@objectstack/objectql 4.1.1 → 4.2.0

package/dist/index.mjs

@@ -619,6 +619,25 @@ function simpleHash(str) {
   }
   return Math.abs(hash).toString(16);
 }
+var ConcurrentUpdateError = class extends Error {
+  constructor(opts) {
+    super(opts.message ?? "Record was modified by another user");
+    this.code = "CONCURRENT_UPDATE";
+    this.status = 409;
+    this.name = "ConcurrentUpdateError";
+    this.currentVersion = opts.currentVersion;
+    this.currentRecord = opts.currentRecord;
+  }
+};
+function normaliseVersionToken(v) {
+  if (v === null || v === void 0) return null;
+  const s = String(v).trim();
+  if (!s) return null;
+  if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
 var SERVICE_CONFIG = {
   auth: { route: "/api/v1/auth", plugin: "plugin-auth" },
   automation: { route: "/api/v1/automation", plugin: "plugin-automation" },
@@ -1212,6 +1231,7 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
     };
   }
   async updateData(request) {
+    await this.assertVersionMatch(request.object, request.id, request.expectedVersion, request.context);
     const opts = { where: { id: request.id } };
     if (request.context !== void 0) opts.context = request.context;
     const result = await this.engine.update(request.object, request.data, opts);
@@ -1222,6 +1242,7 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
     };
   }
   async deleteData(request) {
+    await this.assertVersionMatch(request.object, request.id, request.expectedVersion, request.context);
     const opts = { where: { id: request.id } };
     if (request.context !== void 0) opts.context = request.context;
     await this.engine.delete(request.object, opts);
@@ -1231,6 +1252,42 @@ var _ObjectStackProtocolImplementation = class _ObjectStackProtocolImplementatio
       success: true
     };
   }
+  /**
+   * Optimistic Concurrency Control gate shared by updateData/deleteData.
+   *
+   * When the caller passes a non-empty `expectedVersion` token (typically
+   * the `updated_at` value they read), this fetches the current record
+   * and compares its `updated_at` against the token. Mismatch → throw
+   * `ConcurrentUpdateError` which the REST layer maps to 409.
+   *
+   * Behaviour:
+   *  - Empty/missing token → no check (opt-in semantics; existing callers
+   *    that haven't yet adopted OCC are unaffected).
+   *  - Record not found → no check; downstream `engine.update` will
+   *    surface the usual `RECORD_NOT_FOUND` 404. We intentionally do not
+   *    treat "missing record" as a concurrency conflict.
+   *  - Record has no `updated_at` field (timestamps disabled) → no check.
+   *    Logging would be noisy here; OCC is opt-in and the absence of a
+   *    version column is an explicit "this object doesn't support OCC"
+   *    signal.
+   */
+  async assertVersionMatch(object, id, expectedVersion, context) {
+    const expected = normaliseVersionToken(expectedVersion);
+    if (!expected) return;
+    const findOpts = { where: { id } };
+    if (context !== void 0) findOpts.context = context;
+    const current = await this.engine.findOne(object, findOpts);
+    if (!current) return;
+    const currentVersion = normaliseVersionToken(current.updated_at);
+    if (!currentVersion) return;
+    if (currentVersion !== expected) {
+      throw new ConcurrentUpdateError({
+        currentVersion,
+        currentRecord: current,
+        message: `Record ${object}/${id} was modified by another user (current version ${currentVersion}, expected ${expected})`
+      });
+    }
+  }
   // ==========================================
   // Global Search (M10.5)
   // ==========================================