portal-mojo 0.2.17 → 0.2.18

package/docs/admin-media-rendering.md

@@ -53,7 +53,12 @@ with raw `mojoList` — `SettingModel.normalizeListParams` strips `key`, so the
 model's list hook cannot do this. More than one global row for a key disables
 Save and Reset with a notice naming the ids: `Setting.Meta.ordering = ["key"]`
 leaves the server's `.first()` undefined among duplicates, so editing one could
-change a row the renderer never reads.
+change a row the renderer never reads. Save and Reset also stay disabled until
+the lookup succeeds (pending or failed reads say so beside the buttons), and a
+save with no known row (`saveCategoryValue(category, null, …)`) re-reads first:
+it refuses without writing when that read fails or finds a row, and creates
+only when the list is empty. `resetCategory(category, null)` resolves `null`,
+meaning nothing was reset.
 
 **Write:** the whole category as one object — `POST /api/settings` to create
 (`{key, is_secret: false, group: null, value}`) or `POST /api/settings/<id>`

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "portal-mojo",
-    "version": "0.2.17",
+    "version": "0.2.18",
     "description": "React portal toolkit for django-mojo — typed client + params store, mission-control UI, dependency-free SVG charts, admin section bundles.",
     "type": "module",
     "license": "Apache-2.0",

package/src/admin/storage/MediaRenderingPage.tsx

@@ -94,9 +94,10 @@ function RoleField({ category, draft, role, kind, name, error, disabled, onChang
 function CategoryPanel({ category, categoryKey }: { category: RenditionCategory; categoryKey: string }) {
     const queryClient = useQueryClient();
     const rowsQuery = useQuery({ queryKey: rowQueryKey(category.key), queryFn: () => findCategoryRows(category.key), retry: false, refetchOnWindowFocus: false });
-    const rows = rowsQuery.data ?? [];
-    const row: SettingRow | null = rows[0] ?? null;
-    const duplicates = rows.length > 1;
+    // Rows only from a successful read: a failed or pending read is "unknown", never "no row".
+    const rows = rowsQuery.isSuccess ? rowsQuery.data : null;
+    const row: SettingRow | null = rows?.[0] ?? null;
+    const duplicates = (rows?.length ?? 0) > 1;
     const [draft, setDraft] = useState<CategoryDraft>(() => valueToDraft(category, category.override));
     const [errors, setErrors] = useState<Record<string, string>>({});
     const [formError, setFormError] = useState('');
@@ -134,6 +135,7 @@ function CategoryPanel({ category, categoryKey }: { category: RenditionCategory;
         setErrors((current) => ({ ...current, [key]: routed.message }));
     };
     const save = async () => {
+        if (!rowsQuery.isSuccess || duplicates) return;
         setBusy(true); setFormError(''); setErrors({});
         try {
             await saveCategoryValue(category, row, value);
@@ -146,6 +148,7 @@ function CategoryPanel({ category, categoryKey }: { category: RenditionCategory;
         }
     };
     const reset = async () => {
+        if (!rowsQuery.isSuccess || duplicates) return;
         const ok = await modal.confirm({
             title: `Reset ${renditionCategoryLabel(categoryKey).toLowerCase()} rendering to defaults?`,
             message: 'Every role goes back to the framework defaults and the default set of roles runs on upload. Existing files are not touched.',
@@ -155,8 +158,9 @@ function CategoryPanel({ category, categoryKey }: { category: RenditionCategory;
         if (!ok) return;
         setBusy(true); setFormError(''); setErrors({});
         try {
-            await resetCategory(category, row);
-            toast.success(`${renditionCategoryLabel(categoryKey)} rendering reset to defaults`);
+            const resetRow = await resetCategory(category, row);
+            if (resetRow) toast.success(`${renditionCategoryLabel(categoryKey)} rendering reset to defaults`);
+            else toast.info('There was no stored override to reset.');
             await refresh();
         } catch (reason) {
             fail(reason);
@@ -165,14 +169,17 @@ function CategoryPanel({ category, categoryKey }: { category: RenditionCategory;
         }
     };
 
