domma-cms 1.16.0 → 1.16.2

package/server/routes/api/menus.js

@@ -5,7 +5,7 @@
  * GET    /api/menus/_count           - the sidebar badge (the underscore can never be a slug)
  * GET    /api/menus/:slug            - full menu
  * POST   /api/menus                  - create
- * PUT    /api/menus/:slug            - replace
+ * PUT    /api/menus/:slug            - replace (409 if `revision` is given and the menu has changed since)
  * DELETE /api/menus/:slug            - delete (409 if mapped to a slot)
  * POST   /api/menus/:slug/duplicate  - copy as <slug>-copy
  *
@@ -26,6 +26,7 @@ import {
     getLocations,
     getMenu,
     listMenus,
+    menuRevision,
     updateMenu
 } from '../../services/menus.js';
 import * as cache from '../../services/cache/index.js';
@@ -110,7 +111,8 @@ export async function menusRoutes(fastify, opts = {}) {
         if (!canSeeArtefact(request.user, menu)) {
             return reply.status(403).send({error: 'Access denied for this project'});
         }
-        return menu;
+        // The fingerprint the editor sends back on save (see menuRevision).
+        return {...menu, revision: menuRevision(menu)};
     });
 
     fastify.post('/menus', canCreate, async (request, reply) => {
@@ -126,10 +128,12 @@ export async function menusRoutes(fastify, opts = {}) {
 
     fastify.put('/menus/:slug', canUpdate, async (request, reply) => {
         try {
-            const menu = await updateMenu(request.params.slug, request.body || {});
+            const {revision, ...body} = request.body || {};
+            const menu = await updateMenu(request.params.slug, body, {baseRevision: revision});
             await cache.invalidateTags([`menu:${menu.slug}`, 'nav']);
-            return menu;
+            return {...menu, revision: menuRevision(menu)};
         } catch (err) {
+            if (err.code === 'MENU_STALE') return reply.status(409).send({error: err.message, stale: true});
             const status = /not found/.test(err.message) ? 404 : 400;
             return reply.status(status).send({error: err.message});
         }

package/server/services/menus.js

@@ -8,6 +8,7 @@
  * concept from the map) is held in process memory and seeded by core +
  * plugin hooks at startup.
  */
+import {createHash} from 'crypto';
 import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
@@ -645,18 +646,42 @@ export async function createMenu(input) {
     return menu;
 }
 
+/**
+ * A short fingerprint of a menu as stored. The editor sends back the one it
+ * loaded, so a save over a menu changed since - in another tab, by someone
+ * else, or by hand on the server - is caught instead of quietly undone. It
+ * hashes the whole file, not meta.updatedAt, because a hand edit leaves that
+ * date alone.
+ *
+ * @param   {object} menu
+ * @returns {string}
+ */
+export function menuRevision(menu) {
+    return createHash('sha256').update(JSON.stringify(menu)).digest('hex').slice(0, 16);
+}
+
 /**
  * Replace an existing menu. Preserves meta.createdAt; updates meta.updatedAt.
  * The slug in the path wins over any slug in the body.
  *
+ * `opts.baseRevision` is the revision the caller loaded (menuRevision); when
+ * given and the menu has changed since, nothing is written and the error
+ * carries `code: 'MENU_STALE'`. Leave it out to overwrite regardless.
+ *
  * @param   {string} slug
  * @param   {object} input
+ * @param   {{baseRevision?: string}} [opts]
  * @returns {Promise<object>} the persisted menu
- * @throws  {Error} if the menu does not exist
+ * @throws  {Error} if the menu does not exist, or has changed since baseRevision
  */
-export async function updateMenu(slug, input) {
+export async function updateMenu(slug, input, opts = {}) {
     const existing = await getMenu(slug);
     if (!existing) throw new Error(`Menu "${slug}" not found`);
+    if (opts.baseRevision && opts.baseRevision !== menuRevision(existing)) {
+        const err = new Error(`Menu "${slug}" has changed since it was opened`);
+        err.code = 'MENU_STALE';
+        throw err;
+    }
     const binding = normaliseBinding(input.binding);
     const errors = validateMenu({...input, slug, binding});
     if (errors.length) {