FOUR-32319: Prevent publishing unchanged bundle versions

ProcessMaker/Http/Controllers/Api/DevLinkController.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Notification;
 use Illuminate\Validation\Rule;
@@ -23,6 +24,7 @@
 use ProcessMaker\Models\SettingsMenus;
 use ProcessMaker\Models\User;
 use ProcessMaker\Notifications\BundleUpdatedNotification;
+use ProcessMaker\Services\DevLink\BundleFingerprint;
 
 class DevLinkController extends Controller
 {
@@ -146,14 +148,21 @@ public function remoteBundles(Request $request, DevLink $devLink)
         return $devLink->remoteBundles($request->input('filter'));
     }
 
-    public function createBundle(Request $request)
+    public function createBundle(Request $request, BundleFingerprint $fingerprint)
     {
-        $bundle = new Bundle();
-        $bundle->name = $request->input('name');
-        $bundle->description = $request->input('description');
-        $bundle->published = (bool) $request->input('published', false);
-        $bundle->version = 1;
-        $bundle->saveOrFail();
+        $bundle = DB::transaction(function () use ($request, $fingerprint) {
+            $bundle = new Bundle();
+            $bundle->name = $request->input('name');
+            $bundle->description = $request->input('description');
+            $bundle->published = (bool) $request->input('published', false);
+            $bundle->version = 1;
+            $bundle->saveOrFail();
+
+            $bundle->published_fingerprint = $fingerprint->calculate($bundle);
+            $bundle->saveOrFail();
+
+            return $bundle;
+        });
 
         return $bundle;
     }
@@ -170,12 +179,34 @@ public function updateBundle(Request $request, Bundle $bundle)
         return $bundle;
     }
 
-    public function increaseBundleVersion(Bundle $bundle)
+    public function increaseBundleVersion(Bundle $bundle, BundleFingerprint $fingerprint)
     {
-        $bundle->notifyBundleUpdated();
+        $bundle->validateEditable();
 
-        $bundle->version = $bundle->version + 1;
-        $bundle->saveOrFail();
+        $bundle = DB::transaction(function () use ($bundle, $fingerprint) {
+            $lockedBundle = Bundle::whereKey($bundle->id)->lockForUpdate()->firstOrFail();
+            $lockedBundle->validateEditable();
+            $currentFingerprint = $fingerprint->calculate($lockedBundle);
+
+            // Legacy source bundles have no trustworthy published snapshot to backfill from.
+            // Their first publication establishes the baseline; later identical attempts are blocked.
+            if (
+                $lockedBundle->published_fingerprint !== null
+                && hash_equals($lockedBundle->published_fingerprint, $currentFingerprint)
+            ) {
+                throw ValidationException::withMessages([
+                    '*' => 'There are no changes to publish for this bundle.',
+                ]);
+            }
+
+            $lockedBundle->version = $lockedBundle->version + 1;
+            $lockedBundle->published_fingerprint = $currentFingerprint;
+            $lockedBundle->saveOrFail();
+
+            return $lockedBundle;
+        });
+
+        $bundle->notifyBundleUpdated();
 
         return $bundle;
     }
@@ -202,10 +233,13 @@ public function bundleUpdated($bundleId, $token)
 
     public function deleteBundle(Bundle $bundle)
     {
-        $bundle->assets()->delete();
-        $bundle->settings()->delete();
-        $bundle->instances()->delete();
-        $bundle->delete();
+        DB::transaction(function () use ($bundle) {
+            $lockedBundle = Bundle::whereKey($bundle->id)->lockForUpdate()->firstOrFail();
+            $lockedBundle->assets()->delete();
+            $lockedBundle->settings()->delete();
+            $lockedBundle->instances()->delete();
+            $lockedBundle->delete();
+        });
     }
 
     public function installRemoteBundle(Request $request, DevLink $devLink, $remoteBundleId)
@@ -378,14 +412,20 @@ public function remoteBundleVersion(DevLink $devLink, $remoteBundleId)
 
     public function deleteBundleAsset(BundleAsset $bundleAsset)
     {
-        $bundleAsset->delete();
+        DB::transaction(function () use ($bundleAsset) {
+            Bundle::whereKey($bundleAsset->bundle_id)->lockForUpdate()->firstOrFail();
+            $bundleAsset->delete();
+        });
 
         return response()->json(['message' => 'Bundle asset association deleted.'], 200);
     }
 
     public function deleteBundleSetting(BundleSetting $bundleSetting)
     {
-        $bundleSetting->delete();
+        DB::transaction(function () use ($bundleSetting) {
+            Bundle::whereKey($bundleSetting->bundle_id)->lockForUpdate()->firstOrFail();
+            $bundleSetting->delete();
+        });
 
         return response()->json(['message' => 'Bundle setting deleted.'], 200);
     }

ProcessMaker/Models/Bundle.php

@@ -3,6 +3,7 @@
 namespace ProcessMaker\Models;
 
