@things-factory/board-service 10.1.47 → 10.1.104

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/board-service",
-  "version": "10.1.47",
+  "version": "10.1.104",
   "main": "dist-server/index.js",
   "browser": "client/index.js",
   "things-factory": true,
@@ -25,14 +25,14 @@
   },
   "dependencies": {
     "@hatiolab/things-scene": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.47",
+    "@things-factory/auth-base": "^10.1.79",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/fav-base": "^10.1.47",
-    "@things-factory/font-base": "^10.1.47",
-    "@things-factory/integration-base": "^10.1.47",
+    "@things-factory/fav-base": "^10.1.79",
+    "@things-factory/font-base": "^10.1.79",
+    "@things-factory/integration-base": "^10.1.104",
     "@things-factory/operato-license-checker": "^4.0.4",
     "content-disposition": "^0.5.3",
     "pdfjs-dist": "^5.0.375"
   },
-  "gitHead": "185f20d7d9a15715a0ee2757a6a8189ec36cfb9d"
+  "gitHead": "0d05c7573220c6da2dec2654a4b86d7bd8e3c4fb"
 }

package/tests/board-claim-postgres.test.ts

@@ -0,0 +1,83 @@
+import { join } from 'path'
+
+/**
+ * The board save claim on postgres (ADR-0098, architect ruling 2026-09-27): postgres keeps microseconds
+ * while the editor holds milliseconds, and two saves that read the same moment arrive together. Concurrency
+ * is proven on postgres, where the row lock decides; sqlite's single writer cannot show it.
+ *
+ * Runs when TEST_POSTGRES_URL names an empty database; the schema is dropped and rebuilt.
+ */
+
+const POSTGRES = process.env.TEST_POSTGRES_URL
+
+require('@things-factory/env').config.set('ormconfig', { type: 'postgres' })
+
+const { DataSource } = require('typeorm')
+const { entityClosure } = require(join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs'))
+const DIST = join(__dirname, '..', 'dist-server')
+const { Board } = require(join(DIST, 'service', 'board', 'board.js'))
+const { claimUnchangedSince } = require(join(DIST, 'service', 'board', 'board-claim.js'))
+const shell = require('@things-factory/shell')
+
+const onPostgres = POSTGRES ? describe : describe.skip
+
+onPostgres('board save claim (postgres, TEST_POSTGRES_URL)', () => {
+  let db: any
+  let here: any
+
+  beforeAll(async () => {
+    db = new DataSource({
+      type: 'postgres',
+      url: POSTGRES,
+      synchronize: true,
+      dropSchema: true,
+      namingStrategy: new shell.NamingStrategy(),
+      entities: entityClosure([Board]),
+      logging: false
+    })
+    await db.initialize()
+    shell.addDataSource('default', db)
+    here = await db.getRepository(shell.Domain).save({ name: 'here', subdomain: 'here' })
+  })
+
+  afterAll(async () => {
+    await db?.destroy()
+  })
+
+  const aBoard = async (name: string) => {
+    const saved = await db.getRepository(Board).save({ domain: here, name, model: '{"width":1,"height":1}' })
+    return db.getRepository(Board).findOneBy({ id: saved.id })
+  }
+
+  test('★ a stored time with microseconds is claimed by the millisecond the editor holds', async () => {
+    const board = await aBoard('micro')
+    await db.query(`UPDATE boards SET updated_at = '2026-09-27 01:02:03.456789' WHERE id = $1`, [board.id])
+    const read = (await db.getRepository(Board).findOneBy({ id: board.id })).updatedAt
+    expect(new Date(read).getMilliseconds()).toBe(456)
+
+    expect(await claimUnchangedSince(undefined, here.id, board.id, new Date(read))).toBe(true)
+  })
+
+  test('★ two saves that read the same moment: exactly one is claimed', async () => {
+    const board = await aBoard('race')
+    const read = new Date(board.updatedAt)
+
+    const attempt = () =>
+      db.transaction(async (tx: any) => {
+        const claimed = await claimUnchangedSince(tx, here.id, board.id, read)
+        /* Hold the lock a moment, as a real save does while it writes the model. */
+        await new Promise(resolve => setTimeout(resolve, 50))
+        return claimed
+      })
+
+    const results = await Promise.all([attempt(), attempt(), attempt()])
+    expect(results.filter(Boolean).length).toBe(1)
+  })
+
+  test('a save that read an older one is refused', async () => {
+    const board = await aBoard('older')
+    const read = new Date(board.updatedAt)
+    expect(await claimUnchangedSince(undefined, here.id, board.id, read)).toBe(true)
+    expect(await claimUnchangedSince(undefined, here.id, board.id, read)).toBe(false)
+  })
+})

