Project and release forms: any connector by hand, no uniqueness checks, parser bookkeeping editable

Problem

On Drupal 7 projects and releases are added by hand for connectors taking uploads only: the "add project" page needs an enabled upload connector and offers those connectors as the choice, the connector of a project cannot change afterwards, the uri of a scanned project is fixed, the project uri and the release version within a project must be unique, the home link is optional, and the release form has the version, the download link and the weight.

On 3.0.x the project form is the plain entity form: the connector is a free text field editable any time, any administrator can add projects and releases for scanning connectors, a duplicate uri ends in a storage exception, the home link is required, the parse time is editable, and the release form exposes the file hash, file date, parse time, queue time and the four counters that the parser maintains, but not the weight. Releases of scanned projects can be edited by hand.

Behind that, a connector counted as taking uploads (or as scannable) by its class alone, so the file system variant of the Drupal packages connector counted as an upload connector and its upload variant as scannable.

Proposed resolution

• Projects and releases are added by hand only when an enabled connector takes uploads, administrators included (the access handlers apply the rule in their entry points, since the admin permission bypasses the per-operation checks). Releases of projects found by scanning are not edited by hand.
• The project form offers the enabled upload connectors as radios on add and shows the connector on edit; the uri of a scanned project is fixed; the uri is unique (entity constraint); the home link is optional; the parse time is not on the form.
• The release form validates that the project's connector takes uploads and that the version is unique in the project, and only has the Drupal 7 fields plus the project and the source upload.
• A connector takes uploads through its upload source only and scans through its other sources only. A project whose connector id has no plugin (a module switched off, or a migrated id) gets no connector instead of an exception, and the connector manager skips such ids among the enabled connectors.

Tests

Drupal 7 first: L10nServerProjectFormTestCase covers the add page access, the connector choice, the duplicate uri, the fixed connector and uri, the release add access, the duplicate version and the release form fields. Ported as ProjectReleaseFormsTest, which also checks that a release of a scanned project cannot be edited and that nothing is added without an upload connector.

LLM disclosure

LLM was used to find, diagnose explain and fix this issue. With human review.