cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(dashboard): protect schema snapshots during delayed writes

Browse Source
This commit is contained in:
cesnimda
2026-10-21 21:05:40 +02:00
parent 5edbe59692
commit a24e6b3159
3 changed files with 64 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
JobTrackerApi/Controllers/AuthController.cs
+3 -1
View File
@@ -562,7 +562,7 @@ public sealed class AuthController : ControllerBase
var userId = LocalAuthIdentity.GetRequiredUserId(User);
if (userId is null) return Unauthorized();
var existing = await _db.Users.AsNoTracking().Where(x => x.Id == userId)
.Select(x => new { x.DashboardLayoutJson }).SingleOrDefaultAsync(cancellationToken);
.Select(x => new { x.DashboardLayoutJson, x.DashboardLayoutRevision }).SingleOrDefaultAsync(cancellationToken);
if (existing is null) return Unauthorized();
if (DashboardLayout.Read(existing.DashboardLayoutJson, 0).Version > 1)
return Conflict(new { error = "dashboard_version_unsupported" });
@@ -585,6 +585,8 @@ public sealed class AuthController : ControllerBase
}
catch (JsonException) { return BadRequest("Invalid dashboard layout JSON."); }
if (layout is null) return BadRequest("Invalid dashboard layout version, revision or widgets.");
if (layout.Revision != existing.DashboardLayoutRevision)
return Conflict(new { error = "dashboard_revision_conflict" });
var json = JsonSerializer.Serialize(layout, new JsonSerializerOptions(JsonSerializerDefaults.Web));
var updated = await _db.Users.Where(x => x.Id == userId && x.DashboardLayoutRevision == layout.Revision)
.ExecuteUpdateAsync(set => set.SetProperty(x => x.DashboardLayoutJson, json)