fix(alerts): отклонять запись устаревшего снимка правил

backend/src/services/alerts-config-execution.test.ts

@@ -1,11 +1,19 @@
+import {alertsConfigRevision} from "./alerts-revision.js"
 import assert from "node:assert/strict"
 import {test} from "node:test"
 import {executeAlertsConfigReplacement} from "./alerts-config-execution.js"
 import {normalizeAlertsConfig} from "@mmapp/contracts/alerts"
 const initial={groups:[{id:"g",name:"Group",combineMode:"all" as const,enabled:false,cooldownOverride:null}],rules:[]}
-function fixture(){let state=structuredClone(initial),locks:boolean|undefined=true,failWrite=false,badRead=false,wrongRead=false;const calls:string[]=[];return {calls,state:()=>state,conflict:()=>locks=false,unknown:()=>locks=undefined,fail:()=>failWrite=true,bad:()=>badRead=true,wrong:()=>wrongRead=true,deps:{transaction:async(work:(context:typeof initial)=>Promise<unknown>)=>{calls.push("begin");const context=structuredClone(state);try{const receipt=await work(context);state=context;calls.push("commit");return receipt as never}catch(error){calls.push("rollback");throw error}},lock:async()=>{calls.push("lock");return locks},groups:async(context:typeof initial)=>{calls.push("groups");return context.groups},write:async(context:typeof initial,value:ReturnType<typeof normalizeAlertsConfig>)=>{calls.push("write");context.groups=value.groups!;if(failWrite)throw Error("insert failed")},read:async(context:typeof initial)=>{calls.push("read");return badRead?{ok:false}:wrongRead?{ok:true,...context,groups:initial.groups}:{ok:true,...context}}}}}
+function fixture(){let state=structuredClone(initial),locks:boolean|undefined=true,failWrite=false,badRead=false,wrongRead=false;const calls:string[]=[];return {calls,state:()=>state,conflict:()=>locks=false,unknown:()=>locks=undefined,fail:()=>failWrite=true,bad:()=>badRead=true,wrong:()=>wrongRead=true,deps:{transaction:async(work:(context:typeof initial)=>Promise<unknown>)=>{calls.push("begin");const context=structuredClone(state);try{const receipt=await work(context);state=context;calls.push("commit");return receipt as never}catch(error){calls.push("rollback");throw error}},lock:async()=>{calls.push("lock");return locks},revision:async(context:typeof initial)=>{calls.push("revision");return alertsConfigRevision(context)},groups:async(context:typeof initial)=>{calls.push("groups");return context.groups},write:async(context:typeof initial,value:ReturnType<typeof normalizeAlertsConfig>)=>{calls.push("write");context.groups=value.groups!;if(failWrite)throw Error("insert failed")},read:async(context:typeof initial)=>{calls.push("read");return badRead?{ok:false}:wrongRead?{ok:true,revision:alertsConfigRevision({...context,groups:initial.groups}),...context,groups:initial.groups}:{ok:true,revision:alertsConfigRevision(context),...context}}}}}
 test("omitted groups are read and confirmed inside one locked transaction",async()=>{const f=fixture();const receipt=await executeAlertsConfigReplacement({rules:[]},f.deps);assert.equal(receipt.ok,true);assert.deepEqual(receipt.groups,initial.groups);assert.deepEqual(f.calls,["begin","lock","groups","write","read","commit"])})
 test("write/readback failures roll back and never repeat",async()=>{for(const step of ["write","read"]){const f=fixture();if(step==="write")f.fail();else f.bad();await assert.rejects(executeAlertsConfigReplacement({groups:[],rules:[]},f.deps));assert.deepEqual(f.state(),initial);assert.equal(f.calls.filter(s=>s==="write").length,1);assert.equal(f.calls.includes("commit"),false);assert.equal(f.calls.at(-1),"rollback")}})
 test("false or unknown lock prevents every destructive write",async()=>{for(const unknown of [false,true]){const f=fixture();if(unknown)f.unknown();else f.conflict();await assert.rejects(executeAlertsConfigReplacement({groups:[],rules:[]},f.deps),/выполняется|не подтверждена/);assert.equal(f.calls.includes("write"),false);assert.deepEqual(f.state(),initial)}})
 
