Keep in-editor asset curation off the head, layering it like every edit

ensure_autosave! gives body keystrokes and asset curation one shared
layer, so head is never mutated in place and every curation change
surfaces in the publish delta. Stale rendered join ids are mapped
across the clone via asset_id. Curation now requires holding the
lock; a missing lock answers 423, matching the autosave endpoint.

2 files changed, 19 insertions, 11 deletions

diff --git a/app/controllers/related_assets_controller.rb b/app/controllers/related_assets_controller.rb
index ca894f2f..3aa6d3db 100644
--- a/app/controllers/related_assets_controller.rb
+++ b/app/controllers/related_assets_controller.rb
@@ -2,6 +2,10 @@ class RelatedAssetsController < ApplicationController
   before_action :login_required
   before_action :find_node
 
+  rescue_from LockedByAnotherUser do
+    head :locked
+  end
+
   def search
     term = params[:search_term].to_s.strip
     attached_ids = @node.editable_page.related_assets.pluck(:asset_id)
@@ -19,8 +23,9 @@ class RelatedAssetsController < ApplicationController
   end
 
   def create
+    page  = @node.ensure_autosave!(current_user)
     asset = Asset.find(params[:asset_id])
-    related = @node.editable_page.related_assets.find_or_create_by!(asset: asset)
+    related = page.related_assets.find_or_create_by!(asset: asset)
 
     render json: {
       id: related.id,
@@ -35,22 +40,25 @@ class RelatedAssetsController < ApplicationController
   end
 
   def destroy
-    @node.editable_page.related_assets.find(params[:id]).destroy
+    page   = @node.ensure_autosave!(current_user)
+    source = RelatedAsset.find(params[:id])
+    page.related_assets.find_by!(:asset_id => source.asset_id).destroy
     head :ok
   end
 
   def update
-    related = @node.editable_page.related_assets.find(params[:id])
+    page    = @node.ensure_autosave!(current_user)
+    source  = RelatedAsset.find(params[:id])
+    related = page.related_assets.find_by!(:asset_id => source.asset_id)
 
     if params.key?(:headline)
       RelatedAsset.transaction do
-        @node.editable_page.related_assets.update_all(headline: false)
+        page.related_assets.update_all(headline: false)
         related.update!(headline: true) if params[:headline] == "true"
       end
     else
       related.insert_at(params[:position].to_i)
     end
-
     head :ok
   end
 
diff --git a/app/models/node.rb b/app/models/node.rb
index 274b2f94..02502f6c 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -112,18 +112,18 @@ class Node < ApplicationRecord
     end
   end
 
-  # Creates or updates the autosave buffer from the given attributes.
-  # Autosave rows are never associated to the node via node_id -- they
-  # must never appear in self.pages / the revisions list, which is the
-  # whole reason autosave exists as a separate, unversioned layer.
-  def autosave! attributes, current_user
+  def ensure_autosave! current_user
     assert_locked_by! current_user
-
     unless self.autosave
       self.autosave = Page.create!(:editor => current_user)
       self.autosave.clone_attributes_from(self.draft || self.head) if self.draft || self.head
       self.save!
     end
+    self.autosave
+  end
+
+  def autosave! attributes, current_user
+    ensure_autosave!(current_user)
     self.autosave.assign_attributes(attributes)
     self.autosave.save!
     self.autosave