Added ConcurrencyValue to ensure incoming left/right versions are both checked during update

Author: Bart Koelman

JsonApiDotNetCore.sln.DotSettings

@@ -645,5 +645,6 @@ $left$ = $right$;</s:String>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=subdirectory/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=unarchive/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=Workflows/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=xmin/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=xunit/@EntryIndexedValue">True</s:Boolean>
 </wpf:ResourceDictionary>

src/Examples/MultiDbContextExample/Repositories/DbContextARepository.cs

@@ -1,5 +1,6 @@
 using JetBrains.Annotations;
 using JsonApiDotNetCore.Configuration;
+using JsonApiDotNetCore.Middleware;
 using JsonApiDotNetCore.Queries;
 using JsonApiDotNetCore.Repositories;
 using JsonApiDotNetCore.Resources;
@@ -11,10 +12,10 @@ namespace MultiDbContextExample.Repositories;
 public sealed class DbContextARepository<TResource> : EntityFrameworkCoreRepository<TResource, int>
     where TResource : class, IIdentifiable<int>
 {
-    public DbContextARepository(ITargetedFields targetedFields, DbContextResolver<DbContextA> dbContextResolver, IResourceGraph resourceGraph,
-        IResourceFactory resourceFactory, IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory,
-        IResourceDefinitionAccessor resourceDefinitionAccessor)
-        : base(targetedFields, dbContextResolver, resourceGraph, resourceFactory, constraintProviders, loggerFactory, resourceDefinitionAccessor)
+    public DbContextARepository(IJsonApiRequest request, ITargetedFields targetedFields, DbContextResolver<DbContextA> dbContextResolver,
+        IResourceGraph resourceGraph, IResourceFactory resourceFactory, IResourceDefinitionAccessor resourceDefinitionAccessor,
+        IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory)
+        : base(request, targetedFields, dbContextResolver, resourceGraph, resourceFactory, resourceDefinitionAccessor, constraintProviders, loggerFactory)
     {
     }
 }

src/Examples/MultiDbContextExample/Repositories/DbContextBRepository.cs

@@ -1,5 +1,6 @@
 using JetBrains.Annotations;
 using JsonApiDotNetCore.Configuration;
+using JsonApiDotNetCore.Middleware;
 using JsonApiDotNetCore.Queries;
 using JsonApiDotNetCore.Repositories;
 using JsonApiDotNetCore.Resources;
@@ -11,10 +12,10 @@ namespace MultiDbContextExample.Repositories;
 public sealed class DbContextBRepository<TResource> : EntityFrameworkCoreRepository<TResource, int>
     where TResource : class, IIdentifiable<int>
 {
-    public DbContextBRepository(ITargetedFields targetedFields, DbContextResolver<DbContextB> dbContextResolver, IResourceGraph resourceGraph,
-        IResourceFactory resourceFactory, IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory,
-        IResourceDefinitionAccessor resourceDefinitionAccessor)
-        : base(targetedFields, dbContextResolver, resourceGraph, resourceFactory, constraintProviders, loggerFactory, resourceDefinitionAccessor)
+    public DbContextBRepository(IJsonApiRequest request, ITargetedFields targetedFields, DbContextResolver<DbContextB> dbContextResolver,
+        IResourceGraph resourceGraph, IResourceFactory resourceFactory, IResourceDefinitionAccessor resourceDefinitionAccessor,
+        IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory)
+        : base(request, targetedFields, dbContextResolver, resourceGraph, resourceFactory, resourceDefinitionAccessor, constraintProviders, loggerFactory)
     {
     }
 }

src/JsonApiDotNetCore.Annotations/Resources/IVersionedIdentifiable.cs

@@ -1,3 +1,5 @@
+using JetBrains.Annotations;
+
 namespace JsonApiDotNetCore.Resources;
 
