Filter out unpublished releases

tests/unit/legacy/api/test_json.py

@@ -118,6 +118,13 @@ def test_all_non_prereleases_yanked(self, monkeypatch, db_request):
         db_request.matchdict = {"name": project.normalized_name}
         assert json.latest_release_factory(db_request) == release
 
+    def test_with_unpublished(self, db_request):
+        project = ProjectFactory.create()
+        release = ReleaseFactory.create(project=project, version="1.0")
+        ReleaseFactory.create(project=project, version="2.0", published=False)
+        db_request.matchdict = {"name": project.normalized_name}
+        assert json.latest_release_factory(db_request) == release
+
     def test_project_quarantined(self, monkeypatch, db_request):
         project = ProjectFactory.create(
             lifecycle_status=LifecycleStatus.QuarantineEnter
@@ -191,6 +198,15 @@ def test_renders(self, pyramid_config, db_request, db_session):
             )
         ]
 
+        ReleaseFactory.create(
+            project=project,
+            version="3.1",
+            description=DescriptionFactory.create(
+                content_type=description_content_type
+            ),
+            published=False,
+        )
+
         for urlspec in project_urls:
             label, _, purl = urlspec.partition(",")
             db_session.add(

tests/unit/packaging/test_views.py

@@ -135,6 +135,19 @@ def test_only_yanked_release(self, monkeypatch, db_request):
         assert resp is response
         assert release_detail.calls == [pretend.call(release, db_request)]
 
+    def test_with_unpublished(self, monkeypatch, db_request):
+        project = ProjectFactory.create()
+        release = ReleaseFactory.create(project=project, version="1.0")
+        ReleaseFactory.create(project=project, version="1.1", published=False)
+
+        response = pretend.stub()
+        release_detail = pretend.call_recorder(lambda ctx, request: response)
+        monkeypatch.setattr(views, "release_detail", release_detail)
+
+        resp = views.project_detail(project, db_request)
+        assert resp is response
+        assert release_detail.calls == [pretend.call(release, db_request)]
+
 
 class TestReleaseDetail:
     def test_normalizing_name_redirects(self, db_request):
@@ -178,30 +191,45 @@ def test_normalizing_version_redirects(self, db_request):
     def test_detail_rendered(self, db_request):
         users = [UserFactory.create(), UserFactory.create(), UserFactory.create()]
         project = ProjectFactory.create()
-        releases = [
-            ReleaseFactory.create(
-                project=project,
-                version=v,
-                description=DescriptionFactory.create(
-                    raw="unrendered description",
-                    html="rendered description",
-                    content_type="text/html",
-                ),
-            )
-            for v in ["1.0", "2.0", "3.0", "4.0.dev0"]
-        ] + [
-            ReleaseFactory.create(
-                project=project,
-                version="5.0",
-                description=DescriptionFactory.create(
-                    raw="plaintext description",
-                    html="",
-                    content_type="text/plain",
-                ),
-                yanked=True,
-                yanked_reason="plaintext yanked reason",
-            )
-        ]
+        releases = (
+            [
+                ReleaseFactory.create(
+                    project=project,
+                    version=v,
+                    description=DescriptionFactory.create(
+                        raw="unrendered description",
+                        html="rendered description",
+                        content_type="text/html",
+                    ),
+                )
+                for v in ["1.0", "2.0", "3.0", "4.0.dev0"]
+            ]
+            + [
+                ReleaseFactory.create(
+                    project=project,
+                    version="5.0",
+                    description=DescriptionFactory.create(
+                        raw="plaintext description",
+                        html="",
+                        content_type="text/plain",
+                    ),
+                    yanked=True,
+                    yanked_reason="plaintext yanked reason",
+                )
+            ]
+            + [
+                ReleaseFactory.create(
+                    project=project,
+                    version="5.1",
+                    description=DescriptionFactory.create(
+                        raw="unrendered description",
+                        html="rendered description",
+                        content_type="text/html",
+                    ),
+                    published=False,
+                )
+            ]
+        )
         files = [
             FileFactory.create(
                 release=r,
@@ -226,6 +254,7 @@ def test_detail_rendered(self, db_request):
             "bdists": [],
             "description": "rendered description",
             "latest_version": project.latest_version,
+            # Non published version are not listed here
             "all_versions": [
                 (r.version, r.created, r.is_prerelease, r.yanked, r.yanked_reason)
                 for r in reversed(releases)

warehouse/legacy/api/json.py

@@ -62,7 +62,10 @@ def _json_data(request, project, release, *, all_releases):
             )
         )
         .outerjoin(File)
-        .filter(Release.project == project)
+        .filter(
+            Release.project == project,
+            Release.published.is_(True),
+        )
     )
 
     # If we're not looking for all_releases, then we'll filter this further
@@ -206,7 +209,8 @@ def latest_release_factory(request):
             .filter(
                 Project.lifecycle_status.is_distinct_from(
                     LifecycleStatus.QuarantineEnter
-                )
+                ),
+                Release.published.is_(True),
             )
             .order_by(
                 Release.yanked.asc(),

warehouse/locale/messages.pot

@@ -784,7 +784,7 @@ msgstr ""
 msgid "Provide an Inspector link to specific lines of code."
 msgstr ""
 
-#: warehouse/packaging/views.py:352
+#: warehouse/packaging/views.py:355
 msgid "Your report has been recorded. Thank you for your help."
 msgstr ""
 

warehouse/packaging/models.py

@@ -454,7 +454,11 @@ def latest_version(self):
         return (
             orm.object_session(self)
             .query(Release.version, Release.created, Release.is_prerelease)
-            .filter(Release.project == self, Release.yanked.is_(False))
+            .filter(
+                Release.project == self,
+                Release.yanked.is_(False),
+                Release.published.is_(True),
+            )
             .order_by(Release.is_prerelease.nullslast(), Release._pypi_ordering.desc())
             .first()
         )

warehouse/packaging/utils.py

@@ -53,9 +53,11 @@ def _simple_detail(project, request):
         .join(Release)
         .filter(Release.project == project)
         # Exclude projects that are in the `quarantine-enter` lifecycle status.
+        # And exclude un-published releases from the index
         .join(Project)
         .filter(
-            Project.lifecycle_status.is_distinct_from(LifecycleStatus.QuarantineEnter)
+            Project.lifecycle_status.is_distinct_from(LifecycleStatus.QuarantineEnter),
+            Release.published.is_(True),
         )
         .all(),
         key=lambda f: (packaging_legacy.version.parse(f.release.version), f.filename),

warehouse/packaging/views.py

@@ -179,7 +179,10 @@ def project_detail(project, request):
     try:
         release = (
             request.db.query(Release)
-            .filter(Release.project == project)
+            .filter(
+                Release.project == project,
+                Release.published.is_(True),
+            )
             .order_by(
                 Release.yanked,
                 Release.is_prerelease.nullslast(),