@mpgd/adapter-devvit 0.9.12 → 0.9.13

package/dist/server/payment-order.js

@@ -35,8 +35,10 @@ function normalizeDevvitOrder(input, expectedStatus) {
     }
     const product = requireRecord(record.products[0], 'Devvit payment product');
     const orderId = requireString(record.id, 'order.id');
-    if (record.userId !== undefined
-        && requireString(record.userId, 'order.userId') !== playerId) {
+    // The order must carry the purchasing user so the server-side binding to the
+    // authenticated context is always enforced; an order without userId cannot be
+    // attributed and must not be fulfilled or refunded.
+    if (requireString(record.userId, 'order.userId') !== playerId) {
         throw new TypeError('Devvit payment order userId must match the authenticated context playerId.');
     }
     const platformSku = requireString(product.sku, 'order.products[0].sku');

package/dist/server/redis-post-operation-store.js

@@ -98,17 +98,26 @@ async function mutateIfValue(input) {
             }
             await transaction.multi();
             multiStarted = true;
-            await input.queueMutation(transaction);
+            const counting = countQueuedCommands(transaction);
+            await input.queueMutation(counting.transaction);
+            if (counting.count() === 0) {
+                throw new Error('Devvit Redis transaction queued no commands before EXEC.');
+            }
             const results = await transaction.exec();
+            // `@devvit/redis` `TxClient.exec()` never resolves `null`: it maps the
+            // server reply to an array, so an aborted WATCH transaction surfaces as
+            // an empty array. Fewer results than queued commands is a conflict; `null`
+            // stays a conflict for clients that follow the classic Redis contract.
             if (results === null) {
                 continue;
             }
             if (!Array.isArray(results)) {
                 throw new Error('Devvit Redis transaction returned an unsupported response.');
             }
-            if (results.length > 0) {
-                return true;
+            if (results.length < counting.count()) {
+                continue;
             }
+            return true;
         }
         catch (error) {
             await bestEffortReset(transaction, multiStarted);
@@ -117,6 +126,33 @@ async function mutateIfValue(input) {
     }
     throw new Error(`Devvit Redis transaction contention exceeded ${String(input.transactionAttempts)} attempts for key: ${input.key}`);
 }
+/**
+ * Wraps a transaction so the number of commands queued after MULTI is known
+ * when EXEC resolves, which is what distinguishes a completed transaction from
+ * an aborted one on the Devvit Redis client.
+ */
+function countQueuedCommands(transaction) {
+    let queued = 0;
+    return {
+        count: () => queued,
+        transaction: {
+            multi: () => transaction.multi(),
+            discard: () => transaction.discard(),
+            exec: () => transaction.exec(),
+            unwatch: () => transaction.unwatch(),
+            async set(key, value, options) {
+                const result = await transaction.set(key, value, options);
+                queued += 1;
+                return result;
+            },
+            async del(...keys) {
+                const result = await transaction.del(...keys);
+                queued += 1;
+                return result;
+            },
+        },
+    };
+}
 async function bestEffortReset(transaction, multiStarted) {
     try {
         if (multiStarted) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/adapter-devvit",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "Reddit Devvit Web platform adapter for mpgd games.",
   "license": "MIT",
   "repository": {
@@ -56,7 +56,7 @@
   "dependencies": {
     "@devvit/web": "0.14.1",
     "@mpgd/bridge": "0.10.0",
-    "@mpgd/game-services": "0.17.0",
+    "@mpgd/game-services": "0.17.1",
     "@mpgd/platform": "0.14.0"
   },
   "devDependencies": {