1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
use std::fmt::{self, Display};

use semver::{Comparator, Op, Version, VersionReq};

pub trait VersionExt {
    fn is_prerelease(&self) -> bool;

    fn to_exact_req(&self) -> VersionReq;
}

impl VersionExt for Version {
    fn is_prerelease(&self) -> bool {
        !self.pre.is_empty()
    }

    fn to_exact_req(&self) -> VersionReq {
        VersionReq {
            comparators: vec![Comparator {
                op: Op::Exact,
                major: self.major,
                minor: Some(self.minor),
                patch: Some(self.patch),
                pre: self.pre.clone(),
            }],
        }
    }
}

#[derive(PartialEq, Eq, Hash, Clone, Debug)]
pub enum OptVersionReq {
    Any,
    Req(VersionReq),
    /// The exact locked version and the original version requirement.
    Locked(Version, VersionReq),
    /// The exact requested version and the original version requirement.
    ///
    /// This looks identical to [`OptVersionReq::Locked`] but has a different
    /// meaning, and is used for the `--precise` field of `cargo update`.
    /// See comments in [`OptVersionReq::matches`] for more.
    Precise(Version, VersionReq),
}

impl OptVersionReq {
    pub fn exact(version: &Version) -> Self {
        OptVersionReq::Req(version.to_exact_req())
    }

    // Since some registries have allowed crate versions to differ only by build metadata,
    // A query using OptVersionReq::exact return nondeterministic results.
    // So we `lock_to` the exact version were interested in.
    pub fn lock_to_exact(version: &Version) -> Self {
        OptVersionReq::Locked(version.clone(), version.to_exact_req())
    }

    pub fn is_exact(&self) -> bool {
        match self {
            OptVersionReq::Any => false,
            OptVersionReq::Req(req) | OptVersionReq::Precise(_, req) => {
                req.comparators.len() == 1 && {
                    let cmp = &req.comparators[0];
                    cmp.op == Op::Exact && cmp.minor.is_some() && cmp.patch.is_some()
                }
            }
            OptVersionReq::Locked(..) => true,
        }
    }

    pub fn lock_to(&mut self, version: &Version) {
        assert!(self.matches(version), "cannot lock {} to {}", self, version);
        use OptVersionReq::*;
        let version = version.clone();
        *self = match self {
            Any => Locked(version, VersionReq::STAR),
            Req(req) | Locked(_, req) | Precise(_, req) => Locked(version, req.clone()),
        };
    }

    /// Makes the requirement precise to the requested version.
    ///
    /// This is used for the `--precise` field of `cargo update`.
    pub fn precise_to(&mut self, version: &Version) {
        use OptVersionReq::*;
        let version = version.clone();
        *self = match self {
            Any => Precise(version, VersionReq::STAR),
            Req(req) | Locked(_, req) | Precise(_, req) => Precise(version, req.clone()),
        };
    }

    pub fn is_precise(&self) -> bool {
        matches!(self, OptVersionReq::Precise(..))
    }

    /// Gets the version to which this req is precise to, if any.
    pub fn precise_version(&self) -> Option<&Version> {
        match self {
            OptVersionReq::Precise(version, _) => Some(version),
            _ => None,
        }
    }

    pub fn is_locked(&self) -> bool {
        matches!(self, OptVersionReq::Locked(..))
    }

    /// Gets the version to which this req is locked, if any.
    pub fn locked_version(&self) -> Option<&Version> {
        match self {
            OptVersionReq::Locked(version, _) => Some(version),
            _ => None,
        }
    }

    /// An interim approach allows to update to SemVer-Compatible prerelease version.
    pub fn matches_prerelease(&self, version: &Version) -> bool {
        // Others Non `OptVersionReq::Req` have their own implementation.
        if !matches!(self, OptVersionReq::Req(_)) {
            return self.matches(version);
        }

        // TODO: In the future we have a prerelease semantic to be implemented.
        if version.is_prerelease() {
            let mut version: Version = version.clone();
            // Ignores the Prerelease tag to unlock the limit of non prerelease unpdate to prerelease.
            version.pre = semver::Prerelease::EMPTY;
            return self.matches(&version);
        }
        self.matches(version)
    }

