@oneuptime/common 11.7.4 → 12.0.1

package/Tests/Server/Services/DatabaseServiceEmptyUpdate.test.ts

@@ -45,6 +45,7 @@ describe("DatabaseService._updateBy when the update carries no columns", () => {
   let service: DatabaseService<Probe>;
   let findBySpy: jest.SpyInstance;
   let saveMock: MockFunction;
+  let updateMock: MockFunction;
 
   beforeEach(() => {
     jest.restoreAllMocks();
@@ -54,12 +55,15 @@ describe("DatabaseService._updateBy when the update carries no columns", () => {
 
     /*
      * Only the two surfaces that need a live Postgres are stubbed - the
-     * internal find (`_findBy`) and the repository behind `save()`. Mocking
+     * internal find (`_findBy`) and the repository behind the write. Mocking
      * the TypeORM repository itself is impractical here because `_findBy`
      * builds real query metadata against a DataSource that does not exist in
      * a unit test; stubbing `_findBy` keeps the mock at the exact boundary the
      * fix is about (was the find run at all?) while leaving every line of
      * _updateBy under test - sanitizing, the hooks and the return arithmetic.
+     * Both write surfaces are stubbed (`save()` for relation updates,
+     * `update()` for scalar-only ones) so a stray write of either kind is
+     * caught rather than throwing "not a function".
      *
      * The stub deliberately returns a MATCHING row, because that is what a
      * real database does here: the row exists and the query finds it, there is
@@ -75,8 +79,13 @@ describe("DatabaseService._updateBy when the update carries no columns", () => {
     saveMock.mockImplementation((item: unknown) => {
       return Promise.resolve(item);
     });
+    updateMock = getJestMockFunction();
+    updateMock.mockImplementation(() => {
+      return Promise.resolve({ affected: 1 });
+    });
     getJestSpyOn(service, "getRepository").mockReturnValue({
       save: saveMock,
+      update: updateMock,
     });
 
     // The permission layer is not what these tests are about, and needs a DB.
@@ -157,6 +166,7 @@ describe("DatabaseService._updateBy when the update carries no columns", () => {
     });
 
     expect(saveMock).not.toHaveBeenCalled();
+    expect(updateMock).not.toHaveBeenCalled();
     expect(numberOfDocsAffected).toBe(0);
   });
 
@@ -188,6 +198,7 @@ describe("DatabaseService._updateBy when the update does carry columns", () => {
   let service: DatabaseService<Probe>;
   let findBySpy: jest.SpyInstance;
   let saveMock: MockFunction;
+  let updateMock: MockFunction;
 
   beforeEach(() => {
     jest.restoreAllMocks();
@@ -204,8 +215,13 @@ describe("DatabaseService._updateBy when the update does carry columns", () => {
     saveMock.mockImplementation((item: unknown) => {
       return Promise.resolve(item);
     });
+    updateMock = getJestMockFunction();
+    updateMock.mockImplementation(() => {
+      return Promise.resolve({ affected: 1 });
+    });
     getJestSpyOn(service, "getRepository").mockReturnValue({
       save: saveMock,
+      update: updateMock,
     });
 
     getJestSpyOn(
@@ -250,7 +266,13 @@ describe("DatabaseService._updateBy when the update does carry columns", () => {
       props: { isRoot: true },
     });
 
-    expect(saveMock).toHaveBeenCalledTimes(2);
+    /*
+     * `name` is a scalar column, so the write goes through update() (which
+     * never inserts) rather than save() — one update() per row the find
+     * returned, and save() is left untouched.
+     */
+    expect(updateMock).toHaveBeenCalledTimes(2);
+    expect(saveMock).not.toHaveBeenCalled();
   });
 
   it("still calls onUpdateSuccess with the ids of the rows it updated", async () => {

package/Tests/Server/Services/DatabaseServiceSanitizeUpdateData.test.ts

@@ -168,12 +168,12 @@ describe("DatabaseService._updateBy — updateOneById with a model instance no l
       .mockResolvedValue([foundItem] as never);
 