 /// <summary>
@@ -21,10 +23,16 @@ public interface IVersionedIdentifiable : IIdentifiable
 /// <typeparam name="TVersion">
 /// The database vendor-specific type that is used to store the concurrency token.
 /// </typeparam>
+[PublicAPI]
 public interface IVersionedIdentifiable<TId, TVersion> : IIdentifiable<TId>, IVersionedIdentifiable
 {
     /// <summary>
     /// The concurrency token, which is used to detect if the resource was modified by another user since the moment this resource was last retrieved.
     /// </summary>
     TVersion ConcurrencyToken { get; set; }
+
+    /// <summary>
+    /// Represents a database column where random data is written to on updates, in order to force a concurrency check during relationship updates.
+    /// </summary>
+    Guid ConcurrencyValue { get; set; }
 }

src/JsonApiDotNetCore/Queries/Internal/QueryableBuilding/SelectClauseBuilder.cs

@@ -143,6 +143,10 @@ private ICollection<PropertySelector> ToPropertySelectors(FieldSelectors fieldSe
         }
 
         IncludeFields(fieldSelectors, propertySelectors);
+
+        // Implicitly add concurrency tokens, which we need for rendering links, but may not be exposed as attributes.
+        IncludeConcurrencyTokens(resourceType, elementType, propertySelectors);
+
         IncludeEagerLoads(resourceType, propertySelectors);
 
         return propertySelectors.Values;
@@ -169,6 +173,21 @@ private static void IncludeFields(FieldSelectors fieldSelectors, Dictionary<Prop
         }
     }
 
+    private void IncludeConcurrencyTokens(ResourceType resourceType, Type elementType, Dictionary<PropertyInfo, PropertySelector> propertySelectors)
+    {
+        if (resourceType.IsVersioned)
+        {
+            IEntityType entityModel = _entityModel.GetEntityTypes().Single(type => type.ClrType == elementType);
+            IEnumerable<IProperty> tokenProperties = entityModel.GetProperties().Where(property => property.IsConcurrencyToken).ToArray();
+
+            foreach (IProperty tokenProperty in tokenProperties)
+            {
+                var propertySelector = new PropertySelector(tokenProperty.PropertyInfo!);
+                IncludeWritableProperty(propertySelector, propertySelectors);
+            }
+        }
+    }
+
     private static void IncludeWritableProperty(PropertySelector propertySelector, Dictionary<PropertyInfo, PropertySelector> propertySelectors)
     {
         if (propertySelector.Property.SetMethod != null)

src/JsonApiDotNetCore/Repositories/DataStoreConcurrencyException.cs

@@ -0,0 +1,16 @@
+using JetBrains.Annotations;
+
+namespace JsonApiDotNetCore.Repositories;
+
+/// <summary>
+/// The error that is thrown when the resource version from the request does not match the server version.
+/// </summary>
+[PublicAPI]
+public sealed class DataStoreConcurrencyException : DataStoreUpdateException
+{
+    public DataStoreConcurrencyException(Exception? innerException)
+        : base("The resource version does not match the server version. This indicates that data has been modified since the resource was retrieved.",
+            innerException)
+    {
+    }
+}

src/JsonApiDotNetCore/Repositories/DataStoreUpdateException.cs

@@ -6,10 +6,15 @@ namespace JsonApiDotNetCore.Repositories;
 /// The error that is thrown when the underlying data store is unable to persist changes.
 /// </summary>
 [PublicAPI]
-public sealed class DataStoreUpdateException : Exception
+public class DataStoreUpdateException : Exception
 {
     public DataStoreUpdateException(Exception? innerException)
-        : base("Failed to persist changes in the underlying data store.", innerException)
+        : this("Failed to persist changes in the underlying data store.", innerException)
+    {
+    }
+
+    protected DataStoreUpdateException(string message, Exception? innerException)
+        : base(message, innerException)
     {
     }
 }

src/JsonApiDotNetCore/Repositories/EntityFrameworkCoreRepository.cs

@@ -26,6 +26,7 @@ public class EntityFrameworkCoreRepository<TResource, TId> : IResourceRepository
     where TResource : class, IIdentifiable<TId>
 {
     private readonly CollectionConverter _collectionConverter = new();
+    private readonly IJsonApiRequest _request;
     private readonly ITargetedFields _targetedFields;
     private readonly DbContext _dbContext;
     private readonly IResourceGraph _resourceGraph;
@@ -37,24 +38,26 @@ public class EntityFrameworkCoreRepository<TResource, TId> : IResourceRepository
     /// <inheritdoc />
     public virtual string? TransactionId => _dbContext.Database.CurrentTransaction?.TransactionId.ToString();
 
