fix(storage): scope update detection to the same source repo #88

Open

lucaszhongsj wants to merge 1 commit from lucaszhongsj/fix/cross-repo-update-detection into main

lucaszhongsj commented

2026-08-07 15:46:29 -05:00

(Migrated from github.com)

Problem

When the same payload exists in multiple sources, the storage page flags it as "update available" based on filename + version comparison alone, ignoring which source each side actually came from.

Two forks of the same tool — e.g. ps5-payload-dev/ftpsrv v0.21 in the official repo and drakmor/ftpsrv 1.15-ng-stable in a community source — would show up as updates of each other even though they're different codebases. Installing one would cause the other to prompt an "Update" button, and applying that "update" would silently swap fork implementations.

Fix

Match on source identity before comparing versions. Resolution order:

source.url (repository URL the payload was installed from)
source.id
source.name
Fallback: assume same source (legacy sidecar compatibility)

USB-installed payloads never participate in repo update detection.

Changes

frontend/src/utils/payloadStatus.js (new): version + source-identity matching logic
frontend/src/utils/payloadStatus.test.js (new): 8 test cases covering cross-fork, missing-identity, USB, and legacy-fallback paths
frontend/src/components/views/StorageHub.jsx: pass source_id / source_name / source_url from each catalog entry into the per-payload status resolver
frontend/package.json: add npm test script

Backward compatibility

Sidecar metadata written before multi-source support lacks source identity fields. These entries fall back to the old same-source behavior, so existing installs don't suddenly change semantics.

Test plan

cd frontend && npm test

All 8 tests pass, including:

Cross-fork same-name payload → no update shown
Same-source different version → update shown
USB install → never matches repo update
Missing source identity → falls back to same-source behavior

## Problem When the same payload exists in multiple sources, the storage page flags it as "update available" based on filename + version comparison alone, ignoring which source each side actually came from. Two forks of the same tool — e.g. `ps5-payload-dev/ftpsrv v0.21` in the official repo and `drakmor/ftpsrv 1.15-ng-stable` in a community source — would show up as updates of each other even though they're different codebases. Installing one would cause the other to prompt an "Update" button, and applying that "update" would silently swap fork implementations. ## Fix Match on source identity before comparing versions. Resolution order: 1. `source.url` (repository URL the payload was installed from) 2. `source.id` 3. `source.name` 4. Fallback: assume same source (legacy sidecar compatibility) USB-installed payloads never participate in repo update detection. ## Changes - `frontend/src/utils/payloadStatus.js` (new): version + source-identity matching logic - `frontend/src/utils/payloadStatus.test.js` (new): 8 test cases covering cross-fork, missing-identity, USB, and legacy-fallback paths - `frontend/src/components/views/StorageHub.jsx`: pass `source_id` / `source_name` / `source_url` from each catalog entry into the per-payload status resolver - `frontend/package.json`: add `npm test` script ## Backward compatibility Sidecar metadata written before multi-source support lacks source identity fields. These entries fall back to the old same-source behavior, so existing installs don't suddenly change semantics. ## Test plan ``` cd frontend && npm test ``` All 8 tests pass, including: - Cross-fork same-name payload → no update shown - Same-source different version → update shown - USB install → never matches repo update - Missing source identity → falls back to same-source behavior

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'lucaszhongsj/fix/cross-repo-update-detection:lucaszhongsj/fix/cross-repo-update-detection'

git switch 'lucaszhongsj/fix/cross-repo-update-detection'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'main'

git merge --no-ff 'lucaszhongsj/fix/cross-repo-update-detection'

git switch 'lucaszhongsj/fix/cross-repo-update-detection'

git rebase 'main'

git switch 'main'

git merge --ff-only 'lucaszhongsj/fix/cross-repo-update-detection'

git switch 'lucaszhongsj/fix/cross-repo-update-detection'

git rebase 'main'

git switch 'main'

git merge --no-ff 'lucaszhongsj/fix/cross-repo-update-detection'

git switch 'main'

git merge --squash 'lucaszhongsj/fix/cross-repo-update-detection'