     // eslint-disable-next-line @typescript-eslint/typedef
-    const saveMock = jest.fn((item: unknown) => {
-      return Promise.resolve(item);
+    const updateMock = jest.fn((_where: unknown, _data: unknown) => {
+      return Promise.resolve({ affected: 1 });
     });
     jest
       .spyOn(NetworkDeviceDiscoveryScanService, "getRepository")
-      .mockReturnValue({ save: saveMock } as never);
+      .mockReturnValue({ update: updateMock } as never);
 
     // Permission layer is not under test here and needs no DB.
     jest
@@ -220,13 +220,20 @@ describe("DatabaseService._updateBy — updateOneById with a model instance no l
     );
     expect(selectedColumns).not.toContain("isPermissionIf");
 
-    // The persisted payload is the plain data plus the located row's _id.
-    expect(saveMock).toHaveBeenCalledTimes(1);
-    const savedItem: JSONObject = saveMock.mock.calls[0]![0] as JSONObject;
-    expect(Object.keys(savedItem).sort()).toEqual(
-      ["_id", "startedAt", "status"].sort(),
+    /*
+     * Scalar-only updates go through repository.update(): the located row's
+     * _id becomes the WHERE clause and the sanitized columns the SET payload.
+     * _id must stay out of the SET, and the version bump is emulated there
+     * because update() (unlike save()) does not touch @VersionColumn.
+     */
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    const whereClause: JSONObject = updateMock.mock.calls[0]![0] as JSONObject;
+    const setPayload: JSONObject = updateMock.mock.calls[0]![1] as JSONObject;
+    expect(whereClause["_id"]).toBe(scanId.toString());
+    expect(Object.keys(setPayload).sort()).toEqual(
+      ["startedAt", "status", "version"].sort(),
     );
-    expect(savedItem["status"]).toBe("In Progress");
-    expect(savedItem["_id"]).toBe(scanId.toString());
+    expect(setPayload["status"]).toBe("In Progress");
+    expect(setPayload["_id"]).toBeUndefined();
   });
 });