-    public EntityFrameworkCoreRepository(ITargetedFields targetedFields, IDbContextResolver dbContextResolver, IResourceGraph resourceGraph,
-        IResourceFactory resourceFactory, IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory,
-        IResourceDefinitionAccessor resourceDefinitionAccessor)
+    public EntityFrameworkCoreRepository(IJsonApiRequest request, ITargetedFields targetedFields, IDbContextResolver dbContextResolver,
+        IResourceGraph resourceGraph, IResourceFactory resourceFactory, IResourceDefinitionAccessor resourceDefinitionAccessor,
+        IEnumerable<IQueryConstraintProvider> constraintProviders, ILoggerFactory loggerFactory)
     {
+        ArgumentGuard.NotNull(request, nameof(request));
         ArgumentGuard.NotNull(targetedFields, nameof(targetedFields));
         ArgumentGuard.NotNull(dbContextResolver, nameof(dbContextResolver));
         ArgumentGuard.NotNull(resourceGraph, nameof(resourceGraph));
         ArgumentGuard.NotNull(resourceFactory, nameof(resourceFactory));
+        ArgumentGuard.NotNull(resourceDefinitionAccessor, nameof(resourceDefinitionAccessor));
         ArgumentGuard.NotNull(constraintProviders, nameof(constraintProviders));
         ArgumentGuard.NotNull(loggerFactory, nameof(loggerFactory));
-        ArgumentGuard.NotNull(resourceDefinitionAccessor, nameof(resourceDefinitionAccessor));
 
+        _request = request;
         _targetedFields = targetedFields;
         _dbContext = dbContextResolver.GetContext();
         _resourceGraph = resourceGraph;
         _resourceFactory = resourceFactory;
-        _constraintProviders = constraintProviders;
         _resourceDefinitionAccessor = resourceDefinitionAccessor;
+        _constraintProviders = constraintProviders;
         _traceWriter = new TraceLogWriter<EntityFrameworkCoreRepository<TResource, TId>>(loggerFactory);
     }
 
@@ -249,7 +252,11 @@ await _resourceDefinitionAccessor.OnSetToManyRelationshipAsync(leftResource, has
         using IDisposable _ = CodeTimingSessionManager.Current.Measure("Repository - Get resource for update");
 
         IReadOnlyCollection<TResource> resources = await GetAsync(queryLayer, cancellationToken);
-        return resources.FirstOrDefault();
+        TResource? resource = resources.FirstOrDefault();
+
+        resource?.RestoreConcurrencyToken(_dbContext, _request.PrimaryVersion);
+
+        return resource;
     }
 
     /// <inheritdoc />
@@ -324,6 +331,7 @@ public virtual async Task DeleteAsync(TResource? resourceFromDatabase, TId id, C
         // If so, we'll reuse the tracked resource instead of this placeholder resource.
         TResource placeholderResource = resourceFromDatabase ?? _resourceFactory.CreateInstance<TResource>();
         placeholderResource.Id = id;
+        placeholderResource.RestoreConcurrencyToken(_dbContext, _request.PrimaryVersion);
 
         await _resourceDefinitionAccessor.OnWritingAsync(placeholderResource, WriteOperationKind.DeleteResource, cancellationToken);
 