package/tests/board-claim.test.ts

@@ -0,0 +1,79 @@
+import { join } from 'path'
+
+/**
+ * A board is saved over only by someone who read its last save (ADR-0098, architect ruling 2026-09-27).
+ *
+ * The editor sends the updatedAt it read; the save is claimed in one conditional statement, compared to the
+ * millisecond. Here on sqlite through the real entity; the same claim is run on postgres, with two saves at
+ * once, in board-claim-postgres.test.ts.
+ */
+
+const { createSqliteTestDataSource } = require(
+  join(__dirname, '..', '..', 'ops-master', 'test', 'support', 'database.cjs')
+)
+const DIST = join(__dirname, '..', 'dist-server')
+const { Board } = require(join(DIST, 'service', 'board', 'board.js'))
+const { claimUnchangedSince } = require(join(DIST, 'service', 'board', 'board-claim.js'))
+const shell = require('@things-factory/shell')
+
+let db: any
+let here: any
+let elsewhere: any
+
+beforeAll(async () => {
+  db = createSqliteTestDataSource([Board])
+  await db.initialize()
+  shell.addDataSource('default', db)
+  here = await db.getRepository(shell.Domain).save({ name: 'here', subdomain: 'here' })
+  elsewhere = await db.getRepository(shell.Domain).save({ name: 'elsewhere', subdomain: 'elsewhere' })
+})
+
+afterAll(async () => {
+  await db?.destroy()
+})
+
+const aBoard = async (name: string) => {
+  const saved = await db.getRepository(Board).save({ domain: here, name, model: '{"width":1,"height":1}' })
+  return db.getRepository(Board).findOneBy({ id: saved.id })
+}
+
+test('★ the save that read the last save is claimed, and moves updatedAt on', async () => {
+  const board = await aBoard('read-last')
+  expect(await claimUnchangedSince(undefined, here.id, board.id, new Date(board.updatedAt))).toBe(true)
+
+  const after = await db.getRepository(Board).findOneBy({ id: board.id })
+  expect(new Date(after.updatedAt).getTime()).not.toBe(new Date(board.updatedAt).getTime())
+})
+
+test('★ a save that read an older one is refused', async () => {
+  const board = await aBoard('read-older')
+  const read = new Date(board.updatedAt)
+  await new Promise(resolve => setTimeout(resolve, 5))
+  expect(await claimUnchangedSince(undefined, here.id, board.id, read)).toBe(true)
+  expect(await claimUnchangedSince(undefined, here.id, board.id, read)).toBe(false)
+})
+
+test('the millisecond it read is enough - not the one before or after', async () => {
+  const board = await aBoard('window')
+  const at = new Date(board.updatedAt).getTime()
+  expect(await claimUnchangedSince(undefined, here.id, board.id, new Date(at - 1))).toBe(false)
+  expect(await claimUnchangedSince(undefined, here.id, board.id, new Date(at + 1))).toBe(false)
+  expect(await claimUnchangedSince(undefined, here.id, board.id, new Date(at))).toBe(true)
+})
+
+test('another site\'s board is never claimed', async () => {
+  const board = await aBoard('other-site')
+  expect(await claimUnchangedSince(undefined, elsewhere.id, board.id, new Date(board.updatedAt))).toBe(false)
+})
+
+test('★ updateBoard claims before it writes, refuses by name, and never stores the expectation', () => {
+  const { readFileSync } = require('fs')
+  const source = readFileSync(join(__dirname, '..', 'server', 'service', 'board', 'board-mutation.ts'), 'utf-8')
+  const update = source.slice(source.indexOf('  async updateBoard('), source.indexOf('  async releaseBoard('))
+  const claim = update.indexOf('claimUnchangedSince(tx, domain.id, id, new Date(patch.expectedUpdatedAt))')
+  expect(claim).toBeGreaterThan(0)
+  expect(claim).toBeLessThan(update.indexOf('repository.save('))
+  expect(update).toMatch(/throw new Refusal\(\s*'board-changed-since'/)
+  expect(update).toMatch(/const \{ groupId, expectedUpdatedAt, \.\.\.patched \} = patch/)
+  expect(source.slice(0, source.indexOf('  async updateBoard(')).slice(-400)).toMatch(/@UseMiddleware\(SpeakRefusals\)/)
+})

