fix(issues): refuse stale edits and bump updated_at on chat detach

Author: TheodoreSpeaks

apps/sim/lib/issues/__integration__/issue-body-access.integration.ts

@@ -171,12 +171,21 @@ describe('issue bodies in PostgreSQL', () => {
       .where(eq(copilotChats.id, chatId))
     expect(chat.issueId).toBe(working[0].id)
 
+    const [before] = await db
+      .select({ updatedAt: issue.updatedAt })
+      .from(issue)
+      .where(eq(issue.id, working[0].id))
     await db.transaction((tx) => detachChatFromIssuesInTx(tx, chatId))
     const [released] = await db
-      .select({ status: issue.status, workingChatId: issue.workingChatId })
+      .select({
+        status: issue.status,
+        workingChatId: issue.workingChatId,
+        updatedAt: issue.updatedAt,
+      })
       .from(issue)
       .where(eq(issue.id, working[0].id))
-    expect(released).toEqual({ status: 'inbox', workingChatId: null })
+    expect(released).toMatchObject({ status: 'inbox', workingChatId: null })
+    expect(released.updatedAt.getTime()).toBeGreaterThan(before.updatedAt.getTime())
     const detached = await db
       .select({ kind: issueEvent.kind })
       .from(issueEvent)

apps/sim/lib/issues/application/issues.ts

@@ -325,7 +325,18 @@ export const updateIssue = defineAuthorizedWorkspaceUseCase({
       events.push({ kind: 'owner_changed', payload: { from: current.ownerId, to: input.ownerId } })
     }
     if (events.length > 0) {
-      await transition(current.id, { statuses: ISSUE_STATUSES }, values, () => events, principal)
+      const unchanged = {
+        ...(values.title === undefined ? {} : { title: current.title }),
+        ...(values.priority === undefined ? {} : { priority: current.priority }),
+        ...(values.ownerId === undefined ? {} : { ownerId: current.ownerId }),
+      }
+      await transition(
+        current.id,
+        { statuses: ISSUE_STATUSES, unchanged },
+        values,
+        () => events,
+        principal
+      )
     }
     return { issue: await presentIssue(current.id) }
   },

apps/sim/lib/issues/repository.integration.ts

@@ -153,6 +153,22 @@ describe('issue state in PostgreSQL', () => {
     expect(await db.transaction((tx) => allocateIssueNumber(tx, 'org-b'))).toBe(1)
   })
 
+  it('refuses an edit when a field it changes no longer holds the value that was read', async () => {
+    const db = testDb()
+    const id = await insertIssue({ number: 11 })
+    const rename = (from: string) =>
+      db.transaction((tx) =>
+        updateIssueInTx(
+          tx,
+          id,
+          { statuses: ['inbox'], unchanged: { title: from } },
+          { title: 'Renamed' }
+        )
+      )
+    expect(await rename('Stale title')).toBeNull()
+    expect((await rename('Title'))?.title).toBe('Renamed')
+  })
+
   it('lets only one of two transitions from the same state win', async () => {
     const db = testDb()
     const chatA = await newChat()

apps/sim/lib/issues/repository.ts

@@ -144,6 +144,8 @@ export interface IssueStateGuard {
   statuses: readonly IssueStatus[]
   /** Inbox with a working chat is waiting for review; without one it is new. */
   hasWorkingChat?: boolean
+  /** Fields that must still hold the values the caller read, so an edit never logs a stale "from". */
+  unchanged?: { title?: string; priority?: number; ownerId?: string | null }
 }
 
 /**
@@ -170,6 +172,15 @@ export async function updateIssueInTx(
         eq(issue.id, issueId),
         inArray(issue.status, [...guard.statuses]),
         chatCondition,
+        guard.unchanged?.title === undefined ? undefined : eq(issue.title, guard.unchanged.title),
+        guard.unchanged?.priority === undefined
+          ? undefined
+          : eq(issue.priority, guard.unchanged.priority),
+        guard.unchanged?.ownerId === undefined
+          ? undefined
+          : guard.unchanged.ownerId === null
+            ? isNull(issue.ownerId)
+            : eq(issue.ownerId, guard.unchanged.ownerId),
         isNull(issue.deletedAt)
       )
     )

packages/db/migrations/0400_issue.sql

@@ -182,6 +182,7 @@ BEGIN
     IF NEW.status = 'in_progress' THEN
       NEW.status := 'inbox';
     END IF;
+    NEW.updated_at := now();
     INSERT INTO issue_event (id, issue_id, kind, payload)
     VALUES (gen_random_uuid()::text, NEW.id, 'chat_detached', jsonb_build_object('chatId', OLD.working_chat_id));
   END IF;