 test("literal success with another config rolls back instead of confirming unrelated data",async()=>{const f=fixture();f.wrong();await assert.rejects(executeAlertsConfigReplacement({groups:[],rules:[]},f.deps),/не совпадают/);assert.deepEqual(f.state(),initial);assert.equal(f.calls.at(-1),"rollback")})
+
+test("stale revision is rejected after a preceding commit before every destructive write",async()=>{
+ const f=fixture(),expectedRevision=alertsConfigRevision(f.state())
+ const receipt=await executeAlertsConfigReplacement({groups:[],rules:[],expectedRevision},f.deps);assert.equal(receipt.revision,alertsConfigRevision(f.state()));assert.notEqual(receipt.revision,expectedRevision)
+ const previousWrites=f.calls.filter(call=>call==="write").length
+ await assert.rejects(executeAlertsConfigReplacement({...initial,expectedRevision},f.deps),/Правила изменились/);assert.equal(f.calls.filter(call=>call==="write").length,previousWrites);assert.deepEqual(f.state(),{groups:[],rules:[]});assert.deepEqual(f.calls.slice(-4),["begin","lock","revision","rollback"])
+})

backend/src/services/alerts-config-execution.ts

@@ -1,18 +1,22 @@
+import {alertsConfigRevision} from "./alerts-revision.js"
 import {normalizeAlertsConfig,alertsRulesReceiptSchema,type PutRulesBody} from "@mmapp/contracts/alerts"
 type Receipt=ReturnType<typeof alertsRulesReceiptSchema.parse>
 type Normalized=ReturnType<typeof normalizeAlertsConfig>&{groups:NonNullable<ReturnType<typeof normalizeAlertsConfig>["groups"]>}
-interface Dependencies<C>{transaction:(work:(context:C)=>Promise<Receipt>)=>Promise<Receipt>;lock:(context:C)=>Promise<boolean|undefined>;groups:(context:C)=>Promise<Normalized["groups"]>;write:(context:C,value:Normalized)=>Promise<void>;read:(context:C)=>Promise<unknown>}
-export async function executeAlertsConfigReplacement<C>(input:PutRulesBody,deps:Dependencies<C>):Promise<Receipt>{
- normalizeAlertsConfig(input)
+interface Dependencies<C>{transaction:(work:(context:C)=>Promise<Receipt>)=>Promise<Receipt>;lock:(context:C)=>Promise<boolean|undefined>;revision:(context:C)=>Promise<string>;groups:(context:C)=>Promise<Normalized["groups"]>;write:(context:C,value:Normalized)=>Promise<void>;read:(context:C)=>Promise<unknown>}
+export async function executeAlertsConfigReplacement<C>(input:PutRulesBody&{expectedRevision?:string},deps:Dependencies<C>):Promise<Receipt>{
+ const {expectedRevision,...body}=input
+ normalizeAlertsConfig(body)
  return deps.transaction(async context=>{
   const locked=await deps.lock(context)
   if(locked===false)throw Error("Сохранение правил уже выполняется")
   if(locked!==true)throw Error("Блокировка правил не подтверждена")
-  const normalized=normalizeAlertsConfig({...input,groups:input.groups??await deps.groups(context)}) as Normalized
+  if(expectedRevision!==undefined&&await deps.revision(context)!==expectedRevision)throw Error("Правила изменились на сервере. Обновите снимок и сравните его с черновиком перед сохранением.")
+  const normalized=normalizeAlertsConfig({...body,groups:body.groups??await deps.groups(context)}) as Normalized
   await deps.write(context,normalized)
   const parsed=alertsRulesReceiptSchema.safeParse(await deps.read(context))
   if(!parsed.success)throw Error("Сохранённая конфигурация оповещений не подтверждена")
   const receipt=parsed.data
+  if(receipt.revision!==alertsConfigRevision(receipt))throw Error("Ревизия сохранённой конфигурации не подтверждена")
   const match=(expected:Record<string,unknown>,actual:Record<string,unknown>|undefined)=>actual!==undefined&&Object.entries(expected).every(([key,value])=>JSON.stringify(actual[key])===JSON.stringify(value))
   if(receipt.rules.length!==normalized.rules.length||receipt.groups.length!==normalized.groups.length||normalized.rules.some(rule=>!match(rule,receipt.rules.find(row=>row.id===rule.id)))||normalized.groups.some(group=>!match(group,receipt.groups.find(row=>row.id===group.id))))throw Error("Сохранённые правила или группы не совпадают с отправленными")
   return receipt