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use ProcessMaker\Exception\ExporterNotSupported;
 use ProcessMaker\Exception\ValidationException;
@@ -105,6 +106,13 @@ public function exportSettingPayloads()
     }
 
     public function syncAssets($assets)
+    {
+        return $this->mutateWithLock(function (Bundle $bundle) use ($assets) {
+            return $bundle->syncAssetsWithoutLock($assets);
+        });
+    }
+
+    private function syncAssetsWithoutLock($assets)
     {
         $assetKeys = [];
         foreach ($assets as $asset) {
@@ -139,6 +147,13 @@ public function syncAssets($assets)
     }
 
     public function addAsset(ProcessMakerModel $asset)
+    {
+        return $this->mutateWithLock(function (Bundle $bundle) use ($asset) {
+            return $bundle->addAssetWithoutLock($asset);
+        });
+    }
+
+    private function addAssetWithoutLock(ProcessMakerModel $asset)
     {
         if (!BundleAsset::canExport($asset)) {
             throw new ExporterNotSupported();
@@ -159,6 +174,13 @@ public function addAsset(ProcessMakerModel $asset)
     }
 
     public function addSettings($setting, $newId, $type = null, $replaceIds = false)
+    {
+        return $this->mutateWithLock(function (Bundle $bundle) use ($setting, $newId, $type, $replaceIds) {
+            return $bundle->addSettingsWithoutLock($setting, $newId, $type, $replaceIds);
+        });
+    }
+
+    private function addSettingsWithoutLock($setting, $newId, $type = null, $replaceIds = false)
     {
         $existingSetting = $this->settings()->where('setting', $setting)->first();
 
@@ -218,7 +240,7 @@ private function updateExistingSetting($existingSetting, $decodedNewId, $replace
             return;
         }
 
-        $config = json_decode($existingSetting->config, true) ?: ['id' => []];
+        $config = $existingSetting->configAsArray() ?: ['id' => []];
 
         if (!isset($config['id']) || !is_array($config['id'])) {
             $config['id'] = [];
@@ -374,6 +396,13 @@ public function savePayloadsToFile(array $payloads, array $payloadsSettings, $lo
     }
 
     public function installSettings($settings)
+    {
+        return $this->mutateWithLock(function (Bundle $bundle) use ($settings) {
+            return $bundle->installSettingsWithoutLock($settings);
+        });
+    }
+
+    private function installSettingsWithoutLock($settings)
     {
         $newSettingsKeys = collect($settings)->pluck('setting')->toArray();
 
@@ -382,10 +411,23 @@ public function installSettings($settings)
             ->delete();
 
         foreach ($settings as $setting) {
-            $this->addSettings($setting['setting'], $setting['config']);
+            $this->addSettingsWithoutLock($setting['setting'], $setting['config']);
         }
     }
 
+    private function mutateWithLock(callable $callback)
+    {
+        $result = DB::transaction(function () use ($callback) {
+            $bundle = static::whereKey($this->getKey())->lockForUpdate()->firstOrFail();
+
+            return $callback($bundle);
+        });
+
+        $this->refresh();
+
+        return $result;
+    }
+
     public function installSettingsPayloads(array $payloads, $mode, $logger = null)
     {
         $options = new Options([

ProcessMaker/Models/BundleSetting.php

@@ -36,9 +36,24 @@ public function bundle()
         return $this->belongsTo(Bundle::class);
     }
 
+    public function configAsArray(): array
+    {
+        if (is_array($this->config)) {
+            return $this->config;
+        }
+
+        if (!is_string($this->config)) {
+            return [];
+        }
+
+        $config = json_decode($this->config, true);
+
+        return is_array($config) ? $config : [];
+    }
+
     public function export()
     {
-        $configData = json_decode($this->config, true);
+        $configData = $this->configAsArray();
         $ids = $configData['id'] ?? [];
 
         switch ($this->setting) {