we default to json respond even when html needed

Author: YasenT

pulp_python/app/pypi/views.py

@@ -70,6 +70,41 @@
 
 PYPI_SIMPLE_V1_HTML = "application/vnd.pypi.simple.v1+html"
 PYPI_SIMPLE_V1_JSON = "application/vnd.pypi.simple.v1+json"
+PYPI_TEXT_HTML = "text/html"
+
+_SIMPLE_MEDIA_TYPES = (PYPI_SIMPLE_V1_JSON, PYPI_SIMPLE_V1_HTML, PYPI_TEXT_HTML)
+
+
+def _accept_prefers_json(accept_header):
+    """
+    Determine whether an Accept header genuinely prefers the Simple JSON media type.
+
+    DRF's content negotiation matches renderers in renderer-list order and does not
+    account for q-values among media types of equal specificity, so a client Accept
+    header like "application/vnd.pypi.simple.v1+json, text/html;q=0.01" would
+    otherwise lose to whichever HTML renderer happens to be listed first. We inspect
+    the header ourselves and only prefer JSON when it has a strictly higher q-value
+    than any of the HTML media types the client also advertises (ties favor whichever
+    of the two was listed first, matching how pip/uv order their Accept headers).
+    """
+    best_type, best_q = None, -1.0
+    for token in accept_header.split(","):
+        media_type, _, params = token.strip().partition(";")
+        media_type = media_type.strip().lower()
+        if media_type not in _SIMPLE_MEDIA_TYPES:
+            continue
+        q = 1.0
+        for param in params.split(";"):
+            param = param.strip()
+            if param.startswith("q="):
+                try:
+                    q = float(param[2:])
+                except ValueError:
+                    q = 1.0
+                break
+        if q > best_q:
+            best_q, best_type = q, media_type
+    return best_type == PYPI_SIMPLE_V1_JSON
 
 
 def _get_repo_version(path):
@@ -319,12 +354,12 @@ def get_renderers(self):
         """
         if self.action in ["list", "retrieve"]:
             # DRF resolves equally-specific media types in renderer order and does not
-            # account for q-values.  Put the PyPI JSON renderer first when the client
-            # explicitly advertises it (as pip and uv do), otherwise retain HTML as the
-            # default for browser and legacy clients.
-            accept = self.request.META.get("HTTP_ACCEPT", "").lower()
+            # account for q-values. Put the PyPI JSON renderer first only when the
+            # client's Accept header actually prefers it over HTML (as pip and uv do),
+            # otherwise retain HTML as the default for browser and legacy clients.
+            accept = self.request.META.get("HTTP_ACCEPT", "")
             renderers = [TemplateHTMLRenderer(), PyPISimpleHTMLRenderer()]
-            if PYPI_SIMPLE_V1_JSON in accept:
+            if _accept_prefers_json(accept):
                 renderers.insert(0, PyPISimpleJSONRenderer())
             else:
                 renderers.append(PyPISimpleJSONRenderer())

pulp_python/tests/functional/api/test_pypi_simple_api.py

@@ -171,6 +171,15 @@ def test_simple_json_detail_api(
         (PYPI_SIMPLE_V1_JSON, PYPI_SIMPLE_V1_JSON),
         # Clients such as pip and uv advertise JSON first, with HTML as a fallback.
         (f"{PYPI_SIMPLE_V1_JSON}, {PYPI_SIMPLE_V1_HTML}", PYPI_SIMPLE_V1_JSON),
+        # pip/uv's real-world Accept header: JSON implicitly q=1, HTML variants
+        # explicitly down-weighted as fallbacks.
+        (
+            f"{PYPI_SIMPLE_V1_JSON}, {PYPI_SIMPLE_V1_HTML};q=0.1, {PYPI_TEXT_HTML};q=0.01",
+            PYPI_SIMPLE_V1_JSON,
+        ),
+        # A client that explicitly weights HTML higher than JSON must get HTML,
+        # even though JSON is technically present in the header.
+        (f"{PYPI_SIMPLE_V1_HTML}, {PYPI_SIMPLE_V1_JSON};q=0.1", PYPI_SIMPLE_V1_HTML),
         # Everything else should be html
         ("", PYPI_TEXT_HTML),
         ("application/json", PYPI_TEXT_HTML),