Fix: Filter out private internal libraries from package pages

[Copilot]

Problem

Hackage was incorrectly displaying private internal libraries on package pages, violating Cabal's specification that internal libraries are private by default. This manifested in two ways:

1. Internal libraries without explicit visibility field were being rendered as if they were public, even though Cabal defaults to private for internal libraries
2. Internal libraries with visibility: private had their documentation suppressed, but their contents were still listed on the package landing page

Examples of affected packages include attoparsec and hasql.

Root Cause

The rendering functions in src/Distribution/Server/Packages/Render.hs were using allLibraries and condSubLibraries without filtering based on the libVisibility field, causing all internal libraries to be displayed regardless of their visibility setting.

Solution

Added filtering in two places to respect library visibility:

1. Module Listings (renderModules)

Filters libraries before rendering their exposed modules and signatures:

renderModules docindex = flip fmap (filter isPublicLibrary $ allLibraries flatDesc) $ \lib ->
  ...
  where
    isPublicLibrary lib = libName lib == LMainLibName 
                       || libVisibility lib == LibraryVisibilityPublic

2. Dependency Listings (allCondLibs)

Filters conditional library trees shown in the dependencies section:

allCondLibs desc = filter (isPublicCondLib . snd) $
  maybeToList ((LMainLibName,) <$> condLibrary desc)
  ++ (first LSubLibName <$> condSubLibraries desc)
  where
    isPublicCondLib condTree = 
      let lib = condTreeData condTree
      in libName lib == LMainLibName || libVisibility lib == LibraryVisibilityPublic

Behavior After Fix

Library Type	Visibility Setting	Display Result
Main library	(ignored)	✅ Always shown
Internal library	private (default)	❌ Hidden
Internal library	visibility: private	❌ Hidden
Internal library	visibility: public	✅ Shown

Impact

• Private internal libraries no longer appear in module/signature listings
• Private internal libraries no longer appear in dependency sections
• Main library continues to be shown (as expected)
• Explicitly public internal libraries continue to be shown (as expected)
• Aligns Hackage's behavior with Cabal's specification

Fixes haskell#1346

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• esm.ubuntu.com
  • Triggering command: /usr/lib/apt/methods/https (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Hackage shows non-public, internal libraries. Fix it.

The issue is described in detail at haskell#1346.

In summary there seems to be two problems currently:

1. If the visibility setting is not specified for an internal library, the docs for it are rendered as if it's public. However the Cabal docs state that internal libraries are private by default. See "attoparsec" for example.

2. If visibility is explicitly set to private the docs don't get rendered, but the contents of the internal library still get listed at the landing page of the package. See "hasql" for example.

In both cases Hackage should just ignore the internal packages and neither list or generate docs for them.

The bug was likely introduced in the following PR: haskell#1279 at the 9b8be6f commit.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[nikita-volkov]

PR to the origin repository is here: haskell#1437.

[nikita-volkov]

@copilot Address here the comments in review of this patch which was done in the origin repository. https://github.com/haskell/hackage-server/pull/1437/files