@@ -533,6 +541,17 @@ public virtual async Task RemoveFromToManyRelationshipAsync(TResource leftResour
 
             if (!rightResourceIdsToStore.SetEquals(rightResourceIdsStored))
             {
+                if (relationship.RightType.IsVersioned)
+                {
+                    foreach (IIdentifiable rightResource in rightResourceIdsStored)
+                    {
+                        string? requestVersion = rightResourceIdsToRemove.Single(resource => resource.StringId == rightResource.StringId).GetVersion();
+
+                        rightResource.RestoreConcurrencyToken(_dbContext, requestVersion);
+                        rightResource.RefreshConcurrencyValue();
+                    }
+                }
+
                 AssertIsNotClearingRequiredToOneRelationship(relationship, leftResourceTracked, rightResourceIdsToStore);
 
                 await UpdateRelationshipAsync(relationship, leftResourceTracked, rightResourceIdsToStore, cancellationToken);
@@ -566,6 +585,9 @@ protected async Task UpdateRelationshipAsync(RelationshipAttribute relationship,
             await entityEntry.Reference(inversePropertyName).LoadAsync(cancellationToken);
         }
 
+        leftResource.RestoreConcurrencyToken(_dbContext, _request.PrimaryVersion);
+        leftResource.RefreshConcurrencyValue();
+
         relationship.SetValue(leftResource, trackedValueToAssign);
     }
 
@@ -579,6 +601,13 @@ protected async Task UpdateRelationshipAsync(RelationshipAttribute relationship,
         IReadOnlyCollection<IIdentifiable> rightResources = _collectionConverter.ExtractResources(rightValue);
         IIdentifiable[] rightResourcesTracked = rightResources.Select(rightResource => _dbContext.GetTrackedOrAttach(rightResource)).ToArray();
 
+        foreach (IIdentifiable rightResourceTracked in rightResourcesTracked)
+        {
+            string? rightVersion = rightResourceTracked.GetVersion();
+            rightResourceTracked.RestoreConcurrencyToken(_dbContext, rightVersion);
+            rightResourceTracked.RefreshConcurrencyValue();
+        }
+
         return rightValue is IEnumerable
             ? _collectionConverter.CopyToTypedCollection(rightResourcesTracked, relationshipPropertyType)
             : rightResourcesTracked.Single();
@@ -604,7 +633,7 @@ protected virtual async Task SaveChangesAsync(CancellationToken cancellationToke
         {
             _dbContext.ResetChangeTracker();
 
-            throw new DataStoreUpdateException(exception);
+            throw exception is DbUpdateConcurrencyException ? new DataStoreConcurrencyException(exception) : new DataStoreUpdateException(exception);
         }
     }
 }

src/JsonApiDotNetCore/Resources/IdentifiableExtensions.cs

@@ -1,11 +1,15 @@
 using System.Reflection;
 using JsonApiDotNetCore.Resources.Internal;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.ChangeTracking;
 
 namespace JsonApiDotNetCore.Resources;
 
 internal static class IdentifiableExtensions
 {
     private const string IdPropertyName = nameof(Identifiable<object>.Id);
+    private const string ConcurrencyTokenPropertyName = nameof(IVersionedIdentifiable<object, object>.ConcurrencyToken);
+    private const string ConcurrencyValuePropertyName = nameof(IVersionedIdentifiable<object, object>.ConcurrencyValue);
 
