Allow versionless maven-metadata file duplicates

When namespace_package_settings.maven_duplicates_allowed
is set to false, allow the versionless maven-metadata.xml
file to always be uploaded because it is added with
every version update.

app/services/packages/maven/find_or_create_package_service.rb

@@ -11,12 +11,7 @@ module Packages
                                           .execute
 
         unless Namespace::PackageSetting.duplicates_allowed?(package)
-          files = package&.package_files || []
-          current_maven_files = files.map { |file| extname(file.file_name) }
-
-          if current_maven_files.compact.include?(extname(params[:file_name]))
-            return ServiceResponse.error(message: 'Duplicate package is not allowed')
-          end
+          return ServiceResponse.error(message: 'Duplicate package is not allowed') if target_package_is_duplicate?(package)
         end
 
         unless package
@@ -67,6 +62,17 @@ module Packages
 
         File.extname(filename)
       end
+
+      def target_package_is_duplicate?(package)
+        # duplicate metadata files can be uploaded multiple times
+        return false if package.version.nil?
+
+        package
+          .package_files
+          .map { |file| extname(file.file_name) }
+          .compact
+          .include?(extname(params[:file_name]))
+      end
     end
   end
 end

changelogs/unreleased/276882-Allow-metadata-duplicates.yml

+---
+title: Allow versionless maven-metadata.xml file duplicates even when maven duplicates
+  are disabled
+merge_request: 51758
+author:
+type: fixed

spec/requests/api/maven_packages_spec.rb

@@ -32,6 +32,7 @@ RSpec.describe API::MavenPackages do
   end
 
   let(:version) { '1.0-SNAPSHOT' }
+  let(:param_path) { "#{package_name}/#{version}"}
 
   before do
     project.add_developer(user)
@@ -695,6 +696,14 @@ RSpec.describe API::MavenPackages do
           expect(json_response['message']).to include('Duplicate package is not allowed')
         end
 
+        context 'when uploading to the versionless package which contains metadata about all versions' do
+          let(:version) { nil }
+          let(:param_path) { package_name }
+          let!(:package) { create(:maven_package, project: project, version: version, name: project.full_path) }
+
+          it_behaves_like 'storing the package file'
+        end
+
         context 'when uploading different non-duplicate files to the same package' do
           let!(:package) { create(:maven_package, project: project, name: project.full_path) }
 
@@ -744,7 +753,7 @@ RSpec.describe API::MavenPackages do
     end
 
     def upload_file(params: {}, request_headers: headers, file_extension: 'jar')
-      url = "/projects/#{project.id}/packages/maven/#{package_name}/#{version}/my-app-1.0-20180724.124855-1.#{file_extension}"
+      url = "/projects/#{project.id}/packages/maven/#{param_path}/my-app-1.0-20180724.124855-1.#{file_extension}"
       workhorse_finalize(
         api(url),
         method: :put,

spec/services/packages/maven/find_or_create_package_service_spec.rb

@@ -111,6 +111,13 @@ RSpec.describe Packages::Maven::FindOrCreatePackageService do
         expect(subject.errors).to include('Duplicate package is not allowed')
       end
 
+      context 'when uploading to the versionless package which contains metadata about all versions' do
+        let(:version) { nil }
+        let(:param_path) { path }
+
+        it_behaves_like 'reuse existing package'
+      end
+
       context 'when uploading different non-duplicate files to the same package' do
         before do
           package_file = existing_package.package_files.find_by(file_name: 'my-app-1.0-20180724.124855-1.jar')