automatic_updates.services.yml

@@ -62,6 +62,12 @@ services:
       - '@package_manager.failure_marker'
     calls:
       - ['setLogger', ['@logger.channel.automatic_updates']]
+  automatic_updates.requested_update_validator:
+    class: Drupal\automatic_updates\Validator\RequestedUpdateValidator
+    arguments:
+      - '@string_translation'
+    tags:
+      - { name: event_subscriber }
   automatic_updates.staged_projects_validator:
     class: Drupal\automatic_updates\Validator\StagedProjectsValidator
     arguments:

automatic_updates_extensions/tests/src/Functional/UpdaterFormTest.php

@@ -299,28 +299,38 @@ class UpdaterFormTest extends AutomaticUpdatesFunctionalTestBase {
       $this->container->get('state')->set('automatic_updates_test.new_update', TRUE);
       $page->pressButton('Continue');
       $this->checkForMetaRefresh();
+      $assert_session->pageTextContainsOnce('An error has occurred.');
+      $assert_session->pageTextContainsOnce('Please continue to the error page');
+      $page->clickLink('the error page');
+      $assert_session->pageTextContains('Some modules have database schema updates to install. You should run the database update script immediately.');
+      $assert_session->linkExists('database update script');
+      $assert_session->linkByHrefExists('/update.php');
+      $page->clickLink('database update script');
       $this->assertSession()->addressEquals('/update.php');
-      $assert_session->pageTextNotContains('Possible database updates have been detected in the following extensions.');
-      $assert_session->pageTextContainsOnce('Please apply database updates to complete the update process.');
+      $assert_session->pageTextNotContains('Possible database updates have been detected in the following extension');
       $page->clickLink('Continue');
       // @see automatic_updates_update_1191934()
       $assert_session->pageTextContains('Dynamic automatic_updates_update_1191934');
       $page->clickLink('Apply pending updates');
       $this->checkForMetaRefresh();
       $assert_session->pageTextContains('Updates were attempted.');
+      // PendingUpdatesValidator prevented the update to complete, so the status
+      // checks weren't run.
+      $this->drupalGet('/admin');
+      $assert_session->pageTextContains('Your site has not recently run an update readiness check. Run readiness checks now.');
     }
     else {
       $page->pressButton('Continue');
       $this->checkForMetaRefresh();
       $assert_session->addressEquals('/admin/reports/updates');
       $assert_session->pageTextContainsOnce('Update complete!');
+      // Status checks should display errors on admin page.
+      $this->drupalGet('/admin');
+      // Confirm that the status checks were run and the new error is displayed.
+      $assert_session->statusMessageContains('Error before continue.', 'error');
+      $assert_session->statusMessageContains(static::$errorsExplanation, 'error');
+      $assert_session->pageTextNotContains('Your site has not recently run an update readiness check. Run readiness checks now.');
     }
-    // Status checks should display errors on admin page.
-    $this->drupalGet('/admin');
-    // Confirm that the status checks were run and the new error is displayed.
-    $assert_session->statusMessageContains('Error before continue.', 'error');
-    $assert_session->statusMessageContains(static::$errorsExplanation, 'error');
-    $assert_session->pageTextNotContains('Your site has not recently run an update readiness check. Run readiness checks now.');
   }
 
   /**

package_manager/src/Validator/ComposerExecutableValidator.php

@@ -7,6 +7,7 @@ namespace Drupal\package_manager\Validator;
 use Composer\Semver\Semver;
 use Drupal\Core\Extension\ModuleHandlerInterface;
 use Drupal\Core\Url;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
@@ -167,6 +168,7 @@ class ComposerExecutableValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/ComposerJsonExistsValidator.php

@@ -6,6 +6,7 @@ namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
@@ -52,6 +53,7 @@ final class ComposerJsonExistsValidator implements EventSubscriberInterface {
     // @see \Drupal\package_manager\Validator\EnvironmentSupportValidator
     return [
       PreCreateEvent::class => ['validateComposerJson', 190],
+      PreApplyEvent::class => ['validateComposerJson', 190],
       StatusCheckEvent::class => ['validateComposerJson', 190],
     ];
   }

package_manager/src/Validator/ComposerPatchesValidator.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
@@ -46,6 +47,7 @@ class ComposerPatchesValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/ComposerSettingsValidator.php