-    const disabled = busy || duplicates || rowsQuery.isPending;
+    const disabled = busy || duplicates || !rowsQuery.isSuccess;
+    const status = rowsQuery.isPending ? 'Reading the current override…'
+        : rowsQuery.isError ? 'The current override could not be read — Save is disabled until it loads.'
+        : row ? `Override row #${row.id}` : 'No override row yet — Save creates one.';
     return <div className="media-rendering-panel">
         {hasH265 && <p className="media-rendering-note">
             <b>H.265 (HEVC)</b> encodes take several times longer than H.264 and do not play in every browser. Keep <code>video_mp4</code> as the H.264 compatibility rendition and enable <code>video_hevc</code> on upload only when the extra encode time is worth it.
         </p>}
         {rowsQuery.error && <div className="form-alert" role="alert">The current override could not be read: {rowsQuery.error.message} <button className="btn btn-compact" onClick={() => void rowsQuery.refetch()}>Retry</button></div>}
         {duplicates && <div className="form-alert" role="alert">
-            More than one global row exists for <code>{category.key}</code> (ids {rows.map((entry) => entry.id).join(', ')}). The server reads an undefined one, so this page will not edit them; remove the duplicates on the server first.
+            More than one global row exists for <code>{category.key}</code> (ids {rows?.map((entry) => entry.id).join(', ')}). The server reads an undefined one, so this page will not edit them; remove the duplicates on the server first.
         </div>}
         {formError && <div className="form-alert" role="alert">{formError}</div>}
         <div className="media-rendering-roles">
@@ -210,7 +217,7 @@ function CategoryPanel({ category, categoryKey }: { category: RenditionCategory;
         <div className="media-rendering-actions">
             <button className="btn btn-primary" disabled={disabled || !dirty} onClick={() => void save()}>{busy ? 'Saving…' : 'Save'}</button>
             <button className="btn" disabled={disabled || !row || category.override == null} onClick={() => void reset()}>Reset to defaults…</button>
-            <span className="dim">{row ? `Override row #${row.id}` : 'No override row yet — Save creates one.'}</span>
+            <span className="dim">{status}</span>
         </div>
     </div>;
 }

package/src/admin/storage/rendition-settings.ts

@@ -6,7 +6,7 @@
 // Everything about roles, fields, choices and limits comes from the
 // descriptor. The ONE rule this module hardcodes is the mp4-only trio
 // (`codec`/`crf`/`preset`), which the server refuses on a non-mp4 role.
-import { mojoCall, mojoList, mojoSave, withFreshAuth } from '../../client/runtime';
+import { isReauthRequired, mojoCall, mojoList, mojoSave, withFreshAuth } from '../../client/runtime';
 import type { SettingRow } from '../settings/model';
 
 export type RenditionCategoryKey = 'image' | 'video' | 'document';
@@ -251,13 +251,36 @@ export function routeRenditionError(message: string, knownRoles: readonly string
     return { role: role!, field: field ?? null, message: rest! };
 }
 
-/** Create or update the category's global row. Imperative; a failure rejects. */
+/**
+ * Create or update the category's global row. Imperative; a failure rejects.
+ * With `row === null` the handler proves the row is absent before creating:
+ * it re-reads the global rows and refuses (no write) when that read fails or
+ * finds a row, so no caller creates one blind. The read and the create are
+ * separate requests: two admins saving at the same moment can still both
+ * create (#8200 Challenge row 2); server-side uniqueness is #8201.
+ */
 export async function saveCategoryValue(category: RenditionCategory, row: SettingRow | null, value: Record<string, unknown>): Promise<SettingRow> {
     const changes: Record<string, unknown> = row ? { value } : { key: category.key, is_secret: false, group: null, value };
-    return withFreshAuth(() => mojoSave<SettingRow>('/api/settings', row?.id ?? null, changes));
+    return withFreshAuth(async () => {
+        if (!row) {
+            let existing: SettingRow[];
+            try {
+                existing = await findCategoryRows(category.key);
+            } catch (error) {
+                // A step-up refusal goes back to withFreshAuth, which re-runs the read after re-login.
+                if (isReauthRequired(error)) throw error;
+                throw new Error('The current override could not be read, so nothing was saved. Retry the read first.');
+            }
+            if (existing.length) throw new Error(`A global row for ${category.key} already exists (id ${existing.map((entry) => entry.id).join(', ')}); reload before saving.`);
+        }
+        return mojoSave<SettingRow>('/api/settings', row?.id ?? null, changes);
+    });
 }
 
-/** Reset = write `{}`. The live Setting model refuses DELETE, and `{}` is reported as `override: null`. */
+/**
+ * Reset = write `{}`. The live Setting model refuses DELETE, and `{}` is reported as `override: null`.
+ * Resolves `null` when `row` is null: nothing was reset and nothing was sent.
+ */
 export async function resetCategory(category: RenditionCategory, row: SettingRow | null): Promise<SettingRow | null> {
     if (!row) return null;
     return saveCategoryValue(category, row, {});