forge/routers/api/packages/composer/composer.go

// Copyright 2026 Hanzo AI, Inc. All rights reserved.
// SPDX-License-Identifier: MIT

package composer

import (
	"errors"
	"io"
	"net/http"
	"net/url"
	"strconv"

	"github.com/hanzoai/git/models/db"
	packages_model "github.com/hanzoai/git/models/packages"
	"github.com/hanzoai/git/modules/optional"
	packages_module "github.com/hanzoai/git/modules/packages"
	composer_module "github.com/hanzoai/git/modules/packages/composer"
	"github.com/hanzoai/git/modules/setting"
	"github.com/hanzoai/git/modules/util"
	"github.com/hanzoai/git/routers/api/packages/helper"
	"github.com/hanzoai/git/services/context"
	"github.com/hanzoai/git/services/convert"
	packages_service "github.com/hanzoai/git/services/packages"
)

func apiError(ctx *context.Context, status int, obj any) {
	message := helper.ProcessErrorForUser(ctx, status, obj)
	type Error struct {
		Status  int    `json:"status"`
		Message string `json:"message"`
	}
	ctx.JSON(status, struct {
		Errors []Error `json:"errors"`
	}{
		Errors: []Error{
			{Status: status, Message: message},
		},
	})
}

// ServiceIndex displays registry endpoints
func ServiceIndex(ctx *context.Context) {
	resp := createServiceIndexResponse(setting.PackageRegistryURL(ctx.Package.Owner.Name, "composer"))

	ctx.JSON(http.StatusOK, resp)
}

// SearchPackages searches packages, only "q" is supported
// https://packagist.org/apidoc#search-packages
func SearchPackages(ctx *context.Context) {
	page := max(ctx.FormInt("page"), 1)
	perPage := ctx.FormInt("per_page")
	paginator := db.ListOptions{
		Page:     page,
		PageSize: convert.ToCorrectPageSize(perPage),
	}

	opts := &packages_model.PackageSearchOptions{
		OwnerID:    ctx.Package.Owner.ID,
		Type:       packages_model.TypeComposer,
		Name:       packages_model.SearchValue{Value: ctx.FormTrim("q")},
		IsInternal: optional.Some(false),
		Paginator:  &paginator,
	}
	if ctx.FormTrim("type") != "" {
		opts.Properties = map[string]string{
			composer_module.TypeProperty: ctx.FormTrim("type"),
		}
	}

	pvs, total, err := packages_model.SearchLatestVersions(ctx, opts)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	nextLink := ""
	if len(pvs) == paginator.PageSize {
		u, err := url.Parse(setting.PackageRegistryURL(ctx.Package.Owner.Name, "composer") + "/search.json")
		if err != nil {
			apiError(ctx, http.StatusInternalServerError, err)
			return
		}
		q := u.Query()
		q.Set("q", ctx.FormTrim("q"))
		q.Set("type", ctx.FormTrim("type"))
		q.Set("page", strconv.Itoa(page+1))
		if perPage != 0 {
			q.Set("per_page", strconv.Itoa(perPage))
		}
		u.RawQuery = q.Encode()

		nextLink = u.String()
	}

	pds, err := packages_model.GetPackageDescriptors(ctx, pvs)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	resp := createSearchResultResponse(total, pds, nextLink)

	ctx.JSON(http.StatusOK, resp)
}

// EnumeratePackages lists all package names
// https://packagist.org/apidoc#list-packages
func EnumeratePackages(ctx *context.Context) {
	ps, err := packages_model.GetPackagesByType(ctx, ctx.Package.Owner.ID, packages_model.TypeComposer)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	names := make([]string, 0, len(ps))
	for _, p := range ps {
		names = append(names, p.Name)
	}

