create-feltdb 0.6.14 → 0.7.1

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -41,7 +41,7 @@ use feltdb::{
         Grant, GrantSigner, GrantStore, Subject as GrantSubject,
     },
     cardinality_endpoint::{CardinalityContext, CardinalityDiagnosticResponse},
-    AtomicMutation, AtomicPrecondition,
+    AtomicMutation,
     policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     state_contract::{
         begin_read, compare_schemas, execute_query as execute_state_query, execute_transaction,
@@ -57,7 +57,7 @@ use feltdb::{
         WorkerRegistration,
     },
     workload::{CreateWorkload, WorkloadStore},
-    DatabaseSnapshot, FeltDb, JsonCasResult, Operation, PeerAdvertisement, PeerId, StoredRow,
+    DatabaseSnapshot, FeltDb, JsonCasResult, Operation, PeerAdvertisement, PeerId, StoredRow, FlowError, RecordPrecondition,
 };
 use feltdb_server::{
     app_state::AppState,
@@ -103,6 +103,16 @@ const PROTOCOL_VERSION: &str = "1";
 #[derive(Debug)]
 struct ApiError(StatusCode, String);
 
+impl ApiError {
+    /// An error whose body is a structured document rather than a message.
+    ///
+    /// `api_error_body` already parses a message that happens to be JSON, so
+    /// this is the existing mechanism named rather than a second one.
+    fn structured(status: StatusCode, body: Value) -> Self {
+        Self(status, serde_json::to_string(&body).unwrap_or_else(|_| body.to_string()))
+    }
+}
+
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
         let body = api_error_body(self.0, self.1);
@@ -9039,6 +9049,38 @@ struct AtomicTxOperationRequest {
     /// When set, the record must not already exist for the transaction to commit.
     #[serde(default)]
     require_absent: bool,
+    /// Fence this write on the record's current `__version`.
+    ///
+    /// Present because the client declares it; it was previously accepted by
+    /// serde and silently discarded, so a caller could attach a stale version
+    /// to a staged write and watch the transaction commit anyway.
+    #[serde(default)]
+    expected_version: Option<u64>,
+    #[serde(default)]
+    expected_epoch: Option<u64>,
+    #[serde(default)]
+    expected_lease_id: Option<String>,
+}
+
+/// A precondition on a record the transaction does not necessarily write.
+///
+/// Explicit rather than overloaded onto an operation, because read/decide/write
+/// fencing routinely guards on a record it does not modify -- a session
+/// generation, an ownership epoch -- and expressing that as a no-op write would
+/// make the guard a mutation.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct AtomicTxPreconditionRequest {
+    collection: String,
+    id: String,
+    #[serde(default)]
+    require_absent: bool,
+    #[serde(default)]
+    expected_version: Option<u64>,
+    #[serde(default)]
+    expected_epoch: Option<u64>,
+    #[serde(default)]
+    expected_lease_id: Option<String>,
 }
 
 #[derive(Deserialize)]
@@ -9047,6 +9089,11 @@ struct AtomicTxRequest {
     /// Caller-supplied identity. Reusing one makes the commit idempotent.
     transaction_id: String,
     operations: Vec<AtomicTxOperationRequest>,
+    /// Conditions the authority evaluates inside the same atomic boundary as
+    /// the writes. Absent means an unconditional transaction, which behaves
+    /// exactly as before.
+    #[serde(default)]
+    preconditions: Vec<AtomicTxPreconditionRequest>,
 }
 
 #[derive(Serialize)]
@@ -9087,8 +9134,35 @@ async fn commit_transaction(
     // Validate every operation before any of them is turned into a mutation, so
     // a malformed request cannot commit a prefix of the transaction.
     let mut mutations = Vec::with_capacity(request.operations.len());
-    let mut preconditions = Vec::new();
+    let mut record_preconditions: Vec<RecordPrecondition> = Vec::new();
     let mut seen = std::collections::HashSet::new();
+
+    // Transaction-level preconditions first, on records the transaction need
+    // not write at all.
+    for condition in &request.preconditions {
+        let key = record_key(&condition.collection, &condition.id)?;
+        let precondition = RecordPrecondition {
+            capability: condition.collection.clone(),
+            key,
+            require_absent: condition.require_absent,
+            expected_version: condition.expected_version,
+            expected_epoch: condition.expected_epoch,
+            expected_lease_id: condition.expected_lease_id.clone(),
+        };
+        if precondition.is_empty() {
+            // Refused rather than ignored. A precondition that constrains
+            // nothing reads as protection and provides none, and silently
+            // accepting one is how this whole class of defect happens.
+            return Err(ApiError(
+                StatusCode::BAD_REQUEST,
+                format!(
+                    "precondition on {}/{} constrains nothing",
+                    condition.collection, condition.id
+                ),
+            ));
+        }
+        record_preconditions.push(precondition);
+    }
     for operation in request.operations {
         let key = record_key(&operation.collection, &operation.id)?;
         if !seen.insert(key.clone()) {
@@ -9098,14 +9172,32 @@ async fn commit_transaction(
             ));
         }
         if operation.require_absent {
-            // The store reads a precondition with no expected version as
-            // "this record must not exist", and evaluates it inside the same
-            // lock as the commit, so there is no window between the check and
-            // the write.
-            preconditions.push(AtomicPrecondition {
+            // Use the public record-precondition path so a lost creation race
+            // is both evaluated under the store lock and returned as a
+            // structured presence conflict. The same condition tells the
+            // authority to assign document version 1 to the created value.
+            record_preconditions.push(RecordPrecondition {
                 capability: operation.collection.clone(),
                 key: key.clone(),
+                require_absent: true,
                 expected_version: None,
+                expected_epoch: None,
+                expected_lease_id: None,
+            });
+        }
+        // A guard attached to a staged write. Previously declared by the
+        // client, accepted by serde, and dropped here.
+        if operation.expected_version.is_some()
+            || operation.expected_epoch.is_some()
+            || operation.expected_lease_id.is_some()
+        {
+            record_preconditions.push(RecordPrecondition {
+                capability: operation.collection.clone(),
+                key: key.clone(),
+                require_absent: false,
+                expected_version: operation.expected_version,
+                expected_epoch: operation.expected_epoch,
+                expected_lease_id: operation.expected_lease_id.clone(),
             });
         }
         let value = operation.value.map(|mut fields| {
@@ -9122,11 +9214,33 @@ async fn commit_transaction(
     let operations = mutations.len();
     let commit = state
         .db
-        .apply_atomic_transaction(&request.transaction_id, None, &preconditions, &mutations, None)
+        .apply_atomic_transaction_guarded(
+            &request.transaction_id,
+            None,
+            None,
+            &[],
+            &record_preconditions,
+            &mutations,
+            None,
+        )
         .map_err(|error| {
             // A refused transaction applied nothing, so this is a conflict, not
-            // a partially completed request.
-            ApiError(StatusCode::CONFLICT, error.to_string())
+            // a partially completed request. A precondition failure carries
+            // which predicate failed and what the authority holds, so a caller
+            // can tell a lost race from a broken deployment without parsing
+            // prose.
+            match error {
+                FlowError::PreconditionFailed(failure) => ApiError::structured(
+                    StatusCode::CONFLICT,
+                    json!({
+                        "committed": false,
+                        "code": "PRECONDITION_FAILED",
+                        "error": failure.to_string(),
+                        "failure": *failure,
+                    }),
+                ),
+                other => ApiError(StatusCode::CONFLICT, other.to_string()),
+            }
         })?;
 
     Ok((

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.6.14",
+  "version": "0.7.1",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"