pulsar-edit / package-backend

Pulsar Server Backend for Packages
https://api.pulsar-edit.dev
MIT License
11 stars 11 forks source link

Add logic during version publish to ensure `repository` accuracy #170

Closed confused-Techie closed 1 year ago

confused-Techie commented 1 year ago

Requirements

Description of the Change

This PR attempts to begin addressing the possibility of a misspelled repository key, or even missing key being present in the package.json of a remote package.

Which up until now would mean the package is unavailable for future version publications, unless manual action was made to fix it on the database itself.

This PR is simple, only protecting against a missing, or totally invalid repository field. It's still possible this contains a misspelling. While ideally this could protect against that as well, unfortunately there is no simple way to access the accurate repository during the publication process. Since we rely on GitHub redirects to support any renamed repos or users, while also relying on this to support repos that have transferred names. So by checking for exact spellings could cause this functionality to break. In which case a better solution will need to be found there, or an easy way for package authors to find support.

Resolves #169