Handle case where a requirement conflicts with required rubygems version

Author: jenshenny

app/models/version.rb

@@ -504,22 +504,45 @@ def self.platformed?(platform)
   private
 
   def content_addressable_required_rubygems_version
-    return if meets_content_addressable_rubygems_floor?
+    floor = Gem::Requirement.new(CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION).requirements.first.last
+    requirement = begin
+      Gem::Requirement.new(required_rubygems_version.presence&.split(/\s*,\s*/) || [">= 0"])
+    rescue Gem::Requirement::BadRequirementError
+      nil
+    end
 
-    errors.add(:required_rubygems_version,
-               "must be #{CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION} for content-addressable gems (set required_rubygems_version in the gemspec)")
+    if requirement.nil? || !meets_version_floor?(requirement, floor)
+      errors.add(:required_rubygems_version,
+                 "must be #{CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION} for content-addressable gems " \
+                 "(set required_rubygems_version in the gemspec)")
+    elsif conflicts_content_addressable_rubygems_floor?(requirement, floor)
+      errors.add(:required_rubygems_version,
+                 "must not conflict with RubyGems #{CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION} required to install content-addressable gems " \
+                 "(remove or loosen the conflicting constraint in the gemspec)")
+    end
   end
 
-  def meets_content_addressable_rubygems_floor?
-    floor = Gem::Requirement.new(CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION)
-    requirements = required_rubygems_version.presence&.split(/\s*,\s*/) || [">= 0"]
-    requirement = Gem::Requirement.new(requirements)
+  def meets_version_floor?(requirement, floor)
+    requirement.requirements.any? do |operator, version|
+      [">=", "~>", "=", ">"].include?(operator) && version >= floor
+    end
+  end
 
-    requirement.requirements.any? do |operator, required_version|
-      [">=", "~>", "=", ">"].include?(operator) && floor.satisfied_by?(required_version)
+  def conflicts_version_floor?(requirement, floor)
+    conflict = requirement.requirements.any? do |operator, version|
+      case operator
+      when "<" then version <= floor
+      when "<=", "=" then version < floor
+      when "~>" then version.bump <= floor.release
+      else false
+      end
+    end
+
+    return true if conflict
+
+    !requirement.satisfied_by?(floor) && requirement.requirements.any? do |operator, version|
+      ["<=", "="].include?(operator) && version == floor
     end
-  rescue Gem::Requirement::BadRequirementError
-    false
   end
 
   def update_prerelease

test/integration/pusher_test.rb

@@ -543,6 +543,22 @@ def two_cert_chain(signing_key:, root_not_before: Time.current, cert_not_before:
                       "must be #{Version::CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION} " \
                       "for content-addressable gems (set required_rubygems_version in the gemspec)"
     end
+
+    should "reject with 403 when required_rubygems_version conflicts with the floor" do
+      FeatureFlag.enable_for_actor(FeatureFlag::CONTENT_ADDRESSABLE_GEM_PUSHES, @user)
+      spec = new_gemspec("ca-floor-conflict", "1.0.0", "CA floor test", "arm64-darwin-25",
+                        ruby_version: "~> 3.4.0",
+                        rubygems_version: [">= 4.2", "< 4.1.0.a"])
+      cutter = Pusher.new(@api_key, build_gem(spec))
+      cutter.logger.level = :info
+
+      assert cutter.pull_spec
+      assert cutter.find
+      refute cutter.validate
+
+      assert_equal 403, cutter.code
+      assert_includes cutter.message, "must not conflict with RubyGems #{Version::CONTENT_ADDRESSABLE_REQUIRED_RUBYGEMS_VERSION}"
+    end
   end
 
   context "pushing a new version" do

test/models/version_test.rb

@@ -929,6 +929,36 @@ class VersionTest < ActiveSupport::TestCase
         assert_predicate @content_addressable_version, :valid?
       end
 
+      should "be invalid when an upper bound excludes the floor despite a satisfying lower bound" do
+        @content_addressable_version.required_rubygems_version = ">= 4.2, < 4.1.0.a"
+
+        refute_predicate @content_addressable_version, :valid?
+      end
+
+      should "be invalid when a <= upper bound excludes the floor despite a satisfying lower bound" do
+        @content_addressable_version.required_rubygems_version = ">= 4.2, <= 4.0"
+
+        refute_predicate @content_addressable_version, :valid?
+      end
+
+      should "be invalid when a ~> constraint caps the requirement below the floor" do
+        @content_addressable_version.required_rubygems_version = ">= 4.2, ~> 4.0.0"
+
+        refute_predicate @content_addressable_version, :valid?
+      end
+
+      should "be invalid when the only version satisfying the floor is excluded" do
+        @content_addressable_version.required_rubygems_version = ">= 4.1.0.a, <= 4.1.0.a, != 4.1.0.a"
+
+        refute_predicate @content_addressable_version, :valid?
+      end
+
+      should "be valid when an upper bound still allows versions satisfying the floor" do
+        @content_addressable_version.required_rubygems_version = ">= 4.1.0.a, < 5"
+
+        assert_predicate @content_addressable_version, :valid?
+      end
+
       should "be valid when = operator value satisfies the floor" do
         @content_addressable_version.required_rubygems_version = "= 4.2"