package/Tests/Server/Services/DatabaseServiceUpdateColumnsWithoutHooks.test.ts

@@ -0,0 +1,128 @@
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import RumApplication from "../../../Models/DatabaseModels/RumApplication";
+import ObjectID from "../../../Types/ObjectID";
+import { getJestSpyOn } from "../../Spy";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * Pins `updateColumnsByIdWithoutHooks`' updatedAt behaviour at the SQL
+ * level, because the two sides of it protect different consumers:
+ *
+ *  - By DEFAULT the raw path must refresh updatedAt, preserving the
+ *    behaviour of the normal update pipeline it replaces — anything
+ *    watching row freshness (the RUM "connected" pill via lastSeenAt
+ *    heartbeats) relies on it.
+ *  - With `skipUpdateDateColumn` it must NOT: the session replay
+ *    configEpoch is DERIVED from RumApplication.updatedAt
+ *    (SessionReplayGateCache.getConfigEpoch), so a passive health
+ *    heartbeat that refreshed updatedAt would broadcast "configuration
+ *    changed" to every live recorder once a minute.
+ *
+ * Inverting either branch is invisible to every other suite — the health
+ * markers are mocked at their call sites — so the generated SQL is pinned
+ * here directly.
+ */
+
+const APPLICATION_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
+interface CapturedQuery {
+  sql: string;
+  params: Array<unknown>;
+}
+
+describe("DatabaseService.updateColumnsByIdWithoutHooks", () => {
+  let service: DatabaseService<RumApplication>;
+  let captured: Array<CapturedQuery>;
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    captured = [];
+
+    service = new DatabaseService<RumApplication>(RumApplication);
+
+    const columns: Record<string, string> = {
+      sessionReplayLastChunkReceivedAt: "sessionReplayLastChunkReceivedAt",
+      sessionReplayBudgetExceededAt: "sessionReplayBudgetExceededAt",
+      lastSeenAt: "lastSeenAt",
+      _id: "_id",
+      updatedAt: "updatedAt",
+    };
+
+    getJestSpyOn(service, "getRepository").mockReturnValue({
+      metadata: {
+        tableName: "RumApplication",
+        findColumnWithPropertyName: (
+          propertyName: string,
+        ): { databaseName: string } | undefined => {
+          return columns[propertyName]
+            ? { databaseName: columns[propertyName]! }
+            : undefined;
+        },
+        updateDateColumn: { databaseName: "updatedAt" },
+        primaryColumns: [{ databaseName: "_id" }],
+      },
+      manager: {
+        connection: {
+          driver: {
+            preparePersistentValue: (value: unknown): unknown => {
+              return value;
+            },
+          },
+        },
+        query: async (
+          sql: string,
+          params: Array<unknown>,
+        ): Promise<Array<unknown>> => {
+          captured.push({ sql, params });
+          return [];
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any);
+  });
+
+  it("refreshes updatedAt by default, preserving the normal pipeline's behaviour", async () => {
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { lastSeenAt: new Date() },
+    });
+
+    expect(captured).toHaveLength(1);
+    expect(captured[0]!.sql).toContain(`"updatedAt" = CURRENT_TIMESTAMP`);
+  });
+
+  it("leaves updatedAt untouched when skipUpdateDateColumn is set", async () => {
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { sessionReplayLastChunkReceivedAt: new Date() },
+      skipUpdateDateColumn: true,
+    });
+
+    expect(captured).toHaveLength(1);
+    expect(captured[0]!.sql).not.toContain("updatedAt");
+  });
+
+  it("never bumps the optimistic-lock version column in either mode", async () => {
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { sessionReplayBudgetExceededAt: new Date() },
+      skipUpdateDateColumn: true,
+    });
+
+    expect(captured[0]!.sql).not.toContain("version");
+  });
+
+  it("scopes the update to the one row by primary key", async () => {
+    await service.updateColumnsByIdWithoutHooks({
+      id: APPLICATION_ID,
+      data: { lastSeenAt: new Date() },
+    });
+
+    expect(captured[0]!.sql).toMatch(/WHERE "_id" = \$\d+$/);
+    expect(captured[0]!.params[captured[0]!.params.length - 1]).toBe(
+      APPLICATION_ID.toString(),
+    );
+  });
+});

