Return errors if metadata name or version do not match manifest

src/controllers/krate/publish.rs

@@ -171,6 +171,22 @@ pub async fn publish(app: AppState, req: Parts, body: Body) -> AppResult<Json<Go
     // we only accept manifests with a `package` section and without
     // inheritance.
     let package = tarball_info.manifest.package.unwrap();
+    if package.name != metadata.name {
+        let message = format!(
+            "metadata name `{}` does not match manifest name `{}`",
+            metadata.name, package.name
+        );
+        return Err(bad_request(message));
+    }
+
+    let manifest_version = package.version.map(|it| it.as_local().unwrap()).unwrap();
+    if manifest_version != metadata.vers {
+        let message = format!(
+            "metadata version `{}` does not match manifest version `{manifest_version}`",
+            metadata.vers
+        );
+        return Err(bad_request(message));
+    }
 
     let description = package.description.map(|it| it.as_local().unwrap());
     let mut license = package.license.map(|it| it.as_local().unwrap());

src/tests/krate/publish/manifest.rs

@@ -127,6 +127,30 @@ async fn invalid_manifest_missing_version() {
     assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"failed to parse `Cargo.toml` manifest file\n\nmissing field `version`"}]}"#);
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn name_mismatch() {
+    let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;
+
+    let response =
+        token.publish_crate(PublishBuilder::new("foo", "1.0.0").custom_manifest(
+            "[package]\nname = \"bar\"\nversion = \"1.0.0\"\ndescription = \"description\"\nlicense = \"MIT\"\n",
+        )).await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"metadata name `foo` does not match manifest name `bar`"}]}"#);
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn version_mismatch() {
+    let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;
+
+    let response =
+        token.publish_crate(PublishBuilder::new("foo", "1.0.0").custom_manifest(
+            "[package]\nname = \"foo\"\nversion = \"2.0.0\"\ndescription = \"description\"\nlicense = \"MIT\"\n",
+        )).await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"metadata version `1.0.0` does not match manifest version `2.0.0`"}]}"#);
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn invalid_rust_version() {
     let (_app, _anon, _cookie, token) = TestApp::full().with_token().await;