@@ -6,6 +6,7 @@ namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
@@ -57,6 +58,7 @@ final class ComposerSettingsValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/DiskSpaceValidator.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\Validator;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Component\FileSystem\FileSystem;
@@ -169,6 +170,7 @@ class DiskSpaceValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/EnvironmentSupportValidator.php

@@ -6,6 +6,7 @@ namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\Link;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
@@ -66,6 +67,7 @@ final class EnvironmentSupportValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => ['validateStagePreOperation', 200],
+      PreApplyEvent::class => ['validateStagePreOperation', 200],
       StatusCheckEvent::class => ['validateStagePreOperation', 200],
     ];
   }

package_manager/src/Validator/MultisiteValidator.php

@@ -6,6 +6,7 @@ namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
@@ -77,6 +78,7 @@ final class MultisiteValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/PendingUpdatesValidator.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\Validator;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
@@ -92,6 +93,7 @@ final class PendingUpdatesValidator implements EventSubscriberInterface {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
     ];
   }
 

package_manager/src/Validator/SettingsValidator.php

@@ -7,6 +7,7 @@ namespace Drupal\package_manager\Validator;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
@@ -51,6 +52,7 @@ final class SettingsValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/src/Validator/WritableFileSystemValidator.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
@@ -71,8 +72,15 @@ class WritableFileSystemValidator implements EventSubscriberInterface {
       $messages[] = $this->t('The vendor directory "@dir" is not writable.', ['@dir' => $dir]);
     }
 
-    // Ensure the stage root directory is writable. If it doesn't exist, ensure
-    // we will be able to create it.
+    // During pre-apply don't check whether the staging root is writable.
+    if ($event instanceof PreApplyEvent) {
+      if ($messages) {
+        $event->addError($messages, $this->t('The file system is not writable.'));
+      }
+      return;
+    }
+    // Ensure the staging root is writable. If it doesn't exist, ensure we will
+    // be able to create it.
     $dir = $this->pathLocator->getStagingRoot();
     if (!file_exists($dir)) {
       $dir = dirname($dir);
@@ -99,6 +107,7 @@ class WritableFileSystemValidator implements EventSubscriberInterface {
   public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'validateStagePreOperation',
+      PreApplyEvent::class => 'validateStagePreOperation',
       StatusCheckEvent::class => 'validateStagePreOperation',
     ];
   }

package_manager/tests/modules/fixture_manipulator/src/FixtureManipulator.php

@@ -190,7 +190,7 @@ class FixtureManipulator {
       // If we're going to be updating the package data, merge the incoming data
       // into what we already have.
       if ($package) {
-        $install_json_package = NestedArray::mergeDeep($data['packages'][$position], $install_json_package);
+        $install_json_package = $install_json_package + $data['packages'][$position];
       }
 
       // Remove the existing package; the array will be re-keyed by
@@ -283,6 +283,19 @@ class FixtureManipulator {
     return $this;
   }
 
+  /**
+   * Modifies core packages.
+   *
+   * @param string $version
+   *   Target version.
+   */
+  public function setCorePackageVersion(string $version): self {
+    $this->setVersion('drupal/core', $version);
+    $this->setVersion('drupal/core-recommended', $version);
+    $this->setVersion('drupal/core-dev', $version);
+    return $this;
+  }
+
   /**
    * Commits the changes to the directory.
    */

package_manager/tests/src/Build/PackageUpdateTest.php

@@ -34,6 +34,7 @@ class PackageUpdateTest extends TemplateProjectTestBase {
     // Change both modules' upstream version.
     $this->addRepository('alpha', $this->copyFixtureToTempDirectory(__DIR__ . '/../../fixtures/alpha/1.1.0'));
     $this->addRepository('updated_module', $this->copyFixtureToTempDirectory(__DIR__ . '/../../fixtures/updated_module/1.1.0'));
+    // Make .git folder
 
     // Use the API endpoint to create a stage and update updated_module to
     // 1.1.0. Even though both modules have version 1.1.0 available, only
@@ -56,6 +57,8 @@ class PackageUpdateTest extends TemplateProjectTestBase {
     $mink = $this->getMink();
     $mink->assertSession()->statusCodeEquals(200);
 
