Merge pull request #206 from strongloop-forks/dont-clobber-tags

don't blindly clobber local dist-tags

lib/storage.js

@@ -3,6 +3,7 @@
 const assert = require('assert');
 const async = require('async');
 const Error = require('http-errors');
+const semver = require('semver');
 const Stream = require('stream');
 const Local = require('./local-storage');
 const Logger = require('./logger');
@@ -589,8 +590,10 @@ class Storage {
     // refresh dist-tags
     for (let i in up['dist-tags']) {
       if (local['dist-tags'][i] !== up['dist-tags'][i]) {
-        local['dist-tags'][i] = up['dist-tags'][i];
+        if (!local['dist-tags'][i] || semver.lte(local['dist-tags'][i], up['dist-tags'][i])) {
-        if (i === 'latest') {
+          local['dist-tags'][i] = up['dist-tags'][i];
+        }
+        if (i === 'latest' && local['dist-tags'][i] === up['dist-tags'][i]) {
           // if remote has more fresh package, we should borrow its readme
           local.readme = up.readme;
         }

test/unit/st_merge.js

@@ -31,6 +31,23 @@ describe('Merge', function() {
     });
   });
 
+  it('dist-tags - staging', function() {
+    let x = {
+      versions: {},
+      // we've been locally publishing 1.1.x in preparation for the next
+      // public release
+      'dist-tags': {q:'1.1.10',w:'2.2.2'},
+    }
+    // 1.1.2 is the latest public release, but we want to continue testing
+    // against our local 1.1.10, which may end up published as 1.1.3 in the
+    // future
+    merge(x, {'dist-tags':{q:'1.1.2',w:'3.3.3',t:'4.4.4'}})
+    assert.deepEqual(x, {
+      versions: {},
+      'dist-tags': {q:'1.1.10',w:'3.3.3',t:'4.4.4'},
+    });
+  });
+
   it('semver_sort', function() {
     assert.deepEqual(semver_sort(['1.2.3', '1.2', '1.2.3a', '1.2.3c', '1.2.3-b']),
     ['1.2.3a',