golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(12.2-03): defer relation work on unsaved records and add child file routes

Browse Source 
- record id 0 with X-Session-Key manages deferrable relations: create, link, unlink, delete and pivot edits are held in deferred_bindings
- the record's create save applies relation bindings with the file bindings; an ineligible link is a 422 on the relation-manager field
- child forms upload files through .../records/{child}/files/{field} keyed by X-Child-Session-Key; the child save commits them
- boot refuses a deferrable relation with create whose related model no plugin lists in Models()
This commit is contained in:
Jakub Zych
2026-10-02 19:08:16 +02:00
parent afb05b6ee4
commit fe9e8baaf1
16 changed files with 3643 additions and 436 deletions
Download Patch File Download Diff File Expand all files Collapse all files

181
modules/cabana/deferred.go
View File

@@ -4,6 +4,7 @@ import (
"context"
"errors"
"net/http"
"reflect"
"regexp"
"strconv"
"strings"
@@ -21,6 +22,12 @@ import (
// by the record's next create or update save, inside its transaction.
const SessionKeyHeader = "X-Session-Key"
// ChildSessionKeyHeader carries the session key of a relation child form
// (D-17): the child modal's own form key, sent with the child's file calls
// and with its create or update, which applies the child's file bindings.
// A child modal on a record that is not saved yet carries both headers.
const ChildSessionKeyHeader = "X-Child-Session-Key"
// sessionKeyPattern is the accepted key shape: 32 to 128 URL-safe
// characters, at least 128 bits for a base64url key.
var sessionKeyPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{32,128}$`)
@@ -38,21 +45,39 @@ func sessionKeyFrom(r *http.Request) (string, bool, error) {
return raw, true, nil
}
// commitDeferred applies the file bindings of in.SessionKey to the saved
// target inside the save transaction (D-04), then rechecks the file limits.
// childSessionKeyFrom reads the X-Child-Session-Key header like
// sessionKeyFrom; a malformed key is a validation error on
// child_session_key.
func childSessionKeyFrom(r *http.Request) (string, bool, error) {
raw := strings.TrimSpace(r.Header.Get(ChildSessionKeyHeader))
if raw == "" {
return "", false, nil
}
if !sessionKeyPattern.MatchString(raw) {
return "", false, &ValidationError{Details: map[string]any{"child_session_key": []string{"The child session key is invalid."}}}
}
return raw, true, nil
}
// commitDeferred applies the file and relation bindings of in.SessionKey to
// the saved target inside the save transaction (D-04), then rechecks the
// file limits.
//
// It reads every binding of the key, the authenticated admin and the
// controller's morph type whose master_field is a fileupload field allowed
// in op, locked FOR UPDATE so two saves with one key serialize, and applies
// them in id order: a bind attaches its pending upload (on an attachOne
// field after deleting the file it replaces), an unbind deletes the attached
// file. Blobs of deleted files are removed after commit, and the applied
// rows are deleted. Bindings of other fields stay for the purge. Then every
// fileupload field allowed in op must hold at most maxFiles files and, when
// required, at least one; otherwise the save fails with a 422 on the field,
// the transaction rolls back and the bindings stay in place.
// controller's morph type whose master_field is a fileupload field or a
// deferrable relation-manager relation allowed in op, locked FOR UPDATE so
// two saves with one key serialize, and applies them in id order. A file
// bind attaches its pending upload (on an attachOne field after deleting
// the file it replaces), a file unbind deletes the attached file; blobs of
// deleted files are removed after commit. A relation bind attaches the
// related record (applyRelationBinding), a relation unbind detaches it. The
// applied rows are deleted; bindings of other fields stay for the purge.
// Then every fileupload field allowed in op must hold at most maxFiles files
// and, when required, at least one. Any failure (a 422 on a file field, or
// on a relation-manager field for an ineligible link) rolls the transaction
// back and leaves the bindings in place.
func (s CRUDService) commitDeferred(ctx context.Context, tx *gorm.DB, cc *CompiledController, target any, op string, in RecordInput) error {
if cc == nil || cc.Form == nil || len(cc.files) == 0 {
if cc == nil || cc.Form == nil {
return nil
}
var fields []*compiledFile
@@ -61,8 +86,14 @@ func (s CRUDService) commitDeferred(ctx context.Context, tx *gorm.DB, cc *Compil
fields = append(fields, cf)
}
}
relations := map[string]*CompiledRelation{}
for name, cr := range cc.Relations {
if cr != nil && cr.deferrable && contextAllows(cc, cr.fieldName, op) {
relations[name] = cr
}
}
ownerID := primaryText(target)
if len(fields) == 0 || ownerID == "" {
if (len(fields) == 0 && len(relations) == 0) || ownerID == "" {
return nil
}
morph, err := lagoon.MorphType(tx, target)
@@ -71,30 +102,45 @@ func (s CRUDService) commitDeferred(ctx context.Context, tx *gorm.DB, cc *Compil
}