backend/src/services/alerts-overview.test.ts

@@ -1,8 +1,9 @@
+import {alertsConfigRevision} from "./alerts-revision.js"
 import assert from "node:assert/strict"
 import {test} from "node:test"
 import type {AlertsResponse} from "@mmapp/contracts/alerts"
 import {readAlertsOverview,alertsOverviewTransaction,buildAlertsMeta} from "./alerts-overview.js"
-const empty:AlertsResponse={telegram:{chatId:"",tokenConfigured:false,connected:false,messageThreadId:null},groups:[],rules:[],history:[],meta:buildAlertsMeta([],[])}
+const empty:AlertsResponse={revision:alertsConfigRevision({groups:[],rules:[]}),telegram:{chatId:"",tokenConfigured:false,connected:false,messageThreadId:null},groups:[],rules:[],history:[],meta:buildAlertsMeta([],[])}
 test("Alerts overview uses one context with repeatable read/read only and rejects partial snapshots",async()=>{
  const context={snapshot:structuredClone(empty)},calls:string[]=[];let transactions=0
  const read=<K extends keyof typeof empty>(key:K)=>async(value:typeof context)=>{assert.equal(value,context);calls.push(key);return value.snapshot[key]}

backend/src/services/alerts-overview.ts

@@ -1,10 +1,14 @@
+import {alertsConfigRevision} from "./alerts-revision.js"
 import {alertsResponseSchema,type AlertsResponse} from "@mmapp/contracts/alerts"
 export const alertsOverviewTransaction={isolationLevel:"repeatable read",accessMode:"read only"} as const
 interface Dependencies<C>{transaction:(work:(context:C)=>Promise<AlertsResponse>,options:typeof alertsOverviewTransaction)=>Promise<AlertsResponse>;telegram:(context:C)=>Promise<unknown>;groups:(context:C)=>Promise<unknown>;rules:(context:C)=>Promise<unknown>;history:(context:C)=>Promise<unknown>;meta:(context:C)=>Promise<unknown>}
 export async function readAlertsOverview<C>(deps:Dependencies<C>):Promise<AlertsResponse>{
  return deps.transaction(async context=>{
   const telegram=await deps.telegram(context)
-  const parsed=alertsResponseSchema.safeParse({telegram,groups:await deps.groups(context),rules:await deps.rules(context),history:await deps.history(context),meta:await deps.meta(context)})
+  const groups=await deps.groups(context),rules=await deps.rules(context)
+  let revision:string
+  try{revision=alertsConfigRevision({groups,rules})}catch{throw Error("Снимок оповещений не подтверждён")}
+  const parsed=alertsResponseSchema.safeParse({revision,telegram,groups,rules,history:await deps.history(context),meta:await deps.meta(context)})
   if(!parsed.success)throw Error("Снимок оповещений не подтверждён")
   return parsed.data
  },alertsOverviewTransaction)

