From 64c3ea445b3a3eed70b2f4c7e3c9ef8dbccb246d Mon Sep 17 00:00:00 2001
From: Ryan Graham <r.m.graham@gmail.com>
Date: Fri, 28 Oct 2016 12:25:44 -0700
Subject: [PATCH] don't blindly clobber local dist-tags

If packages are being published to verdaccio as well as upstream to
npmjs.org, then when the cache is updated from npmjs.org it uses the
dist-tags from the upstream even if the locally published version is
actually newer. This makes it very difficult to use verdaccio as a
staging registry for testing out potential releases.

This change partially reverts a change in behaviour that was introduced
in #8 which caused a regression for the staging style workflow that was
supported by sinopia.
---
 lib/storage.js        |  7 +++++--
 test/unit/st_merge.js | 17 +++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/lib/storage.js b/lib/storage.js
index e51d13a41..954e518b8 100644
--- a/lib/storage.js
+++ b/lib/storage.js
@@ -3,6 +3,7 @@
 const assert = require('assert');
 const async = require('async');
 const Error = require('http-errors');
+const semver = require('semver');
 const Stream = require('stream');
 const Local = require('./local-storage');
 const Logger = require('./logger');
@@ -589,8 +590,10 @@ class Storage {
     // refresh dist-tags
     for (let i in up['dist-tags']) {
       if (local['dist-tags'][i] !== up['dist-tags'][i]) {
-        local['dist-tags'][i] = up['dist-tags'][i];
-        if (i === 'latest') {
+        if (!local['dist-tags'][i] || semver.lte(local['dist-tags'][i], up['dist-tags'][i])) {
+          local['dist-tags'][i] = up['dist-tags'][i];
+        }
+        if (i === 'latest' && local['dist-tags'][i] === up['dist-tags'][i]) {
           // if remote has more fresh package, we should borrow its readme
           local.readme = up.readme;
         }
diff --git a/test/unit/st_merge.js b/test/unit/st_merge.js
index 8c023be1d..29152b751 100644
--- a/test/unit/st_merge.js
+++ b/test/unit/st_merge.js
@@ -31,6 +31,23 @@ describe('Merge', function() {
     });
   });
 
+  it('dist-tags - staging', function() {
+    let x = {
+      versions: {},
+      // we've been locally publishing 1.1.x in preparation for the next
+      // public release
+      'dist-tags': {q:'1.1.10',w:'2.2.2'},
+    }
+    // 1.1.2 is the latest public release, but we want to continue testing
+    // against our local 1.1.10, which may end up published as 1.1.3 in the
+    // future
+    merge(x, {'dist-tags':{q:'1.1.2',w:'3.3.3',t:'4.4.4'}})
+    assert.deepEqual(x, {
+      versions: {},
+      'dist-tags': {q:'1.1.10',w:'3.3.3',t:'4.4.4'},
+    });
+  });
+
   it('semver_sort', function() {
     assert.deepEqual(semver_sort(['1.2.3', '1.2', '1.2.3a', '1.2.3c', '1.2.3-b']),
     ['1.2.3a',