Merge branch '290288-add-sha-to-composer' into 'master'

Adds sha checksum to composer URL

See merge request gitlab-org/gitlab!49511

app/presenters/packages/composer/packages_presenter.rb

@@ -11,7 +11,7 @@ module Packages
       end
 
       def root
-        path = api_v4_group___packages_composer_package_name_path({ id: @group.id, package_name: '%package%', format: '.json' }, true)
+        path = api_v4_group___packages_composer_package_name_path({ id: @group.id, package_name: '%package%$%hash%', format: '.json' }, true)
         { 'packages' => [], 'provider-includes' => { 'p/%hash%.json' => { 'sha256' => provider_sha } }, 'providers-url' => path }
       end
 

changelogs/unreleased/290288-add-sha-to-composer.yml

+---
+title: Adds sha checksum to composer URL
+merge_request: 49511
+author:
+type: added

lib/api/composer_packages.rb

@@ -38,6 +38,8 @@ module API
           packages = ::Packages::Composer::PackagesFinder.new(current_user, user_group).execute
 
           if params[:package_name].present?
+            params[:package_name], params[:sha] = params[:package_name].split('$')
+
             packages = packages.with_name(params[:package_name])
           end
 
@@ -93,6 +95,7 @@ module API
 
       get ':id/-/packages/composer/*package_name', requirements: COMPOSER_ENDPOINT_REQUIREMENTS, file_path: true do
         not_found! if packages.empty?
+        not_found! if params[:sha].blank?
 
         presenter.package_versions
       end

spec/presenters/packages/composer/packages_presenter_spec.rb

@@ -67,7 +67,7 @@ RSpec.describe ::Packages::Composer::PackagesPresenter do
       {
         'packages' => [],
         'provider-includes' => { 'p/%hash%.json' => { 'sha256' => /^\h+$/ } },
-        'providers-url' => "/api/v4/group/#{group.id}/-/packages/composer/%package%.json"
+        'providers-url' => "/api/v4/group/#{group.id}/-/packages/composer/%package%$%hash%.json"
       }
     end
 

spec/requests/api/composer_packages_spec.rb

@@ -167,7 +167,8 @@ RSpec.describe API::ComposerPackages do
 
   describe 'GET /api/v4/group/:id/-/packages/composer/*package_name.json' do
     let(:package_name) { 'foobar' }
-    let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}.json" }
+    let(:sha) { '$1234' }
+    let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}#{sha}.json" }
 
     subject { get api(url), headers: headers }
 
@@ -206,6 +207,16 @@ RSpec.describe API::ComposerPackages do
           it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
         end
       end
+
+      context 'without a sha' do
+        let(:sha) { '' }
+
+        include_context 'Composer api group access', 'PRIVATE', :developer, true do
+          include_context 'Composer user type', :developer, true do
+            it_behaves_like 'process Composer api request', :developer, :not_found, true
+          end
+        end
+      end
     end
 
     it_behaves_like 'rejects Composer access with unknown group id'