registry: enforce use of Trunk project name in download route (#504)

registry/sqlx-data.json

@@ -676,6 +676,26 @@
     },
     "query": "\n        INSERT INTO extension_owners(extension_id, owner_id, user_name, created_at, created_by)\n        VALUES ($1, $2, $3, (now() at time zone 'utc'), $2)\n        "
   },
+  "756737edb5733514dcb510266ab577703d9cf4cb7f61702d7a4a15962fc8ae87": {
+    "describe": {
+      "columns": [
+        {
+          "name": "name",
+          "ordinal": 0,
+          "type_info": "Varchar"
+        }
+      ],
+      "nullable": [
+        true
+      ],
+      "parameters": {
+        "Left": [
+          "Int8"
+        ]
+      }
+    },
+    "query": "SELECT name FROM extensions WHERE id = $1"
+  },
   "7a931ec93bcc1516737bfc65fd24b339401996a7f23891c7770a3b5b5c79ffc2": {
     "describe": {
       "columns": [

registry/src/routes/download.rs

@@ -1,4 +1,6 @@
 //! Functionality for downloading extensions and maintaining download counts
+use std::borrow::Cow;
+
 use crate::config::Config;
 use crate::download::{check_version, latest_version};
 use crate::errors::Result;
@@ -16,7 +18,7 @@ pub async fn download(
     path: web::Path<(String, String)>,
 ) -> Result<HttpResponse> {
     let (name, mut version) = path.into_inner();
-    let Ok(extension_id) = get_extension_id_fallback(&name, &conn).await else {
+    let Ok((extension_id, project_name)) = get_extension_id_and_name(&name, &conn).await else {
         return Ok(HttpResponse::NotFound().body("No extension with the given name was found"));
     };
 
@@ -30,7 +32,7 @@ pub async fn download(
             return Ok(HttpResponse::NotFound().body("Version not found"));
         }
     }
-    let url = extension_location(&cfg.bucket_name, &name, &version);
+    let url = extension_location(&cfg.bucket_name, &project_name, &version);
     info!(
         "Download requested for {} version {}. URL: {}",
         name, version, url
@@ -56,12 +58,15 @@ async fn increase_download_count(pool: &Pool<Postgres>, extension_id: i32) -> Re
 /// Given an extension name, try to find it in the `extensions` table (more common scenario).
 ///
 /// If it's not found, try to find it in `versions` under `extension_name`.
-pub async fn get_extension_id_fallback(extension_name: &str, conn: &Pool<Postgres>) -> Result<i64> {
+pub async fn get_extension_id_and_name<'n>(
+    extension_name: &'n str,
+    conn: &Pool<Postgres>,
+) -> Result<(i64, Cow<'n, str>)> {
     if let Ok(record) = sqlx::query!("SELECT id FROM extensions WHERE name = $1", extension_name)
         .fetch_one(conn)
         .await
     {
-        return Ok(record.id);
+        return Ok((record.id, extension_name.into()));
     }
 
     let record = sqlx::query!(
@@ -72,5 +77,13 @@ pub async fn get_extension_id_fallback(extension_name: &str, conn: &Pool<Postgre
     .await?;
 
     // Safe unwrap: if `extension_name` is in versions, `extension_id` must be as well
-    Ok(record.extension_id.unwrap() as i64)
+    let extension_id = record.extension_id.unwrap() as i64;
+
+    let record = sqlx::query!("SELECT name FROM extensions WHERE id = $1", extension_id)
+        .fetch_one(conn)
+        .await?;
+
+    // Safe unwrap: if the `extension` has an entry in `versions` it must have its
+    // name filled in
+    Ok((extension_id, record.name.unwrap().into()))
 }

registry/src/uploader.rs

@@ -11,16 +11,16 @@ use tracing::{debug, info};
 const CACHE_CONTROL_IMMUTABLE: &str = "public,max-age=31536000,immutable";
 
 /// Returns the internal path of an uploaded extension's version archive.
-pub fn extension_path(name: &str, version: &str) -> String {
+fn extension_path(name: &str, version: &str) -> String {
     format!("extensions/{name}/{name}-{version}.tar.gz")
 }
 
 /// Returns the URL of an uploaded extension's version archive.
 ///
 /// The function doesn't check for the existence of the file.
-pub fn extension_location(bucket_name: &str, extension_name: &str, version: &str) -> String {
+pub fn extension_location(bucket_name: &str, project_name: &str, version: &str) -> String {
     let host = format!("{bucket_name}.s3.amazonaws.com");
-    let path = extension_path(extension_name, version);
+    let path = extension_path(project_name, version);
     format!("https://{host}/{path}")
 }