     public static object GetTypedId(this IIdentifiable identifiable)
     {
@@ -58,4 +62,51 @@ public static void SetVersion(this IIdentifiable identifiable, string? version)
             versionedIdentifiable.Version = version;
         }
     }
+
+    public static void RestoreConcurrencyToken(this IIdentifiable identifiable, DbContext dbContext, string? versionFromRequest)
+    {
+        ArgumentGuard.NotNull(identifiable, nameof(identifiable));
+        ArgumentGuard.NotNull(dbContext, nameof(dbContext));
+
+        if (identifiable is IVersionedIdentifiable versionedIdentifiable)
+        {
+            versionedIdentifiable.Version = versionFromRequest;
+
+            PropertyInfo? property = identifiable.GetClrType().GetProperty(ConcurrencyTokenPropertyName);
+
+            if (property == null)
+            {
+                throw new InvalidOperationException(
+                    $"Resource of type '{identifiable.GetClrType()}' does not contain a property named '{ConcurrencyTokenPropertyName}'.");
+            }
+
+            PropertyEntry propertyEntry = dbContext.Entry(identifiable).Property(ConcurrencyTokenPropertyName);
+
+            if (!propertyEntry.Metadata.IsConcurrencyToken)
+            {
+                throw new InvalidOperationException($"Property '{identifiable.GetClrType()}.{ConcurrencyTokenPropertyName}' is not a concurrency token.");
+            }
+
+            object? concurrencyTokenFromRequest = property.GetValue(identifiable);
+            propertyEntry.OriginalValue = concurrencyTokenFromRequest;
+        }
+    }
+
+    public static void RefreshConcurrencyValue(this IIdentifiable identifiable)
+    {
+        ArgumentGuard.NotNull(identifiable, nameof(identifiable));
+
+        if (identifiable is IVersionedIdentifiable)
+        {
+            PropertyInfo? property = identifiable.GetClrType().GetProperty(ConcurrencyValuePropertyName);
+
+            if (property == null)
+            {
+                throw new InvalidOperationException(
+                    $"Resource of type '{identifiable.GetClrType()}' does not contain a property named '{ConcurrencyValuePropertyName}'.");
+            }
+
+            property.SetValue(identifiable, Guid.NewGuid());
+        }
+    }
 }

src/JsonApiDotNetCore/Resources/ResourceChangeTracker.cs

@@ -13,9 +13,9 @@ public sealed class ResourceChangeTracker<TResource> : IResourceChangeTracker<TR
     private readonly IJsonApiRequest _request;
     private readonly ITargetedFields _targetedFields;
 
-    private IDictionary<string, string>? _initiallyStoredAttributeValues;
-    private IDictionary<string, string>? _requestAttributeValues;
-    private IDictionary<string, string>? _finallyStoredAttributeValues;
+    private IDictionary<string, string?>? _initiallyStoredAttributeValues;
+    private IDictionary<string, string?>? _requestAttributeValues;
+    private IDictionary<string, string?>? _finallyStoredAttributeValues;
 
     public ResourceChangeTracker(IJsonApiRequest request, ITargetedFields targetedFields)
     {
@@ -50,9 +50,9 @@ public void SetFinallyStoredAttributeValues(TResource resource)
         _finallyStoredAttributeValues = CreateAttributeDictionary(resource, _request.PrimaryResourceType!.Attributes);
     }
 
-    private IDictionary<string, string> CreateAttributeDictionary(TResource resource, IEnumerable<AttrAttribute> attributes)
+    private IDictionary<string, string?> CreateAttributeDictionary(TResource resource, IEnumerable<AttrAttribute> attributes)
     {
-        var result = new Dictionary<string, string>();
+        var result = new Dictionary<string, string?>();
 
         foreach (AttrAttribute attribute in attributes)
         {
@@ -61,6 +61,11 @@ private IDictionary<string, string> CreateAttributeDictionary(TResource resource
             result.Add(attribute.PublicName, json);
         }
 
+        if (resource is IVersionedIdentifiable versionedIdentifiable)
+        {
+            result.Add(nameof(versionedIdentifiable.Version), versionedIdentifiable.Version);
+        }
+
         return result;
     }
 
@@ -73,7 +78,7 @@ public bool HasImplicitChanges()
             {
                 if (_requestAttributeValues.TryGetValue(key, out string? requestValue))
                 {
-                    string actualValue = _finallyStoredAttributeValues[key];
+                    string? actualValue = _finallyStoredAttributeValues[key];
 
                     if (requestValue != actualValue)
                     {
@@ -82,8 +87,8 @@ public bool HasImplicitChanges()
                 }
                 else
                 {
-                    string initiallyStoredValue = _initiallyStoredAttributeValues[key];
-                    string finallyStoredValue = _finallyStoredAttributeValues[key];
+                    string? initiallyStoredValue = _initiallyStoredAttributeValues[key];
+                    string? finallyStoredValue = _finallyStoredAttributeValues[key];
 
                     if (initiallyStoredValue != finallyStoredValue)
                     {