Prevent stale saves from restoring deleted repeater items

_dev/src/components/RightPanel.vue

@@ -177,24 +177,33 @@ prettyBlocksContext.on('saveConfig', () => {
 })
 prettyBlocksContext.on('saveSubState', () => {
   save()
-  prettyBlocksContext.initStates()
 })
 
 /*
  * Save the SubState in BD
  *
  */
 const save = async (success = true) => {
-  let block = currentBlock.value;
-  let data = await prettyBlocksContext.updateSubSelectItem(state);
+  const context = snapshotBlockContext(prettyBlocksContext);
+  const { id_prettyblocks, subSelected, need_reload } = currentBlock.value;
+  const data = await prettyBlocksContext.updateSubSelectItem(state);
+  if (data.code === 'repeater_item_missing') {
+    if (sameBlockContext(context, snapshotBlockContext(prettyBlocksContext))
+      && currentBlock.value.id_prettyblocks === id_prettyblocks
+      && currentBlock.value.subSelected === subSelected) {
+      prettyBlocksContext.displayError(data.message);
+      await prettyBlocksContext.initStates({ selectId: id_prettyblocks, context });
+    }
+    return;
+  }
   if (data.success) {
     if (data.message && success) {
       prettyBlocksContext.displayMessage(data.message);
     }
-    if (block.need_reload) {
+    if (need_reload) {
       prettyBlocksContext.reloadIframe()
     } else {
-       prettyBlocksContext.sendPrettyBlocksEvents('reloadBlock', {id_prettyblocks: block.id_prettyblocks})
+       prettyBlocksContext.sendPrettyBlocksEvents('reloadBlock', {id_prettyblocks})
     }
   }
   prettyBlocksContext.initStates()

controllers/front/ajax.php

@@ -446,6 +446,16 @@ public function displayAjaxUpdateState()
         $formattedState = json_decode($stateRequest, true);
 
         $state_decoded = json_decode($state->state, true);
+        // The add action persists the item first; a save must never recreate a deleted key.
+        if (!is_array($state_decoded) || !array_key_exists($substate_key, $state_decoded)) {
+            exit(json_encode([
+                'success' => false,
+                'saved' => false,
+                'code' => 'repeater_item_missing',
+                'message' => $this->translator->trans('This repeater item no longer exists.', [], 'Modules.Prettyblocks.Admin'),
+            ]));
+        }
+
         $state_decoded[$substate_key] = $formattedState;
 
         $state->state = json_encode($state_decoded);

scripts/test-release.sh

@@ -152,6 +152,7 @@ for service in ps82 ps91; do
   for fixture_and_target in \
     'field-fileupload-test:classes/prettyblocks/core/FieldCore.php' \
     'date-field-test:classes/prettyblocks/core/FieldCore.php' \
+    'repeater-update-test:controllers/front/ajax.php' \
     'editor-cache-test:prettyblocks.php'; do
     fixture=${fixture_and_target%%:*}
     target=${fixture_and_target#*:}

tests/repeater-update-test.php

@@ -0,0 +1,99 @@
+<?php
+
+$controllerFile = $argv[1];
+$case = $argv[2] ?? null;
+
+// The AJAX action terminates with exit(), so run each case in its own PHP process.
+if ($case === null) {
+    foreach (['deleted', 'invalid-state', 'existing'] as $name) {
+        $command = implode(' ', array_map('escapeshellarg', [PHP_BINARY, __FILE__, $controllerFile, $name]));
+        passthru($command, $status);
+        if ($status !== 0) {
+            exit($status);
+        }
+    }
+
+    exit(0);
+}
+
+define('_PS_VERSION_', '8.2.7');
+
+class ModuleFrontController
+{
+}
+
+class Tools
+{
+    public static function getValue($key)
+    {
+        return $_POST[$key] ?? false;
+    }
+}
+
+class PrettyBlocksModel
+{
+    public static $originalState;
+    public static $savedState;
+    public $state;
+
+    public function __construct($id, $language, $shop)
+    {
+        $this->state = self::$originalState;
+    }
+
+    public function save()
+    {
+        self::$savedState = $this->state;
+
+        return true;
+    }
+}
+
+require $controllerFile;
+
+class RepeaterUpdateFixtureController extends PrettyBlocksAjaxModuleFrontController
+{
+    public function __construct()
+    {
+        $this->translator = new class {
+            public function trans($message, $parameters, $domain)
+            {
+                return $message;
+            }
+        };
+    }
+}
+
+$initialItems = [1 => ['question' => ['value' => 'Keep this']], 3 => ['question' => ['value' => 'Edit this']]];
+$updatedItem = ['question' => ['value' => 'Updated question']];
+PrettyBlocksModel::$originalState = $case === 'invalid-state' ? 'null' : json_encode($initialItems);
+$_POST = [
+    'id_prettyblocks' => '12',
+    'ctx_id_lang' => '1',
+    'ctx_id_shop' => '1',
+    'subSelected' => $case === 'existing' ? '3' : '2',
+    'state' => json_encode($updatedItem),
+];
+
+ob_start();
+register_shutdown_function(function () use ($case, $initialItems, $updatedItem) {
+    $result = json_decode(ob_get_clean(), true);
+    if ($case === 'existing') {
+        $initialItems[3] = $updatedItem;
+        $valid = ($result['success'] ?? null) === true
+            && json_decode(PrettyBlocksModel::$savedState ?? '', true) === $initialItems;
+    } else {
+        $valid = ($result['success'] ?? null) === false
+            && ($result['code'] ?? null) === 'repeater_item_missing'
+            && PrettyBlocksModel::$savedState === null;
+    }
+
+    if (!$valid) {
+        fwrite(STDERR, "Repeater update fixture failed: $case.\n");
+        exit(1);
+    }
+
+    echo "Repeater update fixture passed: $case.\n";
+});
+
+(new RepeaterUpdateFixtureController())->displayAjaxUpdateState();