package/Tests/Server/Services/DatabaseServiceUpdateWriteRouting.test.ts

@@ -0,0 +1,178 @@
+import NetworkDeviceDiscoveryScanService from "../../../Server/Services/NetworkDeviceDiscoveryScanService";
+import ModelPermission from "../../../Server/Types/Database/Permissions/Index";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import NetworkDeviceDiscoveryScan from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import Probe from "../../../Models/DatabaseModels/Probe";
+import ObjectID from "../../../Types/ObjectID";
+import { JSONObject } from "../../../Types/JSON";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * Regression tests for the write-routing contract introduced by
+ * "updates must never resurrect concurrently-deleted rows".
+ *
+ * DatabaseService._updateBy chooses its persistence primitive by whether the
+ * sanitized update data touches an EntityArray (many-to-many) column:
+ *
+ *   - everything else -> repository.update(): a WHERE-clause UPDATE that
+ *     never INSERTs, so a row hard-deleted between the internal find and the
+ *     write simply gets zero rows affected instead of being resurrected as a
+ *     zombie. The @VersionColumn bump save() did for free is emulated with an
+ *     atomic `"version" + 1` SQL expression in the SET.
+ *
+ *   - updates touching an EntityArray column -> repository.save(): only
+ *     many-to-many writes need TypeORM's junction-table handling.
+ *
+ * Entity (many-to-one) columns deliberately take the update() path. They are
+ * ordinary foreign-key columns on the row itself, and TypeORM resolves a
+ * relation property to its join columns. Routing them to save() left the
+ * resurrection hole open for any caller expressing the write as the relation
+ * member instead of the scalar id — Monitor.currentMonitorStatus and
+ * Monitor.currentMonitorStatusId are two decorated members over the SAME
+ * physical column, and a save() through the former could re-INSERT a
+ * concurrently-deleted Monitor, permanently blocking deletion of the
+ * MonitorStatus it pointed at.
+ *
+ * These tests pin the routing itself (which primitive fires for which data
+ * shape), which is the exact behaviour a future refactor of _updateBy could
+ * silently break. NetworkDeviceDiscoveryScan has a plain scalar column
+ * (`status`) and an Entity relation column (`probe`); Monitor supplies the
+ * EntityArray case (`labels`) and the two-members-one-column case.
+ */
+
+type ScanUpdateData = UpdateBy<NetworkDeviceDiscoveryScan>["data"];
+
+describe("DatabaseService._updateBy — save() vs update() write routing", () => {
+  let saveMock: MockFunction;
+  let updateMock: MockFunction;
+  let scanId: ObjectID;
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    scanId = ObjectID.generate();
+
+    const foundItem: NetworkDeviceDiscoveryScan =
+      new NetworkDeviceDiscoveryScan();
+    foundItem._id = scanId.toString();
+
+    jest
+      .spyOn(NetworkDeviceDiscoveryScanService as any, "_findBy")
+      .mockResolvedValue([foundItem] as never);
+
+    saveMock = getJestMockFunction();
+    saveMock.mockImplementation((item: unknown) => {
+      return Promise.resolve(item);
+    });
+    updateMock = getJestMockFunction();
+    updateMock.mockImplementation(() => {
+      return Promise.resolve({ affected: 1 });
+    });
+    jest
+      .spyOn(NetworkDeviceDiscoveryScanService, "getRepository")
+      .mockReturnValue({ save: saveMock, update: updateMock } as never);
+
+    // The permission layer needs a DB and is not what these tests exercise.
+    jest
+      .spyOn(ModelPermission, "checkUpdatePermissionByModel")
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(ModelPermission, "checkUpdateQueryPermissions")
+      .mockImplementation(((
+        _modelType: unknown,
+        query: unknown,
+      ): Promise<unknown> => {
+        return Promise.resolve(query);
+      }) as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a scalar-only update goes through update(), never save()", async () => {
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: scanId,
+      data: { status: "In Progress" } as ScanUpdateData,
+      props: { isRoot: true },
+    });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+  });
+
+  test("the scalar update() targets the located _id and never puts _id in the SET", async () => {
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: scanId,
+      data: { status: "In Progress" } as ScanUpdateData,
+      props: { isRoot: true },
+    });
+
+    const whereClause: JSONObject = updateMock.mock.calls[0]![0] as JSONObject;
+    const setPayload: JSONObject = updateMock.mock.calls[0]![1] as JSONObject;
+
+    expect(whereClause["_id"]).toBe(scanId.toString());
+    expect(setPayload["status"]).toBe("In Progress");
+    expect(setPayload["_id"]).toBeUndefined();
+  });
+
+  test("the scalar update() emulates the version bump with an SQL expression, not a literal", async () => {
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: scanId,
+      data: { status: "In Progress" } as ScanUpdateData,
+      props: { isRoot: true },
+    });
+
+    const setPayload: JSONObject = updateMock.mock.calls[0]![1] as JSONObject;
+    const versionValue: unknown = setPayload["version"];
+
+    /*
+     * A function (SQL expression thunk) is what keeps the bump atomic and
+     * race-free; a plain number would clobber a concurrent writer's bump.
+     */
+    expect(typeof versionValue).toBe("function");
+    expect((versionValue as () => string)()).toBe('"version" + 1');
+  });
+
+  test("an Entity (many-to-one) column takes update(), not save() — it is just an FK on this row", async () => {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = "Completed";
+    scan.probe = new Probe(ObjectID.generate());
+
+    await NetworkDeviceDiscoveryScanService.updateOneById({
+      id: scanId,
+      data: scan as unknown as ScanUpdateData,
+      props: { isRoot: true },
+    });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+  });
+
+  test("a row deleted between the find and the write is not resurrected and reports no rows affected", async () => {
+    updateMock.mockImplementation(() => {
+      // The concurrent hard delete already removed the row.
+      return Promise.resolve({ affected: 0 });
+    });
+
+    const updatedCount: number =
+      await NetworkDeviceDiscoveryScanService.updateOneById({
+        id: scanId,
+        data: { status: "In Progress" } as ScanUpdateData,
+        props: { isRoot: true },
+      });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+    expect(updatedCount).toBe(0);
+  });
+});

