From ac80f1d91307a54d22b9594e43393004f59b8bc8 Mon Sep 17 00:00:00 2001
From: David Hotham <david.hotham@blueyonder.co.uk>
Date: Sun, 10 Jul 2022 18:17:53 +0100
Subject: [PATCH] Don't search secondary repositories if not required

---
 docs/repositories.md            |  8 +++-----
 src/poetry/repositories/pool.py | 13 +++++++++++--
 tests/repositories/test_pool.py | 21 +++++++++++++++++++++
 3 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/docs/repositories.md b/docs/repositories.md
index 1b4128fabe0..d709ca4b854 100644
--- a/docs/repositories.md
+++ b/docs/repositories.md
@@ -168,12 +168,10 @@ There can be more than one secondary package source.
 
 {{% note %}}
 
-All package sources (including secondary sources) will be searched during the package lookup
-process. These network requests will occur for all sources, regardless of if the package is
-found at one or more sources.
+Secondary sources are searched only for packages that are not found in primary
+sources.
 
-If you wish to avoid this, you may explicitly specify which source to search in for a particular
-package.
+You may explicitly specify which source to search in for a particular package.
 
 ```bash
 poetry add --source pypi httpx
diff --git a/src/poetry/repositories/pool.py b/src/poetry/repositories/pool.py
index edc53e71ba2..45dd51b6ca1 100644
--- a/src/poetry/repositories/pool.py
+++ b/src/poetry/repositories/pool.py
@@ -176,8 +176,17 @@ def find_packages(self, dependency: Dependency) -> list[Package]:
         if repository is not None and not self._ignore_repository_names:
             return self.repository(repository).find_packages(dependency)
 
-        packages = []
-        for repo in self._repositories:
+        packages: list[Package] = []
+        for index, repo in enumerate(self._repositories):
+            if (
+                self._secondary_start_idx is not None
+                and index >= self._secondary_start_idx
+                and packages
+            ):
+                # We've found packages in the primary repositories, don't search
+                # secondary repositories.
+                break
+
             packages += repo.find_packages(dependency)
 
         return packages
diff --git a/tests/repositories/test_pool.py b/tests/repositories/test_pool.py
index 74aa6750549..f08ef13f889 100644
--- a/tests/repositories/test_pool.py
+++ b/tests/repositories/test_pool.py
@@ -2,8 +2,10 @@
 
 import pytest
 
+from poetry.core.packages.package import Package
 from poetry.core.semver.version import Version
 
+from poetry.factory import Factory
 from poetry.repositories import Pool
 from poetry.repositories import Repository
 from poetry.repositories.exceptions import PackageNotFound
@@ -141,3 +143,22 @@ def test_repository_ordering():
     assert pool.repositories == [default1, primary1, primary3, secondary1, secondary3]
     with pytest.raises(ValueError):
         pool.add_repository(default2, default=True)
+
+
+def test_secondary_repository_is_not_always_searched() -> None:
+    package1 = Package("foo", "1.0.0")
+    primary = Repository("primary", [package1])
+
+    package2 = Package("foo", "2.0.0")
+    secondary = Repository("secondary", [package2])
+
+    pool = Pool()
+    pool.add_repository(primary)
+    pool.add_repository(secondary, secondary=True)
+
+    # Only the package in the primary repository is found, even though there's a newer
+    # version in a secondary repository.
+    dependency = Factory.create_dependency("foo", "*")
+    packages = pool.find_packages(dependency)
+    assert len(packages) == 1
+    assert packages[0].pretty_version == "1.0.0"