_group1) { create(:group, parent: group) }
+      let_it_be(:sub_group2)   { create(:group, parent: group) }
+      let_it_be(:project1) { create(:project, group: sub_group1) }
+      let_it_be(:project2) { create(:project, group: sub_group2) }
+      let_it_be(:project3) { create(:project, group: sub_group1) }
+      let_it_be(:package_name) { 'foo' }
+      let_it_be(:package1) { create(:maven_package, project: project1, name: package_name, version: nil) }
+      let_it_be(:package2) { create(:maven_package, project: project2, name: package_name, version: nil) }
+      let_it_be(:package3) { create(:maven_package, project: project3, name: package_name, version: nil) }
+
+      let(:param_group) { group }
+      let(:param_path) { package_name }
+
+      before do
+        sub_group1.add_developer(user)
+        sub_group2.add_developer(user)
+        # the package with the most recently published file should be returned
+        create(:package_file, :xml, package: package2)
+      end
+
+      it { is_expected.to eq(package2) }
+    end
   end
 end

spec/models/packages/package_spec.rb

@@ -599,6 +599,20 @@ RSpec.describe Packages::Package, type: :model do
     end
   end
 
+  describe '.order_by_package_file' do
+    let_it_be(:project) { create(:project) }
+    let_it_be(:package1) { create(:maven_package, project: project) }
+    let_it_be(:package2) { create(:maven_package, project: project) }
+
+    it 'orders packages their associated package_file\'s created_at date', :aggregate_failures do
+      expect(project.packages.order_by_package_file).to match_array([package1, package1, package1, package2, package2, package2])
+
+      create(:package_file, :xml, package: package1)
+
+      expect(project.packages.order_by_package_file).to match_array([package1, package1, package1, package2, package2, package2, package1])
+    end
+  end
+
   describe '#versions' do
     let_it_be(:project) { create(:project) }
     let_it_be(:package) { create(:maven_package, project: project) }