+
+
     $file_contents = $mink->getSession()->getPage()->getContent();
     $file_contents = json_decode($file_contents, TRUE);
 

package_manager/tests/src/Kernel/ComposerExecutableValidatorTest.php

@@ -6,6 +6,7 @@ namespace Drupal\Tests\package_manager\Kernel;
 
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Url;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Validator\ComposerExecutableValidator;
 use Drupal\package_manager\ValidationResult;
@@ -72,6 +73,33 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults([$error], PreCreateEvent::class);
   }
 
+  /**
+   * Tests error on pre-apply if the Composer executable isn't found.
+   */
+  public function testErrorIfComposerNotFoundDuringPreApply(): void {
+    // Setting command output which doesn't raise error for pre-create event.
+    TestComposerExecutableValidator::setCommandOutput("Composer version 2.2.12");
+    $exception = new IOException("This is your regularly scheduled error.");
+
+    $listener = function () use ($exception): void {
+      TestComposerExecutableValidator::setCommandOutput($exception);
+    };
+    $this->container->get('event_dispatcher')->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
+
+    // The validator should translate that exception into an error.
+    $error = ValidationResult::createError([
+      $exception->getMessage(),
+    ]);
+    $stage = $this->assertResults([$error], PreApplyEvent::class);
+    $stage->destroy(TRUE);
+
+    // Setting command output which doesn't raise error for pre-create event.
+    TestComposerExecutableValidator::setCommandOutput("Composer version 2.2.12");
+    $this->enableModules(['help']);
+    $this->container->get('event_dispatcher')->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
+    $this->assertResultsWithHelp([$error], PreApplyEvent::class, FALSE);
+  }
+
   /**
    * Data provider for testComposerVersionValidation().
    *
@@ -180,6 +208,36 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResultsWithHelp($expected_results, PreCreateEvent::class);
   }
 
+  /**
+   * Tests validation of various Composer versions on pre-apply.
+   *
+   * @param string $reported_version
+   *   The version of Composer that `composer --version` should report.
+   * @param \Drupal\package_manager\ValidationResult[] $expected_results
+   *   The expected validation results.
+   *
+   * @dataProvider providerComposerVersionValidation
+   */
+  public function testComposerVersionValidationDuringPreApply(string $reported_version, array $expected_results): void {
+    // Setting command output which doesn't raise error for pre-create event.
+    TestComposerExecutableValidator::setCommandOutput("Composer version 2.2.12");
+    $listener = function () use ($reported_version): void {
+      TestComposerExecutableValidator::setCommandOutput("Composer version $reported_version");
+    };
+    $this->container->get('event_dispatcher')->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
+
+    // If the validator can't find a recognized, supported version of Composer,
+    // it should produce errors.
+    $stage = $this->assertResults($expected_results, PreApplyEvent::class);
+    $stage->destroy(TRUE);
+
+    // Setting command output which doesn't raise error for pre-create event.
+    TestComposerExecutableValidator::setCommandOutput("Composer version 2.2.12");
+    $this->enableModules(['help']);
+    $this->container->get('event_dispatcher')->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
+    $this->assertResultsWithHelp($expected_results, PreApplyEvent::class, FALSE);
+  }
+
   /**
    * Asserts that a set of validation results link to the Package Manager help.
    *
@@ -188,8 +246,11 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
    * @param string|null $event_class
    *   (optional) The class of the event which should return the results. Must
    *   be passed if $expected_results is not empty.
+   * @param bool $assert_status_check
+   *   (optional) Whether the status checks should be asserted. Defaults to
+   *   TRUE.
    */
-  private function assertResultsWithHelp(array $expected_results, string $event_class = NULL): void {
+  private function assertResultsWithHelp(array $expected_results, string $event_class = NULL, bool $assert_status_check = TRUE): void {
     $url = Url::fromRoute('help.page', ['name' => 'package_manager'])
       ->setOption('fragment', 'package-manager-faq-composer-not-found')
       ->toString();
@@ -203,7 +264,9 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
       $messages = array_map($map, $result->getMessages());
       $expected_results[$index] = ValidationResult::createError($messages);
     }
-    $this->assertStatusCheckResults($expected_results);
+    if ($assert_status_check) {
+      $this->assertStatusCheckResults($expected_results);
+    }
     $this->assertResults($expected_results, $event_class);
   }
 

package_manager/tests/src/Kernel/ComposerJsonExistsValidatorTest.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\package_manager\Kernel;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
 use Drupal\package_manager\ValidationResult;
@@ -39,4 +40,32 @@ class ComposerJsonExistsValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults([$result], PreCreateEvent::class);
   }
 
