CenterForDigitalHumanities / CenterForDigitalHumanities/TinyNode

If-Overwritten-Version header not enforced on /overwrite endpoint

Open
#106 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1
Forks
3
Avg merge
29m
Merged PRs (30d)
1

Description

## Summary
The `If-Overwritten-Version` header documented in the RERUM API is not being enforced by TinyNode's `/overwrite` endpoint. Requests succeed even when the version in the header doesn't match the current server version.

## Expected Behavior
According to the [RERUM API documentation](https://store.rerum.io/v1/API.html#overwrite):
> Including the 'If-Overwritten-Version' header with the value of the `__rerum.isOverwritten` property of the record will cause the request to fail if the record has been overwritten since that time.

When a client sends an `/overwrite` request with an `If-Overwritten-Version` header that doesn't match the current `__rerum.isOverwritten` value on the server, the server should return **409 Conflict**.

## Actual Behavior
The request succeeds with **200 OK** and the object is overwritten, even when the `If-Overwritten-Version` header contains an outdated timestamp.

## Steps to Reproduce
1. Load an object and note its `__rerum.isOverwritten` value (e.g., `2025-11-30T20:31:57.853`)
2. Update the object via `/overwrite` - this changes `isOverwritten` to a new value (e.g., `2025-11-30T20:33:58.609`)
3. Send another `/overwrite` request with header `If-Overwritten-Version: 2025-11-30T20:31:57.853` (the old value)
4. **Expected:** 409 Conflict response
5. **Actual:** 200 OK, object is overwritten

## Evidence
Request headers sent (verified in browser DevTools):
```
if-overwritten-version: 2025-11-30T20:31:57.853
content-type: application/json
```

Server's current `isOverwritten` at time of request: `2025-11-30T20:33:58.609`

Response: 200 OK (should have been 409 Conflict)

## Use Case
This feature is needed to implement optimistic locking for concurrent editing. Without server-side enforcement, two users editing the same object can silently overwrite each other's changes.

## Related
- RERUM server issue: https://github.com/CenterForDigitalHumanities/rerum_server_nodejs/issues/230
- RERUM API docs: https://store.rerum.io/v1/API.html#overwrite

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.