fix(dashboards): optimistic locking + manage-ACL on generate/stream

Adds @Version to SavedDashboard so concurrent chat turns / favorite /
share / update writes on the same row fail cleanly (409) instead of
racing or leaking a raw Hibernate error message. Also tightens
generate/stream to require manage (not just read) access, since it
creates/mutates saved dashboards.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: notSumit25

backend/src/main/java/com/dbaagent/controller/DashboardGenerationController.java

@@ -6,6 +6,7 @@
 import com.dbaagent.service.security.AccessControlService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -72,7 +73,10 @@ public ResponseEntity<?> generate(@RequestBody GenerateRequest request) {
     @PostMapping(value = "/generate/stream", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
     public SseEmitter generateStream(@RequestBody GenerateRequest request) {
         requireValid(request);
-        accessControlService.assertCanReadConnectionContent(request.connectionId());
+        // This path creates/updates a SavedDashboard row (beginGenerationTurn etc.)
+        // on every call, not just reads — a VIEWER (read-only) must not be able to
+        // mint or mutate drafts via chat.
+        accessControlService.assertCanManageConnectionContent(request.connectionId());
         SseEmitter emitter = new SseEmitter(600_000L);
 
         // Resolve (or create) the target dashboard and record the user's message
@@ -87,6 +91,11 @@ public SseEmitter generateStream(@RequestBody GenerateRequest request) {
         } catch (IllegalArgumentException | IllegalStateException e) {
             sendErrorAndComplete(emitter, e.getMessage());
             return emitter;
+        } catch (OptimisticLockingFailureException e) {
+            // Lost the race to another concurrent submit on the same dashboard —
+            // same user-facing shape as the "already running" case above.
+            sendErrorAndComplete(emitter, "A generation is already running for this dashboard.");
+            return emitter;
         }
         // The frontend needs this id right away (not just at the end) so a
         // brand-new dashboard is addressable — e.g. by a reload — well before

backend/src/main/java/com/dbaagent/controller/SavedDashboardController.java

@@ -5,6 +5,7 @@
 import com.dbaagent.service.security.AccessControlService;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
@@ -25,6 +26,19 @@ public class SavedDashboardController {
     @Autowired
     private AccessControlService accessControlService;
 
+    // Every write method below is load-then-save on a row a background generation
+    // turn (SavedDashboardService.beginGenerationTurn etc.) may be writing at the
+    // same time. Without this helper, the loser's raw Hibernate message
+    // ("Unexpected row count... where id=? and version=?") leaked straight into
+    // the API response as a 500 instead of a clean, retryable conflict.
+    private static ResponseEntity<Map<String, Object>> conflict(OptimisticLockingFailureException e) {
+        log.warn("Dashboard update lost a concurrent-write race: {}", e.getMessage());
+        Map<String, Object> body = new HashMap<>();
+        body.put("success", false);
+        body.put("message", "This dashboard changed elsewhere just now — please retry.");
+        return ResponseEntity.status(HttpStatus.CONFLICT).body(body);
+    }
+
     /** Publish this dashboard to the web (opt-in, revocable public link). */
     @PostMapping("/{id}/share")
     public ResponseEntity<Map<String, Object>> enableShare(@PathVariable UUID id) {
@@ -39,6 +53,8 @@ public ResponseEntity<Map<String, Object>> enableShare(@PathVariable UUID id) {
             return ResponseEntity.status(HttpStatus.NOT_FOUND).body(Map.of("success", false, "message", e.getMessage()));
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
+        } catch (OptimisticLockingFailureException e) {
+            return conflict(e);
         } catch (Exception e) {
             log.error("Error enabling dashboard share", e);
             return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
@@ -59,6 +75,8 @@ public ResponseEntity<Map<String, Object>> setSharePassword(@PathVariable UUID i
             return ResponseEntity.status(HttpStatus.NOT_FOUND).body(Map.of("success", false, "message", e.getMessage()));
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
+        } catch (OptimisticLockingFailureException e) {
+            return conflict(e);
         } catch (Exception e) {
             log.error("Error setting dashboard share password", e);
             return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
@@ -79,6 +97,8 @@ public ResponseEntity<Map<String, Object>> disableShare(@PathVariable UUID id) {
             return ResponseEntity.status(HttpStatus.NOT_FOUND).body(Map.of("success", false, "message", e.getMessage()));
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
+        } catch (OptimisticLockingFailureException e) {
+            return conflict(e);
         } catch (Exception e) {
             log.error("Error disabling dashboard share", e);
             return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
@@ -196,6 +216,8 @@ public ResponseEntity<Map<String, Object>> updateDashboard(@PathVariable UUID id
             return ResponseEntity.status(HttpStatus.NOT_FOUND).body(errorResponse);
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
+        } catch (OptimisticLockingFailureException e) {
+            return conflict(e);
         } catch (Exception e) {
             log.error("Error updating saved dashboard", e);
             Map<String, Object> errorResponse = new HashMap<>();
@@ -255,6 +277,8 @@ public ResponseEntity<Map<String, Object>> toggleFavorite(@PathVariable UUID id)
             return ResponseEntity.status(HttpStatus.NOT_FOUND).body(errorResponse);
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
+        } catch (OptimisticLockingFailureException e) {
+            return conflict(e);
         } catch (Exception e) {
             log.error("Error toggling favorite", e);
             Map<String, Object> errorResponse = new HashMap<>();

backend/src/main/java/com/dbaagent/model/SavedDashboard.java

@@ -102,6 +102,16 @@ public boolean isSharePasswordSet() {
     @Column(nullable = false)
     private LocalDateTime updatedAt;
 
+    // Optimistic lock: beginGenerationTurn/appendAgentReply/completeBuildTurn/
+    // appendErrorReply all do load-then-save on this same row, and two overlapping
+    // turns (e.g. a slow build finishing after the user already sent a follow-up
+    // chat) would otherwise silently lose whichever save landed first. Hibernate
+    // bumps this on every UPDATE and rejects a save whose version is stale with
+    // OptimisticLockException instead of overwriting.
+    @Version
+    @Column(nullable = false)
+    private Long version = 0L;
+
     // Jackson deserializes create/update bodies via Lombok's all-args constructor
     // (Spring's parameter-names module), which bypasses the field defaults and
     // leaves these NOT-NULL booleans null when the client omits them. Coerce here

backend/src/main/java/com/dbaagent/service/SavedDashboardService.java

@@ -253,6 +253,12 @@ public void deleteDashboardsByConnection(String connectionId) {
      * kicks off the slow agent work). Marking generationStatus=RUNNING here —
      * not after the agent finishes — is what lets a reload mid-generation see
      * "still working" instead of nothing at all.
+     *
+     * isFreshlyRunning below is check-then-act, but SavedDashboard.version
+     * (@Version) is the real guard: save() is `UPDATE ... WHERE version=?`, so a
+     * racing loser gets OptimisticLockingFailureException, not a double-append
+     * (caught in DashboardGenerationController same as the IllegalStateException
+     * below). Verified with concurrent requests: loser rejected, zero writes.
      */
     @Transactional
     public SavedDashboard beginGenerationTurn(UUID dashboardId, String connectionId, String prompt) {

backend/src/main/resources/db/migration/V112__add_dashboard_version.sql

@@ -0,0 +1 @@
+ALTER TABLE saved_dashboards ADD COLUMN IF NOT EXISTS version BIGINT NOT NULL DEFAULT 0;