backend/src/services/alerts-revision.test.ts

@@ -0,0 +1,9 @@
+import assert from "node:assert/strict"
+import {test} from "node:test"
+import {alertsConfigRevision} from "./alerts-revision.js"
+const rule={id:"r",name:"Router",type:"server",targets:["router"],conditions:["offline"],severity:"critical",enabled:true,cooldown:"5м",chatId:"",recoveryMode:"conditional",recoveryStabilitySec:17}
+test("Alerts revision is deterministic across row/property order and ignores notification history",()=>{
+ const first={groups:[],rules:[{...rule,id:"b"},{...rule,id:"a"}]};const revision=alertsConfigRevision(first)
+ assert.match(revision,/^[a-f0-9]{64}$/);assert.equal(alertsConfigRevision({rules:[{lastFiredAt:"2026-10-03",...rule,id:"a"},{...rule,id:"b"}],groups:[]}),revision)
+ for(const patch of [{enabled:false},{targets:["other"]},{conditions:["online"]},{recoveryMode:"never"},{recoveryStabilitySec:18}])assert.notEqual(alertsConfigRevision({groups:[],rules:[{...rule,...patch,id:"a"},{...rule,id:"b"}]}),revision)
+})

backend/src/services/alerts-revision.ts

@@ -0,0 +1,9 @@
+import {createHash} from "node:crypto"
+import {putRulesSchema,normalizeAlertsConfig} from "@mmapp/contracts/alerts"
+export function alertsConfigRevision(input:unknown){
+ const parsed=putRulesSchema.parse(input)
+ if(parsed.groups===undefined)throw Error("Для ревизии нужен полный снимок групп")
+ const normalized=normalizeAlertsConfig(parsed)
+ const sort=<T extends {id:string}>(rows:T[])=>[...rows].sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0)
+ return createHash("sha256").update(JSON.stringify({groups:sort(normalized.groups!),rules:sort(normalized.rules)})).digest("hex")
+}

backend/src/services/alerts-service.ts

@@ -1,3 +1,4 @@
+import {alertsConfigRevision} from "./alerts-revision.js"
 import {readAlertsOverview,buildAlertsMeta} from "./alerts-overview.js"
 import {executeAlertsConfigReplacement} from "./alerts-config-execution.js"
 import {sendTelegramRequest} from "./alerts-telegram-send.js"
@@ -205,11 +206,12 @@ export type ReplaceAlertGroupInput = {
 
 /** Атомарно заменяет группы, правила и строки targets. */
 type AlertsWriteContext=Parameters<Parameters<typeof db.transaction>[0]>[0]
-export async function replaceAlertsConfig(payload: { groups?: ReplaceAlertGroupInput[]; rules: ReplaceAlertRuleInput[] }) {
+export async function replaceAlertsConfig(payload: { groups?: ReplaceAlertGroupInput[]; rules: ReplaceAlertRuleInput[];expectedRevision?:string }) {
   const now=sql`now()`
   return executeAlertsConfigReplacement<AlertsWriteContext>(payload, {
     transaction:work=>db.transaction(work),
     lock:async tx=>{const result=await tx.execute(sql`SELECT pg_try_advisory_xact_lock(8723103) AS acquired`);return typeof result.rows[0]?.acquired==="boolean"?result.rows[0].acquired:undefined},
+    revision:async tx=>alertsConfigRevision({groups:await listAlertGroups(tx),rules:await listAlertRules(tx)}),
     groups:tx=>listAlertGroups(tx),
     write:async(tx,{groups,rules})=>{
       await tx.delete(alertRuleConditions)
@@ -285,7 +287,7 @@ export async function replaceAlertsConfig(payload: { groups?: ReplaceAlertGroupI
         }
       }
     },
-    read:async tx=>({ok:true,groups:await listAlertGroups(tx),rules:await listAlertRules(tx)}),
+    read:async tx=>{const groups=await listAlertGroups(tx),rules=await listAlertRules(tx);return {ok:true,revision:alertsConfigRevision({groups,rules}),groups,rules}},
   })
 }