From c42f7b6bc0533b195eb878d15b8de185e236a5f1 Mon Sep 17 00:00:00 2001
From: eth3lbert <eth3lbert+dev@gmail.com>
Date: Tue, 22 Oct 2024 19:23:40 +0800
Subject: [PATCH 1/2] models: Increase visibility of `default_versions` module

---
 src/models.rs                  | 2 +-
 src/models/default_versions.rs | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/models.rs b/src/models.rs
index f5bfb170457..08cc17b4695 100644
--- a/src/models.rs
+++ b/src/models.rs
@@ -20,7 +20,7 @@ pub mod helpers;
 mod action;
 pub mod category;
 mod crate_owner_invitation;
-mod default_versions;
+pub mod default_versions;
 pub mod dependency;
 mod download;
 mod email;
diff --git a/src/models/default_versions.rs b/src/models/default_versions.rs
index 5145e38c06a..a4bba9394db 100644
--- a/src/models/default_versions.rs
+++ b/src/models/default_versions.rs
@@ -15,11 +15,11 @@ use diesel::prelude::*;
 #[derive(Clone, Debug, PartialEq, Eq, Queryable, Selectable)]
 #[diesel(table_name = versions)]
 #[diesel(check_for_backend(diesel::pg::Pg))]
-struct Version {
-    id: i32,
+pub struct Version {
+    pub id: i32,
     #[diesel(deserialize_as = SemverVersion)]
-    num: semver::Version,
-    yanked: bool,
+    pub num: semver::Version,
+    pub yanked: bool,
 }
 
 impl Version {

From a5d24b38002150ff5c15932a550b4654a7d08cea Mon Sep 17 00:00:00 2001
From: eth3lbert <eth3lbert+dev@gmail.com>
Date: Tue, 22 Oct 2024 16:44:36 +0800
Subject: [PATCH 2/2] controllers/krate/publish: Always upsert the
 default_value

The value is determined by comparing the existing `default_value` to the
published version. This could potentially result in upserting an
outdated version. A subsequent background job is necessary to ensure
correctness and eventual consistency.
---
 src/controllers/krate/publish.rs | 65 +++++++++++++++++++++-----------
 1 file changed, 44 insertions(+), 21 deletions(-)

diff --git a/src/controllers/krate/publish.rs b/src/controllers/krate/publish.rs
index ac105c547ec..b1fcc28cf95 100644
--- a/src/controllers/krate/publish.rs
+++ b/src/controllers/krate/publish.rs
@@ -23,8 +23,8 @@ use tokio::runtime::Handle;
 use url::Url;
 
 use crate::models::{
-    insert_version_owner_action, Category, Crate, DependencyKind, Keyword, NewCrate, NewVersion,
-    Rights, VersionAction,
+    default_versions::Version as DefaultVersion, insert_version_owner_action, Category, Crate,
+    DependencyKind, Keyword, NewCrate, NewVersion, Rights, VersionAction,
 };
 
 use crate::licenses::parse_license_expr;
@@ -64,7 +64,7 @@ pub async fn publish(app: AppState, req: BytesRequest) -> AppResult<Json<GoodCra
 
     Crate::validate_crate_name("crate", &metadata.name).map_err(bad_request)?;
 
-    let version = match semver::Version::parse(&metadata.vers) {
+    let semver = match semver::Version::parse(&metadata.vers) {
         Ok(parsed) => parsed,
         Err(_) => {
             return Err(bad_request(format_args!(
@@ -75,7 +75,7 @@ pub async fn publish(app: AppState, req: BytesRequest) -> AppResult<Json<GoodCra
     };
 
     // Convert the version back to a string to deal with any inconsistencies
-    let version_string = version.to_string();
+    let version_string = semver.to_string();
 
     let request_log = req.request_log();
     request_log.add("crate_name", &*metadata.name);
@@ -385,17 +385,46 @@ pub async fn publish(app: AppState, req: BytesRequest) -> AppResult<Json<GoodCra
             // Link this new version to all dependencies
             add_dependencies(conn, &deps, version.id)?;
 
-            // Insert the default version if it doesn't already exist. Compared
-            // to only using a background job, this prevents us from getting
-            // into a situation where a crate exists in the `crates` table but
-            // doesn't have a default version in the `default_versions` table.
-            let inserted_default_versions = diesel::insert_into(default_versions::table)
-                .values((
-                    default_versions::crate_id.eq(krate.id),
-                    default_versions::version_id.eq(version.id),
-                ))
-                .on_conflict_do_nothing()
-                .execute(conn)?;
+            let existing_default_version = default_versions::table
+                .inner_join(versions::table)
+                .filter(default_versions::crate_id.eq(krate.id))
+                .select(DefaultVersion::as_select())
+                .first(conn)
+                .optional()?;
+
+            // Upsert the `default_value` determined by the existing `default_value` and the
+            // published version. Note that this could potentially write an outdated version
+            // (although this should not happen regularly), as we might be comparing to an
+            // outdated value.
+            //
+            // Compared to only using a background job, this prevents us from getting into a
+            // situation where a crate exists in the `crates` table but doesn't have a default
+            // version in the `default_versions` table.
+            if let Some(existing_default_version) = existing_default_version {
+                let published_default_version = DefaultVersion {
+                    id: version.id,
+                    num: semver,
+                    yanked: false,
+                };
+
+                if existing_default_version < published_default_version {
+                    diesel::update(default_versions::table)
+                        .filter(default_versions::crate_id.eq(krate.id))
+                        .set(default_versions::version_id.eq(version.id))
+                        .execute(conn)?;
+                }
+
+                // Update the default version asynchronously in a background job
+                // to ensure correctness and eventual consistency.
+                UpdateDefaultVersion::new(krate.id).enqueue(conn)?;
+            } else {
+                diesel::insert_into(default_versions::table)
+                    .values((
+                        default_versions::crate_id.eq(krate.id),
+                        default_versions::version_id.eq(version.id),
+                    ))
+                    .execute(conn)?;
+            }
 
             // Update all keywords for this crate
             Keyword::update_crate(conn, &krate, &keywords)?;
@@ -446,12 +475,6 @@ pub async fn publish(app: AppState, req: BytesRequest) -> AppResult<Json<GoodCra
 
             SendPublishNotificationsJob::new(version.id).enqueue(conn)?;
 
-            // If this is a new version for an existing crate it is sufficient
-            // to update the default version asynchronously in a background job.
-            if inserted_default_versions == 0 {
-                UpdateDefaultVersion::new(krate.id).enqueue(conn)?;
-            }
-
             // Experiment: check new crates for potential typosquatting.
             if existing_crate.is_none() {
                 CheckTyposquat::new(&krate.name).enqueue(conn)?;