    pub fn matches(&self, version: &Version) -> bool {
        match self {
            OptVersionReq::Any => true,
            OptVersionReq::Req(req) => req.matches(version),
            OptVersionReq::Locked(v, _) => {
                // Generally, cargo is of the opinion that semver metadata should be ignored.
                // If your registry has two versions that only differing metadata you get the bugs you deserve.
                // We also believe that lock files should ensure reproducibility
                // and protect against mutations from the registry.
                // In this circumstance these two goals are in conflict, and we pick reproducibility.
                // If the lock file tells us that there is a version called `1.0.0+bar` then
                // we should not silently use `1.0.0+foo` even though they have the same version.
                v == version
            }
            OptVersionReq::Precise(v, _) => {
                // This is used for the `--precise` field of cargo update.
                //
                // Unfortunately crates.io allowed versions to differ only
                // by build metadata. This shouldn't be allowed, but since
                // it is, this will honor it if requested.
                //
                // In that context we treat a requirement that does not have
                // build metadata as allowing any metadata. But, if a requirement
                // has build metadata, then we only allow it to match the exact
                // metadata.
                v.major == version.major
                    && v.minor == version.minor
                    && v.patch == version.patch
                    && v.pre == version.pre
                    && (v.build == version.build || v.build.is_empty())
            }
        }
    }
}

impl Display for OptVersionReq {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            OptVersionReq::Any => f.write_str("*"),
            OptVersionReq::Req(req)
            | OptVersionReq::Locked(_, req)
            | OptVersionReq::Precise(_, req) => Display::fmt(req, f),
        }
    }
}

impl From<VersionReq> for OptVersionReq {
    fn from(req: VersionReq) -> Self {
        OptVersionReq::Req(req)
    }
}

#[cfg(test)]
mod matches_prerelease {
    use semver::VersionReq;

    use super::OptVersionReq;
    use super::Version;

    #[test]
    fn prerelease() {
        // As of the writing, this test is not the final semantic of pre-release
        // semver matching. Part of the behavior is buggy. This test just tracks
        // the current behavior of the unstable `--precise <prerelease>`.
        //
        // The below transformation proposed in the RFC is hard to implement
        // outside the semver crate.
        //
        // ```
        // >=1.2.3, <2.0.0 -> >=1.2.3, <2.0.0-0
        // ```
        //
        // The upper bound semantic is also not resolved. So, at least two
        // outstanding issues are required to be fixed before the stabilization:
        //
        // * Bug 1: `x.y.z-pre.0` shouldn't match `x.y.z`.
        // * Upper bound: Whether `>=x.y.z-0, <x.y.z` should match `x.y.z-0`.
        //
        // See the RFC 3493 for the unresolved upper bound issue:
        // https://rust-lang.github.io/rfcs/3493-precise-pre-release-cargo-update.html#version-ranges-with-pre-release-upper-bounds
        let cases = [
            //
            ("1.2.3", "1.2.3-0", true), // bug, must be false
            ("1.2.3", "1.2.3-1", true), // bug, must be false
            ("1.2.3", "1.2.4-0", true),
            //
            (">=1.2.3", "1.2.3-0", true), // bug, must be false
            (">=1.2.3", "1.2.3-1", true), // bug, must be false
            (">=1.2.3", "1.2.4-0", true),
            //
            (">1.2.3", "1.2.3-0", false),
            (">1.2.3", "1.2.3-1", false),
            (">1.2.3", "1.2.4-0", true),
            //
            (">1.2.3, <1.2.4", "1.2.3-0", false),
            (">1.2.3, <1.2.4", "1.2.3-1", false),
            (">1.2.3, <1.2.4", "1.2.4-0", false), // upper bound semantic
            //
            (">=1.2.3, <1.2.4", "1.2.3-0", true), // bug, must be false
            (">=1.2.3, <1.2.4", "1.2.3-1", true), // bug, must be false
            (">=1.2.3, <1.2.4", "1.2.4-0", false), // upper bound semantic
            //
            (">1.2.3, <=1.2.4", "1.2.3-0", false),
            (">1.2.3, <=1.2.4", "1.2.3-1", false),
            (">1.2.3, <=1.2.4", "1.2.4-0", true),
            //
            (">=1.2.3-0, <1.2.3", "1.2.3-0", false), // upper bound semantic
            (">=1.2.3-0, <1.2.3", "1.2.3-1", false), // upper bound semantic
            (">=1.2.3-0, <1.2.3", "1.2.4-0", false),
        ];
        for (req, ver, expected) in cases {
            let version_req = req.parse().unwrap();
            let version = ver.parse().unwrap();
            let matched = OptVersionReq::Req(version_req).matches_prerelease(&version);
            assert_eq!(expected, matched, "req: {req}; ver: {ver}");
        }
    }

    #[test]
    fn opt_version_req_matches_prerelease() {
        let req_ver: VersionReq = "^1.2.3-rc.0".parse().unwrap();
        let to_ver: Version = "1.2.3-rc.0".parse().unwrap();

        let req = OptVersionReq::Req(req_ver.clone());
        assert!(req.matches_prerelease(&to_ver));

        let req = OptVersionReq::Locked(to_ver.clone(), req_ver.clone());
        assert!(req.matches_prerelease(&to_ver));

        let req = OptVersionReq::Precise(to_ver.clone(), req_ver.clone());
        assert!(req.matches_prerelease(&to_ver));
    }
}