Protect changing in parallel using HTTP 412 precondition failed

Makefile

@@ -1,3 +1,19 @@
+run: examples/base/pocketbase
+	examples/base/pocketbase serve --dir examples/base/data
+
+examples/base/pocketbase: ui/node_modules
+	npm --prefix ui run build
+	rm -rf ui/node_modules
+	go build -o examples/base/pocketbase examples/base/main.go
+	git restore ui
+	git clean -f ui
+
+ui/node_modules:
+	npm --prefix ui install
+
+clean:
+	rm examples/base/pocketbase
+
 lint:
 	golangci-lint run -c ./golangci.yml ./...
 

examples/base/main.go

@@ -116,11 +116,47 @@ func main() {
 		Priority: 999, // execute as latest as possible to allow users to provide their own route
 	})
 
+	app.OnRecordViewRequest().BindFunc(addLastModified)
+
+	app.OnRecordUpdateRequest().BindFunc(ifUnmodifiedSince)
+
+	app.OnRecordDeleteRequest().BindFunc(ifUnmodifiedSince)
+
 	if err := app.Start(); err != nil {
 		log.Fatal(err)
 	}
 }
 
+func addLastModified(e *core.RecordRequestEvent) error {
+	updated := e.Record.GetString("updated")
+
+	if updated != "" {
+		e.Response.Header().Add("Last-Modified", updated)
+	}
+
+	return e.Next()
+}
+
+func ifUnmodifiedSince(e *core.RecordRequestEvent) error {
+	updated := e.Record.GetString("updated")
+
+	if updated != "" {
+		header := e.Request.Header.Get("If-Unmodified-Since")
+
+		if header == "" || header != updated {
+			e.Response.Header().Add("Last-Modified", updated)
+
+			if header == "" {
+				return e.Error(http.StatusPreconditionRequired, "Header If-Unmodified-Since is required", nil)
+			} else if header != updated {
+				return e.Error(http.StatusPreconditionFailed, "Record was modified after retrieval", nil)
+			}
+		}
+	}
+
+	return e.Next()
+}
+
 // the default pb_public dir location is relative to the executable
 func defaultPublicDir() string {
 	if osutils.IsProbablyGoRun() {

ui/src/components/records/RecordUpsertPanel.svelte

@@ -278,7 +278,11 @@
             if (isNew) {
                 result = await ApiClient.collection(collection.id).create(data);
             } else {
-                result = await ApiClient.collection(collection.id).update(record.id, data);
+                result = await ApiClient.collection(collection.id).update(record.id, data, {
+                    headers: {
+                        "If-Unmodified-Since": record.updated,
+                    },
+                });
             }
 
             addSuccessToast(isNew ? "Successfully created record." : "Successfully updated record.");
@@ -318,7 +322,11 @@
 
         confirm(`Do you really want to delete the selected record?`, () => {
             return ApiClient.collection(original.collectionId)
-                .delete(original.id)
+                .delete(original.id, {
+                    headers: {
+                        "If-Unmodified-Since": record.updated,
+                    },
+                })
                 .then(() => {
                     forceHide();
                     addSuccessToast("Successfully deleted record.");