NuGet/NuGetGallery — Issue #131: Not verifying a package upload leaves the package in a broken state
Author: anglicangeek
Created: 2011-10-16 05:35:33+00:00
State: open
Labels: bug

Repro steps:
1. Upload a new package
2. Instead of clicking Verify in step 2, navigate to the My Contributions listing

Expected: The package that I haven't yet verified isn't displayed
Actual: It is displayed, and it's in a wonky, broken state (i.e., will throw errors if you try to do anything with it)

Thoughts:
Since we've switched from the idea of "publishing" a package to whether a package is "listed", it seems wrong for a package to ever be put into the system if I haven't verified it. Here's what I'm thinking we should do:

1. When a package is uploaded, it gets copied to a folder/blob for "uploads". A given user can only have one package upload in progress
2. After uploading, the user is redirected to the verify action
2. The verify action reads the uploaded package file; the verification user experience doesn't change
3a. If the user cancels, the uploaded package is deleted
3b. If the user verifies, the package is created, just as it is now
3c. If the user leaves the page without cancelling or verifying, the uploaded package is waiting there for them to come back. We could display a message letting them know they have a package upload in progress, and at the least, if they try to upload a new package, they first have to either cancel or verify the current one

This keeps the user experience pretty much the way it is now, but without the odd behavior of what happens if you don't verify. It keeps things simple (I can't have packages in limbo; I have to either cancel or verify an upload before I can start a new one). If my browser does crash or whatever, it's sitting there waiting for me when I come back.