nullable and fix

Author: Nigusu-Allehu

src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Download/PackageDownloadRunner.cs

@@ -1,6 +1,8 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+#nullable enable
+
 using System;
 using System.Collections.Generic;
 using System.Globalization;
@@ -48,8 +50,10 @@ public static async Task<int> RunAsync(PackageDownloadArgs args, CancellationTok
 
         public static async Task<int> RunAsync(PackageDownloadArgs args, ILoggerWithColor logger, IReadOnlyList<PackageSource> packageSources, ISettings settings, CancellationToken token)
         {
-            // If --source is explicitly provided, validate those sources up front.
-            if (args.Sources != null && args.Sources.Count > 0 && DetectAndReportInsecureSources(args.AllowInsecureConnections, packageSources, logger))
+            var packageSourceMapping = PackageSourceMapping.GetPackageSourceMapping(settings);
+            var hasSourcesArg = args.Sources != null && args.Sources.Count > 0;
+            var mappingDisabled = (packageSourceMapping != null && !packageSourceMapping.IsEnabled) || packageSourceMapping == null;
+            if ((mappingDisabled || hasSourcesArg) && DetectAndReportInsecureSources(args.AllowInsecureConnections, packageSources, logger))
             {
                 return ExitCodeError;
             }
@@ -58,11 +62,10 @@ public static async Task<int> RunAsync(PackageDownloadArgs args, ILoggerWithColo
             var cache = new SourceCacheContext();
 
             IReadOnlyDictionary<string, SourceRepository> sourceRepositoriesMap = GetSourceRepositories(packageSources);
-            var packageSourceMapping = PackageSourceMapping.GetPackageSourceMapping(settings);
 
             bool downloadedAllSuccessfully = true;
 
-            foreach (var package in args.Packages)
+            foreach (var package in args.Packages ?? [])
             {
                 logger.LogMinimal(string.Format(
                     CultureInfo.CurrentCulture,
@@ -85,7 +88,7 @@ public static async Task<int> RunAsync(PackageDownloadArgs args, ILoggerWithColo
 
                 try
                 {
-                    (NuGetVersion version, SourceRepository downloadRepository) =
+                    (NuGetVersion? version, SourceRepository? downloadRepository) =
                         await ResolvePackageDownloadVersion(
                             package,
                             sourceRepositories,
@@ -104,7 +107,7 @@ await ResolvePackageDownloadVersion(
                     bool success = await DownloadPackageAsync(
                         package.Id,
                         version,
-                        downloadRepository,
+                        downloadRepository!,
                         cache,
                         settings,
                         outputDirectory,
@@ -143,16 +146,16 @@ await ResolvePackageDownloadVersion(
             return downloadedAllSuccessfully ? ExitCodeSuccess : ExitCodeError;
         }
 
-        internal static async Task<(NuGetVersion, SourceRepository)> ResolvePackageDownloadVersion(
+        internal static async Task<(NuGetVersion?, SourceRepository?)> ResolvePackageDownloadVersion(
             PackageWithNuGetVersion packageWithNuGetVersion,
             IEnumerable<SourceRepository> sourceRepositories,
             SourceCacheContext cache,
             ILoggerWithColor logger,
             bool includePrerelease,
             CancellationToken token)
         {
-            NuGetVersion versionToDownload = null;
-            SourceRepository downloadSourceRepository = null;
+            NuGetVersion? versionToDownload = null;
+            SourceRepository? downloadSourceRepository = null;
             bool versionSpecified = packageWithNuGetVersion.NuGetVersion != null;
 
             foreach (var repo in sourceRepositories)
@@ -213,41 +216,58 @@ private static bool TryGetRepositoriesForPackage(
             string packageId,
             PackageDownloadArgs args,
             IReadOnlyList<PackageSource> allPackageSources,
-            PackageSourceMapping packageSourceMapping,
+            PackageSourceMapping? packageSourceMapping,
             IReadOnlyDictionary<string, SourceRepository> sourceRepositoriesMap,
             ILoggerWithColor logger,
             out List<SourceRepository> repositories)
         {
-            repositories = new List<SourceRepository>();
+            List<PackageSource> effectiveSources;
 
-            if (args.Sources != null && args.Sources.Count > 0)
+            var sourceExplicitlyProvided = args.Sources?.Count > 0;
+            if (sourceExplicitlyProvided || (packageSourceMapping != null && !packageSourceMapping.IsEnabled))
             {
-                // --source specified: use the provided sources
-                foreach (var source in allPackageSources)
-                {
-                    repositories.Add(sourceRepositoriesMap[source.Name]);
-                }
-
-                return true;
+                // --source given OR mapping disabled: use all provided sources as-is
+                effectiveSources = [.. allPackageSources];
             }
-
-            // No --source: use package source mapping
-            var mappedSourceNames = packageSourceMapping.GetConfiguredPackageSources(packageId);
-            var mappedSources = allPackageSources.Where(ps => mappedSourceNames.Contains(ps.Name, StringComparer.OrdinalIgnoreCase)).ToList();
-            if (DetectAndReportInsecureSources(args.AllowInsecureConnections, mappedSources, logger))
+            else
             {
-                return false;
+                // Mapping enabled, no --source: try mapped names first
+                var mappedNames = packageSourceMapping == null ? [] : packageSourceMapping.GetConfiguredPackageSources(packageId);
+
+                // Build effective sources in the same order as mappedNames
+                var mapped = mappedNames
+                    .Select(n => allPackageSources.FirstOrDefault(ps =>
+                        string.Equals(ps.Name, n, StringComparison.OrdinalIgnoreCase)))
+                    .ToList();
+
+                // Only validate insecure sources when mapping produced something
+                if (mapped.Count > 0)
+                {
+                    if (DetectAndReportInsecureSources(args.AllowInsecureConnections, mapped!, logger))
+                    {
+                        repositories = [];
+                        return false;
+                    }
+
+                    effectiveSources = mapped!;
+                }
+                else
+                {
+                    // No mapping for this package: fall back to all sources
+                    effectiveSources = [.. allPackageSources];
+                }
             }
 
-            foreach (var name in mappedSourceNames)
+            // Convert effective sources to repositories
+            repositories = new List<SourceRepository>(effectiveSources.Count);
+            foreach (var src in effectiveSources)
             {
-                repositories.Add(sourceRepositoriesMap[name]);
+                repositories.Add(sourceRepositoriesMap[src.Name]);
             }
 
             return true;
         }
 
-
         private static async Task<bool> DownloadPackageAsync(
             string id,
             NuGetVersion version,
@@ -299,7 +319,7 @@ private static async Task<bool> DownloadPackageAsync(
             return success;
         }
 
-        private static IReadOnlyList<PackageSource> GetPackageSources(IList<string> sources, IPackageSourceProvider sourceProvider)
+        private static IReadOnlyList<PackageSource> GetPackageSources(IList<string>? sources, IPackageSourceProvider sourceProvider)
         {
             IEnumerable<PackageSource> configuredSources = sourceProvider.LoadPackageSources()
                 .Where(s => s.IsEnabled);