package/translations/en.json

@@ -8,5 +8,6 @@
   "error.group not found": "Group not found.",
   "error.group has boards": "Cannot delete a group that still contains {count} board(s). Move or remove the boards first.",
   "error.play group not found": "Play group not found.",
-  "error.play group has boards": "Cannot delete a play group that still contains {count} board(s). Remove the boards first."
+  "error.play group has boards": "Cannot delete a play group that still contains {count} board(s). Remove the boards first.",
+  "error.board-changed-since": "this board was saved somewhere else after you opened it. open it again and then save."
 }

package/translations/ja.json

@@ -8,5 +8,6 @@
   "error.group has boards": "ボード{count}件が所属するグループは削除できません。先にボードを移動または削除してください。",
   "error.group not found": "グループが見つかりません。",
   "error.play group has boards": "ボード{count}件を含むプレイグループは削除できません。先にボードを削除してください。",
-  "error.play group not found": "プレイグループが見つかりません。"
+  "error.play group not found": "プレイグループが見つかりません。",
+  "error.board-changed-since": "このボードを開いた後、別の場所で保存されました。開き直してから保存してください。"
 }

package/translations/ko.json

@@ -8,5 +8,6 @@
   "error.group not found": "그룹을 찾을 수 없습니다.",
   "error.group has boards": "보드 {count}개가 소속된 그룹은 삭제할 수 없습니다. 먼저 보드를 옮기거나 제거하세요.",
   "error.play group not found": "플레이 그룹을 찾을 수 없습니다.",
-  "error.play group has boards": "보드 {count}개가 담긴 플레이 그룹은 삭제할 수 없습니다. 먼저 보드를 제거하세요."
+  "error.play group has boards": "보드 {count}개가 담긴 플레이 그룹은 삭제할 수 없습니다. 먼저 보드를 제거하세요.",
+  "error.board-changed-since": "이 보드를 연 뒤 다른 곳에서 저장했습니다. 다시 열어 보고 저장하세요."
 }

package/translations/ms.json

@@ -8,5 +8,6 @@
   "error.group has boards": "Kumpulan yang masih mengandungi {count} papan tidak boleh dipadam. Alihkan atau buang papan itu dahulu.",
   "error.group not found": "Kumpulan tidak dijumpai.",
   "error.play group has boards": "Kumpulan main yang masih mengandungi {count} papan tidak boleh dipadam. Buang papan itu dahulu.",
-  "error.play group not found": "Kumpulan main tidak dijumpai."
+  "error.play group not found": "Kumpulan main tidak dijumpai.",
+  "error.board-changed-since": "papan ini telah disimpan di tempat lain selepas anda membukanya. buka semula dan kemudian simpan."
 }

package/translations/zh.json

@@ -8,5 +8,6 @@
   "error.group has boards": "仍有 {count} 个板块的组合无法删除。请先移动或删除这些板块。",
   "error.group not found": "找不到组合。",
   "error.play group has boards": "仍有 {count} 个板块的播放组合无法删除。请先删除这些板块。",
-  "error.play group not found": "找不到播放组合。"
+  "error.play group not found": "找不到播放组合。",
+  "error.board-changed-since": "打开此看板后，它已在其他地方被保存。请重新打开后再保存。"
 }