package/Tests/Server/Services/DatabaseServiceUpdateWriteRoutingMonitor.test.ts

@@ -0,0 +1,206 @@
+import MonitorService from "../../../Server/Services/MonitorService";
+import ModelPermission from "../../../Server/Types/Database/Permissions/Index";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import Label from "../../../Models/DatabaseModels/Label";
+import ObjectID from "../../../Types/ObjectID";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * Companion to DatabaseServiceUpdateWriteRouting.test.ts, exercising the
+ * write-routing contract on the model that the "updates must never resurrect
+ * concurrently-deleted rows" work was actually chasing: Monitor.
+ *
+ * The routing rule is: DatabaseService._updateBy sends an update through
+ * repository.save() ONLY when the sanitized data touches an EntityArray
+ * (many-to-many) column, and through repository.update() otherwise.
+ *
+ * Two Monitor-specific shapes are pinned here that the sibling suite (built on
+ * NetworkDeviceDiscoveryScan) cannot express:
+ *
+ *   1. labels — a real EntityArray column. It MUST route to save(), because a
+ *      many-to-many write needs TypeORM's junction-table handling. The sibling
+ *      suite only ever asserts save() is NOT called; nothing anywhere asserts
+ *      the positive half of the contract, so a refactor that routed EntityArray
+ *      to update() (silently breaking label writes) would pass every test. This
+ *      closes that hole.
+ *
+ *   2. currentMonitorStatus vs currentMonitorStatusId — two decorated members
+ *      over the SAME physical FK column. Expressing the write as the relation
+ *      member (an Entity, many-to-one) must still take update(), never save():
+ *      routing it to save() is exactly what let a concurrent monitor delete be
+ *      resurrected as a zombie that then held the MonitorStatus FK forever.
+ *
+ * onBeforeUpdate is stubbed: it performs project-scoped reference validation
+ * that needs a live DB, which is not what these tests exercise.
+ */
+
+describe("DatabaseService._updateBy — Monitor write routing (save vs update)", () => {
+  let saveMock: MockFunction;
+  let updateMock: MockFunction;
+  let onUpdateSuccessMock: MockFunction;
+  let monitorId: ObjectID;
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    monitorId = ObjectID.generate();
+
+    const foundItem: Monitor = new Monitor();
+    foundItem._id = monitorId.toString();
+
+    jest
+      .spyOn(MonitorService as any, "_findBy")
+      .mockResolvedValue([foundItem] as never);
+
+    /*
+     * onBeforeUpdate validates that referenced ids belong to the project,
+     * which needs a DB. Bypass it — the routing decision it feeds into is the
+     * subject under test, not the validation.
+     */
+    jest.spyOn(MonitorService as any, "onBeforeUpdate").mockImplementation(((
+      updateBy: UpdateBy<Monitor>,
+    ): Promise<unknown> => {
+      return Promise.resolve({ updateBy, carryForward: null });
+    }) as never);
+
+    /*
+     * onUpdateSuccess is a post-write hook (status-change side effects,
+     * dashboard links) that fires AFTER the save()/update() routing has already
+     * happened. It needs a live DB; stub it so the routing assertions run in
+     * isolation.
+     */
+    onUpdateSuccessMock = getJestMockFunction();
+    onUpdateSuccessMock.mockImplementation((onUpdate: unknown) => {
+      return Promise.resolve(onUpdate);
+    });
+    jest
+      .spyOn(MonitorService as any, "onUpdateSuccess")
+      .mockImplementation(onUpdateSuccessMock as never);
+
+    saveMock = getJestMockFunction();
+    saveMock.mockImplementation((item: unknown) => {
+      return Promise.resolve(item);
+    });
+    updateMock = getJestMockFunction();
+    updateMock.mockImplementation(() => {
+      return Promise.resolve({ affected: 1 });