principal, _ := bouncer.User(ctx)
if in.SessionKey != "" && principal != nil && principal.Backend && principal.ID != 0 {
names := make([]string, len(fields))
for i, cf := range fields {
names[i] = cf.name
names := make([]string, 0, len(fields)+len(relations))
for _, cf := range fields {
names = append(names, cf.name)
}
for name := range relations {
names = append(names, name)
}
key := lagoon.DeferredKey{SessionKey: in.SessionKey, AdminID: principal.ID, MasterType: morph}
rows, err := lagoon.DeferredBindings(ctx, tx, key, names)
if err != nil {
return lifecycleFailure(cc, err)
}
rel := RelationService{DB: s.DB, bucket: s.bucket, tr: s.tr}
parent := &relationParent{model: target, id: pkUint(target)}
applied := make([]uint, 0, len(rows))
for _, row := range rows {
cf := cc.files[row.MasterField]
if cf == nil || row.SlaveType != lagoon.DeferredFileType {
if cf := cc.files[row.MasterField]; cf != nil && row.SlaveType == lagoon.DeferredFileType {
if row.IsBind {
err = s.applyFileBind(ctx, tx, cf, morph, ownerID, row)
} else {
err = s.applyFileUnbind(ctx, tx, cf, morph, ownerID, row)
}
if err != nil {
return lifecycleFailure(cc, err)
}
applied = append(applied, row.ID)
continue
}
if row.IsBind {
err = s.applyFileBind(ctx, tx, cf, morph, ownerID, row)
} else {
err = s.applyFileUnbind(ctx, tx, cf, morph, ownerID, row)
cr := relations[row.MasterField]
if cr == nil {
continue
}
done, err := rel.applyRelationBinding(ctx, tx, cc, cr, parent, row)
if err != nil {
return lifecycleFailure(cc, err)
}
applied = append(applied, row.ID)
if done {
applied = append(applied, row.ID)
}
}
if err := lagoon.DeferredForget(ctx, tx, applied); err != nil {
return lifecycleFailure(cc, err)
@@ -125,6 +171,95 @@ func (s CRUDService) commitDeferred(ctx context.Context, tx *gorm.DB, cc *Compil
return nil
}
// applyRelationBinding applies one relation binding of a form session to
// the saved parent (D-04) and reports whether the row was consumed. A
// binding of another slave type is left alone. A bind of a child the
// session created attaches it directly: a hasMany child whose ForeignKey is
// still NULL gets the parent's key through its model (a child gone or owned
// elsewhere is skipped); a belongsToMany record gets its pivot row with the
// envelope's pivot values and RelationBeforeLink stamps. A bind of an
// existing record runs the shared link path with the saved parent, so the
// eligibility checks (RelationExtendManageQuery, ExcludedRelatedIDs, not
// linked yet) run again; an ineligible record fails the save with a 422 on
// the relation-manager field. An unbind runs the shared unlink path.
func (s RelationService) applyRelationBinding(ctx context.Context, tx *gorm.DB, cc *CompiledController, cr *CompiledRelation, parent *relationParent, row lagoon.DeferredBinding) (bool, error) {
morph, err := lagoon.MorphType(tx, cr.Contract.NewRelated())
if err != nil {
return false, err
}
if row.SlaveType != morph {
return false, nil
}
n, err := strconv.ParseUint(row.SlaveID, 10, 64)
if err != nil || n == 0 {
return true, nil
}
id := uint(n)
if !row.IsBind {
_, err := s.unlinkRelated(ctx, tx, cc, cr, parent.model, []uint{id})
return true, err
}
env, err := row.Envelope()
if err != nil {
return false, err
}
var pivot map[string]any
if len(env.Pivot) > 0 && cr.pivot != nil {
pivot = env.Pivot
}
if !env.Created {
_, err := s.linkRelated(ctx, tx, cc, cr, parent.model, []uint{id}, pivot, relationInvalid(cr.fieldName, "contains an ineligible record"))
return true, err
}
child := cr.Contract.NewRelated()
err = tx.Session(&gorm.Session{NewDB: true, Context: ctx}).Clauses(clause.Locking{Strength: "UPDATE"}).
Where(clause.Eq{Column: clause.Column{Name: primaryColumn(child)}, Value: castPK(child, id)}).Take(child).Error
if errors.Is(err, gorm.ErrRecordNotFound) {
return true, nil
}
if err != nil {
return false, err
}
if cr.hasMany() {
if fk, ok := structFieldValue(child, cr.Contract.ForeignKey); !ok || !fk.IsNil() {
return true, nil
}
if err := setModelColumn(child, cr.Contract.ForeignKey, parent.id); err != nil {
return false, err
}
return true, tx.WithContext(ctx).Save(child).Error
}
linked, err := pendingRelationIDs(tx, cr, parent.id, []uint{id})
if err != nil || len(linked) == 0 {
return true, err
}
var pivotRow any
if pivot != nil {
pivotRow = cr.Contract.NewPivot()
if err := s.fillPivot(ctx, tx, cr, pivotRow, pivot); err != nil {
return false, err
}
}
return true, insertPivot(ctx, tx, cc, cr, parent.model, child, pivotRow)
}
// structFieldValue is the value of a pointer field stored in column, false
// when the column is not a pointer field.
func structFieldValue(model any, column string) (reflect.Value, bool) {
v := reflect.ValueOf(model)
for v.Kind() == reflect.Pointer {
if v.IsNil() {
return reflect.Value{}, false
}
v = v.Elem()
}
f := fieldByColumn(v, column)
if !f.IsValid() || f.Kind() != reflect.Pointer {
return reflect.Value{}, false
}
return f, true
}
// applyFileBind attaches a pending upload to the owner. A row that is gone
// or already attached somewhere is ignored. On an attachOne field the file
// it replaces is deleted first (WinterCMS's AttachOne::add).