fix(caver): address PR review feedback

- Replace TOCTOU SELECT+INSERT with atomic ON CONFLICT in add-explored-entrance
- Add unique index to test DB for ON CONFLICT support
- Add missing DELETE test for non-existing caverId
- Move legacy j_caver_cave_explorer cleanup into Promise.all in delete
- Add defensive junction row cleanup in model test outer after hook

Author: ClemRz

api/controllers/v1/caver/add-explored-entrance.js

@@ -31,28 +31,22 @@ module.exports = async (req, res) => {
     return res.notFound(`Caver with id ${caverId} not found.`);
   }
 
-  // Check if a relationship already exists
-  const existingQuery = `
-    SELECT 1 FROM j_caver_entrance_explorer
-    WHERE id_entrance = $1 AND id_caver = $2
+  // Atomic upsert: INSERT with ON CONFLICT eliminates the TOCTOU race
+  const insertQuery = `
+    INSERT INTO j_caver_entrance_explorer (id_entrance, id_caver)
+    VALUES ($1, $2)
+    ON CONFLICT (id_entrance, id_caver) DO NOTHING
   `;
-  const existingResult = await sails.sendNativeQuery(existingQuery, [
+  const result = await sails.sendNativeQuery(insertQuery, [
     entranceId,
     caverId,
   ]);
 
-  if (existingResult.rows.length > 0) {
+  if (result.rowCount === 0) {
     return res.conflict(
       'Caver is already registered as an explorer of this entrance.'
     );
   }
 
-  // Create the relationship
-  const insertQuery = `
-    INSERT INTO j_caver_entrance_explorer (id_entrance, id_caver)
-    VALUES ($1, $2)
-  `;
-  await sails.sendNativeQuery(insertQuery, [entranceId, caverId]);
-
   return res.status(204).send();
 };

api/controllers/v1/caver/delete.js

@@ -158,14 +158,13 @@ module.exports = async (req, res) => {
     linkedEntitiesDeleteOrMerge('subscribedToRegions'),
     linkedEntitiesDeleteOrMerge('grottos'),
     linkedEntitiesDeleteOrMerge('documents', allDocumentIds),
+    // Clean up legacy j_caver_cave_explorer rows (table preserved, no Waterline association)
+    CommonService.query(
+      'DELETE FROM j_caver_cave_explorer WHERE id_caver = $1',
+      [caverId]
+    ),
   ]);
 
-  // Clean up legacy j_caver_cave_explorer rows (table preserved, no Waterline association)
-  await CommonService.query(
-    'DELETE FROM j_caver_cave_explorer WHERE id_caver = $1',
-    [caverId]
-  );
-
   await TCaver.destroyOne({ id: caverId });
 
   const action = shouldMergeInto ? 'delete+merge' : 'delete';

test/customSQL.js

@@ -93,6 +93,7 @@ CREATE INDEX IF NOT EXISTS j_caver_cave_explorer_id_caver_idx ON j_caver_cave_ex
 CREATE INDEX IF NOT EXISTS j_caver_cave_explorer_id_cave_idx ON j_caver_cave_explorer (id_cave);
 CREATE INDEX IF NOT EXISTS j_caver_entrance_explorer_id_caver_idx ON j_caver_entrance_explorer (id_caver);
 CREATE INDEX IF NOT EXISTS j_caver_entrance_explorer_id_entrance_idx ON j_caver_entrance_explorer (id_entrance);
+CREATE UNIQUE INDEX IF NOT EXISTS j_caver_entrance_explorer_unique ON j_caver_entrance_explorer (id_entrance, id_caver);
 CREATE INDEX IF NOT EXISTS idx_document_id_parent ON t_document(id_parent) WHERE id_parent IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_document_hierarchy ON t_document(id, id_parent);
 CREATE INDEX IF NOT EXISTS idx_t_document_type ON t_document(id_type);

test/integration/0_models/JCaverEntranceExplorer.test.js

@@ -30,6 +30,14 @@ describe('JCaverEntranceExplorer model associations', () => {
   });
 
   after(async () => {
+    // Clear any lingering junction rows first (idempotent — safe if already gone)
+    if (testCaver && testEntrance) {
+      await TCaver.removeFromCollection(
+        testCaver.id,
+        'exploredEntrances',
+        testEntrance.id
+      );
+    }
     if (testEntrance) await TEntrance.destroyOne({ id: testEntrance.id });
     if (testCave) await TCave.destroyOne({ id: testCave.id });
     if (testCaver) await TCaver.destroyOne({ id: testCaver.id });

test/integration/4_routes/Cavers/exploredEntrances.test.js

@@ -155,6 +155,13 @@ describe('Caver explored entrances features', () => {
         .expect(404, done);
     });
 
+    it('should return 404 on non-existing caver', (done) => {
+      supertest(sails.hooks.http.app)
+        .delete(`/api/v1/entrances/${testEntrance.id}/cavers/987654321`)
+        .set('Authorization', moderatorToken)
+        .expect(404, done);
+    });
+
     it('should return 404 when relationship does not exist', async () => {
       // Remove the relationship first
       await sails.sendNativeQuery(