	ctx.JSON(http.StatusOK, map[string][]string{
		"packageNames": names,
	})
}

// PackageMetadata returns the metadata for a single package
// https://packagist.org/apidoc#get-package-data
func PackageMetadata(ctx *context.Context) {
	vendorName := ctx.PathParam("vendorname")
	projectName := ctx.PathParam("projectname")

	pvs, err := packages_model.GetVersionsByPackageName(ctx, ctx.Package.Owner.ID, packages_model.TypeComposer, vendorName+"/"+projectName)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}
	if len(pvs) == 0 {
		apiError(ctx, http.StatusNotFound, packages_model.ErrPackageNotExist)
		return
	}

	pds, err := packages_model.GetPackageDescriptors(ctx, pvs)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	resp := createPackageMetadataResponse(
		ctx,
		setting.PackageRegistryURL(ctx.Package.Owner.Name, "composer"),
		pds,
	)

	ctx.JSON(http.StatusOK, resp)
}

// DownloadPackageFile serves the content of a package
func DownloadPackageFile(ctx *context.Context) {
	s, u, pf, err := packages_service.OpenFileForDownloadByPackageNameAndVersion(
		ctx,
		&packages_service.PackageInfo{
			Owner:       ctx.Package.Owner,
			PackageType: packages_model.TypeComposer,
			Name:        ctx.PathParam("package"),
			Version:     ctx.PathParam("version"),
		},
		&packages_service.PackageFileInfo{
			Filename: ctx.PathParam("filename"),
		},
		ctx.Req.Method,
	)
	if err != nil {
		if errors.Is(err, packages_model.ErrPackageNotExist) || errors.Is(err, packages_model.ErrPackageFileNotExist) {
			apiError(ctx, http.StatusNotFound, err)
			return
		}
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	helper.ServePackageFile(ctx, s, u, pf)
}

// UploadPackage creates a new package
func UploadPackage(ctx *context.Context) {
	buf, err := packages_module.CreateHashedBufferFromReader(ctx.Req.Body)
	if err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}
	defer buf.Close()

	cp, err := composer_module.ParsePackage(buf, ctx.FormTrim("version"))
	if err != nil {
		if errors.Is(err, util.ErrInvalidArgument) {
			apiError(ctx, http.StatusBadRequest, err)
		} else {
			apiError(ctx, http.StatusInternalServerError, err)
		}
		return
	}

	if _, err := buf.Seek(0, io.SeekStart); err != nil {
		apiError(ctx, http.StatusInternalServerError, err)
		return
	}

	if cp.Version == "" {
		// the version should be either set in the "composer.json", or as a query parameter "?version=xxx"
		apiError(ctx, http.StatusBadRequest, composer_module.ErrInvalidVersion)
		return
	}

	_, _, err = packages_service.CreatePackageAndAddFile(
		ctx,
		&packages_service.PackageCreationInfo{
			PackageInfo: packages_service.PackageInfo{
				Owner:       ctx.Package.Owner,
				PackageType: packages_model.TypeComposer,
				Name:        cp.Name,
				Version:     cp.Version,
			},
			SemverCompatible: true,
			Creator:          ctx.Doer,
			Metadata:         cp.Metadata,
			VersionProperties: map[string]string{
				composer_module.TypeProperty: cp.Type,
			},
		},
		&packages_service.PackageFileCreationInfo{
			PackageFileInfo: packages_service.PackageFileInfo{
				Filename: cp.Filename,
			},
			Creator: ctx.Doer,
			Data:    buf,
			IsLead:  true,
		},
	)
	if err != nil {
		switch err {
		case packages_model.ErrDuplicatePackageVersion:
			apiError(ctx, http.StatusConflict, err)
		case packages_service.ErrQuotaTotalCount, packages_service.ErrQuotaTypeSize, packages_service.ErrQuotaTotalSize:
			apiError(ctx, http.StatusForbidden, err)
		default:
			apiError(ctx, http.StatusInternalServerError, err)
		}
		return
	}

	ctx.Status(http.StatusCreated)
}