Skip to content

Add NPM dist tags support

David Fernandez requested to merge 10io-add-npm-tag-support into master

What does this MR do?

This MR is a MR split from !14263 (closed). A partial review has been conducted there and the relevant feedback was included in this MR.

This MR will add support for package tags when npm CLI interacts with the backend. See NPM docs: https://docs.npmjs.com/cli/dist-tag.

It adds 3 url endpoints to NpmPackages for tags handling. Relevant models and services are also included. Relevant table has already been added with !15770 (merged).

In addition, a reorganization of the npm services has been done: they are now under the same namespace Packages::Npm::

See #9425 (closed) and #12403 (closed)

Additional points

Here are some points on how the tags are implemented:

  • A package tag is implemented as a generic tag with its own table packages_tags with columns package_id and simply name. Model is Packages::Tag.
  • This MR implements tags for NPM but future/current package managers will/can use them.
  • Tags for NPM have a custom behavior: they act as cursors for a given package version. In other words, given n versions of the same package, a tag will be uniquely associated with a single version.
  • Example, let's say a package has versions v1, v2 and v3. A user tags v1 with tag. When a user tags v3 with tag, the backend will untag v1 and tag v3.
  • This behavior has been implemented in a NPM custom service: Packages::Npm::CreateTagService.
  • Other package managers may have different expectations regarding tags. For example, a NuGet package has a set of tags and those can be duplicated across several versions (v1 has tag1, tag2 and tag3; v2has tag1 and tag3).

Screenshots

List all the tags within a given package:

$ npm dist-tag ls @root/bacon
latest: 1.4.0

Create a new tag:

$ npm dist-tag add @root/bacon@1.3.0 tagme
+tagme: @root/bacon@1.3.0

$ npm dist-tag ls @root/bacon
latest: 1.4.0
tagme: 1.3.0

Use the tag when install the package:

$ npm install @root/bacon@tagme
npm WARN @root/client@1.0.0 No repository field.

+ @root/bacon@1.3.0
updated 1 package in 15.692s

Remove the tag:

$ npm dist-tag rm @root/bacon tagme
-tagme: @root/bacon@1.3.0

$ npm dist-tag ls @root/bacon
latest: 1.4.0

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Database checklist

When adding migrations:

  • Updated db/schema.rb
  • Added a down method so the migration can be reverted
  • Added the output of the migration(s) to the MR body
$ r db:migrate
== 20191126134210 RenamePackagesPackageTags: migrating ========================
-- rename_table(:packages_package_tags, :packages_tags)
   -> 0.0065s
== 20191126134210 RenamePackagesPackageTags: migrated (0.0066s) ===============
  • Added tests for the migration in spec/migrations if necessary (e.g. when migrating data)
  • Added rollback procedure. Include either a rollback procedure or description how to rollback changes

When adding or modifying queries to improve performance:

  • Included data that shows the performance improvement, preferably in the form of a benchmark
  • Included the output of EXPLAIN (ANALYZE, BUFFERS) of the relevant queries

When adding foreign keys to existing tables:

  • Included a migration to remove orphaned rows in the source table before adding the foreign key
  • Removed any instances of dependent: ... that may no longer be necessary

When adding tables:

  • Ordered columns based on the Ordering Table Columns guidelines
  • Added foreign keys to any columns pointing to data in other tables
  • Added indexes for fields that are used in statements such as WHERE, ORDER BY, GROUP BY, and JOINs

When removing columns, tables, indexes or other structures:

  • Removed these in a post-deployment migration
  • Made sure the application no longer uses (or ignores) these structures
Edited by David Fernandez

Merge request reports