#492: conditional requests on PUT/DELETE/MOVE; ETag after PUT and tus finalize #503

Merged
Cordy merged 2 commits from fix-492 into main 2026-09-12 15:47:29 +00:00
Owner

Wave 3 of the hardening set — closes the lost-update window for sync clients (desktop ruling P2-R16).

  • checkWriteConditions evaluates If-Match / If-None-Match (RFC 7232 §3) against the current ETag before PUT, DELETE and MOVE (source); a stale validator answers 412 and nothing is written. If-None-Match: * gives create-if-absent semantics.
  • PUT 201/204 responses carry the new ETag and Last-Modified; the tus PATCH that completes an upload returns the stored object's ETag — no follow-up PROPFIND that can race a concurrent same-size write.
  • Tests: stale/matching If-Match on PUT, DELETE and MOVE (refused writes leave content untouched), If-None-Match * create-then-412, tus completion ETag. All witnessed red first; full suite green.
Wave 3 of the hardening set — closes the lost-update window for sync clients (desktop ruling P2-R16). - `checkWriteConditions` evaluates If-Match / If-None-Match (RFC 7232 §3) against the current ETag before PUT, DELETE and MOVE (source); a stale validator answers **412** and nothing is written. `If-None-Match: *` gives create-if-absent semantics. - PUT 201/204 responses carry the new **ETag** and **Last-Modified**; the tus PATCH that completes an upload returns the stored object's ETag — no follow-up PROPFIND that can race a concurrent same-size write. - Tests: stale/matching If-Match on PUT, DELETE and MOVE (refused writes leave content untouched), If-None-Match `*` create-then-412, tus completion ETag. All witnessed red first; full suite green.
Cordy merged commit 50e1b527d0 into main 2026-09-12 15:47:29 +00:00
Cordy deleted branch fix-492 2026-09-12 15:47:31 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#503
No description provided.