+  /**
+   * Tests that active composer.json is not present during pre-apply.
+   */
+  public function testComposerRequirementDuringPreApply(): void {
+    $result = ValidationResult::createError([
+      'No composer.json file can be found at vfs://root/active',
+    ]);
+    $this->container->get('event_dispatcher')->addListener(
+        PreApplyEvent::class,
+        function (): void {
+          unlink($this->container->get('package_manager.path_locator')
+            ->getProjectRoot() . '/composer.json');
+        },
+        PHP_INT_MAX
+      );
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function (): void {
+        $this->fail('Event propagation should have been stopped during ' . PreApplyEvent::class . '.');
+      },
+      // Execute this listener immediately after the tested validator, which
+      // uses priority 190. This ensures informative test failures.
+      // @see \Drupal\package_manager\Validator\ComposerJsonExistsValidator::getSubscribedEvents()
+      189
+    );
+    $this->assertResults([$result], PreApplyEvent::class);
+  }
+
 }

package_manager/tests/src/Kernel/ComposerPatchesValidatorTest.php

@@ -4,7 +4,8 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\package_manager\Kernel;
 
-use Composer\Json\JsonFile;
+use Drupal\fixture_manipulator\ActiveFixtureManipulator;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\ValidationResult;
 
@@ -24,15 +25,7 @@ class ComposerPatchesValidatorTest extends PackageManagerKernelTestBase {
     $dir = $this->container->get('package_manager.path_locator')
       ->getProjectRoot();
 
-    // Simulate that the patcher is installed in the active directory.
-    $file = new JsonFile($dir . '/vendor/composer/installed.json');
-    $this->assertTrue($file->exists());
-    $data = $file->read();
-    $data['packages'][] = [
-      'name' => 'cweagans/composer-patches',
-      'version' => '1.0.0',
-    ];
-    $file->write($data);
+    $this->installPatcherInActive($dir);
 
     // Because ComposerUtility reads composer.json and passes it to the Composer
     // factory as an array, Composer will assume that the configuration is
@@ -44,4 +37,44 @@ class ComposerPatchesValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults([$error], PreCreateEvent::class);
   }
 
+  /**
+   * Tests that the patcher configuration is validated during pre-apply.
+   */
+  public function testErrorDuringPreApply(): void {
+    // Simulate an active directory where the patcher is installed, but there's
+    // no composer-exit-on-patch-failure flag.
+    $dir = $this->container->get('package_manager.path_locator')
+      ->getProjectRoot();
+
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function () use ($dir): void {
+        $this->installPatcherInActive($dir);
+      },
+      PHP_INT_MAX
+    );
+    // Because ComposerUtility reads composer.json and passes it to the Composer
+    // factory as an array, Composer will assume that the configuration is
+    // coming from a config.json file, even if one doesn't exist.
+    $error = ValidationResult::createError([
+      "The <code>cweagans/composer-patches</code> plugin is installed, but the <code>composer-exit-on-patch-failure</code> key is not set to <code>true</code> in the <code>extra</code> section of $dir/config.json.",
+    ]);
+    $this->assertResults([$error], PreApplyEvent::class);
+  }
+
+  /**
+   * Simulates that the patcher is installed in the active directory.
+   *
+   * @param string $dir
+   *   The active directory.
+   */
+  private function installPatcherInActive(string $dir): void {
+    (new ActiveFixtureManipulator())
+      ->addPackage([
+        'name' => 'cweagans/composer-patches',
+        'version' => '1.0.0',
+        'type' => 'composer-plugin',
+      ])->commitChanges();
+  }
+
 }

package_manager/tests/src/Kernel/ComposerSettingsValidatorTest.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\Tests\package_manager\Kernel;
 
 use Drupal\Component\Serialization\Json;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\ValidationResult;
 
@@ -68,4 +69,27 @@ class ComposerSettingsValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults($expected_results, PreCreateEvent::class);
   }
 
