ersatztv/ErsatzTV.Application/ConcurrencyExtensions.cs

using ErsatzTV.Core;
using ErsatzTV.Core.Domain;
using ErsatzTV.Core.Errors;
using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.ChangeTracking;

namespace ErsatzTV.Application;

public static class ConcurrencyExtensions
{
    /// <summary>
    ///     Persist changes that touch a versioned root but do <b>not</b> participate in the If-Match
    ///     contract (e.g. a playout's settings/schedule-file/on-demand-checkpoint writer, a collection's
    ///     name edit). Because the root's <c>Version</c> is an <c>IsConcurrencyToken</c>, EF guards every
    ///     UPDATE of that row with <c>WHERE Version=@orig</c>, so a concurrent bump from a replace-all
    ///     editor would otherwise surface as an unhandled <see cref="DbUpdateConcurrencyException" /> →
    ///     500 (issue #253 / #269). Phase-1 semantics for a missing <c>If-Match</c> is <b>force-write</b>,
    ///     so on a concurrency failure we rebase onto the stored token: original becomes the stored value
    ///     (the retry's WHERE then matches) and current becomes stored + our pending delta (a bumper's ++
    ///     still advances the ETag past the concurrent writer's value — #269 rotation; a non-bumper adopts
    ///     it unchanged) and retry; our own modified scalars still win. Bounded to avoid a livelock; if the row
    ///     was deleted out from under us, that's a genuine conflict and rethrows.
    /// </summary>
    public static async Task<int> SaveChangesForcingVersion(
        this DbContext dbContext,
        CancellationToken cancellationToken)
    {
        for (var attempt = 0; ; attempt++)
        {
            try
            {
                return await dbContext.SaveChangesAsync(cancellationToken);
            }
            catch (DbUpdateConcurrencyException ex) when (attempt < 5)
            {
                var resolvedAny = false;
                foreach (EntityEntry entry in ex.Entries)
                {
                    if (entry.Entity is not IVersionedAggregate)
                    {
                        continue;
                    }

                    PropertyValues databaseValues = await entry.GetDatabaseValuesAsync(cancellationToken);
                    if (databaseValues is null)
                    {
                        // The row was deleted out from under us — a genuine conflict, not a token race.
                        throw;
                    }

                    PropertyEntry version = entry.Property(nameof(IVersionedAggregate.Version));
                    int dbVersion = (int)databaseValues[nameof(IVersionedAggregate.Version)]!;

                    // Rebase our pending delta on top of the stored token instead of adopting it verbatim:
                    // a Version-bumping sibling (pending current = original + 1) must still advance the
                    // ETag PAST the concurrent writer's value, or an editor holding that writer's ETag is
                    // never invalidated by our change (#269 rotation silently lost under race). Non-bumpers
                    // (delta 0, e.g. ErasePlayoutHistory) still adopt the stored token unchanged.
                    int pendingDelta = (int)version.CurrentValue! - (int)version.OriginalValue!;
                    version.OriginalValue = dbVersion;
                    version.CurrentValue = dbVersion + pendingDelta;
                    resolvedAny = true;
                }

                if (!resolvedAny)
                {
                    throw;
                }
            }
        }
    }

    /// <summary>
    ///     Persist pending changes, mapping the EF optimistic-concurrency failure to
    ///     <see cref="PreconditionFailedError" /> (→ 412). When a versioned root carries an
    ///     <c>IsConcurrencyToken</c> column and its <c>Version</c> is bumped before saving, EF emits
    ///     <c>UPDATE … WHERE Id=@id AND Version=@original</c>; a zero-row result (another writer won
    ///     the race between our load and save) throws <see cref="DbUpdateConcurrencyException" />.
    ///     This is the backstop that closes the load→save TOCTOU the handler pre-check cannot.
    ///     Issue #253.
    /// </summary>
    public static async Task<Either<BaseError, Unit>> SaveChangesWithConcurrencyGuard(
        this DbContext dbContext,
        CancellationToken cancellationToken)
    {
        try
        {
            await dbContext.SaveChangesAsync(cancellationToken);
            return Unit.Default;
        }
        catch (DbUpdateConcurrencyException)
        {
            return new PreconditionFailedError(
                "The resource was modified by another request. Reload and try again.");
        }
    }
}