+    });
+    jest
+      .spyOn(MonitorService, "getRepository")
+      .mockReturnValue({ save: saveMock, update: updateMock } as never);
+
+    jest
+      .spyOn(ModelPermission, "checkUpdatePermissionByModel")
+      .mockResolvedValue(undefined as never);
+    jest
+      .spyOn(ModelPermission, "checkUpdateQueryPermissions")
+      .mockImplementation(((
+        _modelType: unknown,
+        query: unknown,
+      ): Promise<unknown> => {
+        return Promise.resolve(query);
+      }) as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The Monitor update-data type is a deep recursive generic; referencing it in
+   * a cast trips TS2589 ("excessively deep"). Build a real Monitor instance for
+   * each case and hand the whole call argument over as `any` — the routing code
+   * under test reads runtime column metadata, not the static type.
+   */
+  const updateMonitorWith: (
+    mutate: (m: Monitor) => void,
+  ) => Promise<void> = async (mutate: (m: Monitor) => void): Promise<void> => {
+    const monitor: Monitor = new Monitor();
+    mutate(monitor);
+    await MonitorService.updateOneById({
+      id: monitorId,
+      data: monitor,
+      props: { isRoot: true },
+    } as any);
+  };
+
+  test("updating labels (EntityArray) routes to save(), never update()", async () => {
+    await updateMonitorWith((m: Monitor) => {
+      m.labels = [new Label(ObjectID.generate())];
+    });
+
+    expect(saveMock).toHaveBeenCalledTimes(1);
+    expect(updateMock).not.toHaveBeenCalled();
+  });
+
+  test("updating currentMonitorStatusId (scalar FK) routes to update(), never save()", async () => {
+    await updateMonitorWith((m: Monitor) => {
+      m.currentMonitorStatusId = ObjectID.generate();
+    });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+  });
+
+  test("updating currentMonitorStatus (the relation member of a many-to-one) still routes to update(), never save()", async () => {
+    await updateMonitorWith((m: Monitor) => {
+      /*
+       * currentMonitorStatus and currentMonitorStatusId are the SAME physical
+       * column. A save() here could re-INSERT a concurrently-deleted Monitor;
+       * update() simply affects zero rows when the target is gone.
+       */
+      m.currentMonitorStatus = new MonitorStatus(ObjectID.generate());
+    });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+  });
+
+  test("a mixed scalar + EntityArray update still needs save() for the junction write", async () => {
+    await updateMonitorWith((m: Monitor) => {
+      m.disableActiveMonitoring = true;
+      m.labels = [new Label(ObjectID.generate())];
+    });
+
+    expect(saveMock).toHaveBeenCalledTimes(1);
+    expect(updateMock).not.toHaveBeenCalled();
+  });
+
+  test("a scalar update whose row was hard-deleted mid-write hands onUpdateSuccess no phantom ids", async () => {
+    /*
+     * Simulate the concurrent hard delete: the located row is gone by the time
+     * the WHERE-clause UPDATE runs, so Postgres reports zero rows affected.
+     */
+    updateMock.mockImplementation(() => {
+      return Promise.resolve({ affected: 0 });
+    });
+
+    await updateMonitorWith((m: Monitor) => {
+      m.currentMonitorStatusId = ObjectID.generate();
+    });
+
+    expect(updateMock).toHaveBeenCalledTimes(1);
+    expect(saveMock).not.toHaveBeenCalled();
+
+    /*
+     * onUpdateSuccess must still fire (subclasses depend on it), but with an
+     * EMPTY id list: a row that was deleted mid-update must never be handed to
+     * the hook, which would re-read it and dereference null.
+     */
+    expect(onUpdateSuccessMock).toHaveBeenCalledTimes(1);
+    const idsPassedToHook: Array<ObjectID> = onUpdateSuccessMock.mock
+      .calls[0]![1] as Array<ObjectID>;
+    expect(idsPassedToHook).toEqual([]);
+  });
+});