+  /**
+   * Tests that Composer's secure-http setting is validated during pre-apply.
+   *
+   * @param string $contents
+   *   The contents of the composer.json file.
+   * @param \Drupal\package_manager\ValidationResult[] $expected_results
+   *   The expected validation results, if any.
+   *
+   * @dataProvider providerSecureHttpValidation
+   */
+  public function testSecureHttpValidationDuringPreApply(string $contents, array $expected_results): void {
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function () use ($contents): void {
+        $active_dir = $this->container->get('package_manager.path_locator')
+          ->getProjectRoot();
+        file_put_contents("$active_dir/composer.json", $contents);
+      },
+      PHP_INT_MAX
+    );
+    $this->assertResults($expected_results, PreApplyEvent::class);
+  }
+
 }

package_manager/tests/src/Kernel/DiskSpaceValidatorTest.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\package_manager\Kernel;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\ValidationResult;
 use Drupal\Component\Utility\Bytes;
@@ -154,4 +155,34 @@ class DiskSpaceValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults($expected_results, PreCreateEvent::class);
   }
 
+  /**
+   * Tests disk space validation during pre-apply.
+   *
+   * @param bool $shared_disk
+   *   Whether the root and vendor directories are on the same logical disk.
+   * @param array $free_space
+   *   The free space that should be reported for various paths. The keys
+   *   are the paths, and the values are the free space that should be reported,
+   *   in a format that can be parsed by
+   *   \Drupal\Component\Utility\Bytes::toNumber().
+   * @param \Drupal\package_manager\ValidationResult[] $expected_results
+   *   The expected validation results.
+   *
+   * @dataProvider providerDiskSpaceValidation
+   */
+  public function testDiskSpaceValidationDuringPreApply(bool $shared_disk, array $free_space, array $expected_results): void {
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function () use ($shared_disk, $free_space): void {
+        /** @var \Drupal\Tests\package_manager\Kernel\TestDiskSpaceValidator $validator */
+        $validator = $this->container->get('package_manager.validator.disk_space');
+        $validator->sharedDisk = $shared_disk;
+        $validator->freeSpace = array_map([Bytes::class, 'toNumber'], $free_space);
+      },
+      PHP_INT_MAX
+    );
+
+    $this->assertResults($expected_results, PreApplyEvent::class);
+  }
+
 }

package_manager/tests/src/Kernel/EnvironmentSupportValidatorTest.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\package_manager\Kernel;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
 use Drupal\package_manager\ValidationResult;
@@ -41,6 +42,35 @@ class EnvironmentSupportValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults([$result], PreCreateEvent::class);
   }
 
+  /**
+   * Tests an invalid URL in the environment support variable during pre-apply.
+   */
+  public function testInvalidUrlDuringPreApply(): void {
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function (): void {
+        putenv(EnvironmentSupportValidator::VARIABLE_NAME . '=broken/url.org');
+      },
+      PHP_INT_MAX
+    );
+
+    $result = ValidationResult::createError([
+      'Package Manager is not supported by your environment.',
+    ]);
+
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function (): void {
+        $this->fail('Event propagation should have been stopped during ' . PreApplyEvent::class . '.');
+      },
+      // Execute this listener immediately after the tested validator, which
+      // uses priority 200. This ensures informative test failures.
+      // @see \Drupal\package_manager\Validator\EnvironmentSupportValidator::getSubscribedEvents()
+      199
+    );
+    $this->assertResults([$result], PreApplyEvent::class);
+  }
+
   /**
    * Tests that the validation message links to the provided URL.
    */
@@ -55,4 +85,23 @@ class EnvironmentSupportValidatorTest extends PackageManagerKernelTestBase {
     $this->assertResults([$result], PreCreateEvent::class);
   }
 
+  /**
+   * Tests that the validation message links to the provided URL during pre-apply.
+   */
+  public function testValidUrlDuringPreApply(): void {
+    $url = 'http://www.example.com';
+    $this->container->get('event_dispatcher')->addListener(
+      PreApplyEvent::class,
+      function () use ($url): void {
+        putenv(EnvironmentSupportValidator::VARIABLE_NAME . '=' . $url);
+      },
+      PHP_INT_MAX
+    );
+
+    $result = ValidationResult::createError([
+      '<a href="' . $url . '">Package Manager is not supported by your environment.</a>',
+    ]);
+    $this->assertResults([$result], PreApplyEvent::class);
+  }
+
 }