fix putData : detect collision on specific provided version id

Issue: CLDSRV-953

Author: SylvainSenechal

lib/routes/routeBackbeat.js

@@ -450,8 +450,9 @@ function putData(request, response, bucketInfo, objMd, log, callback) {
                 errorInstances.BadRequest.customizeDescription('bad request: invalid x-scal-version-id header'),
             );
         }
-        if (objMd && objMd.versionId === incomingVersionIdDecoded) {
-            // Data already at destination for this version; return 409 with the existing
+        if (objMd) {
+            // objMd is the specific version (fetched by versionId from x-scal-version-id header)
+            // its existence means data is already at destination. Return 409 with the existing
             // microVersionId so backbeat can decide if putMetadata is still needed.
             log.debug('crr putData: version already at destination', {
                 method: 'putData',
@@ -2069,7 +2070,20 @@ function routeBackbeat(clientIP, request, response, log) {
                     });
                     return next(errors.InvalidArgument);
                 }
-                const versionId = decodedVidResult;
+                let versionId = decodedVidResult;
+                // For putData api: the version to check is passed
+                // via x-scal-version-id header, not the URL query. Fetch that specific
+                // version so objMd matches the replicated version, not always the master.
+                const isPutDataApi = request.method === 'PUT' && request.resourceType === 'data';
+                if (isPutDataApi) {
+                    const versionIdHeader = request.headers['x-scal-version-id'];
+                    if (versionIdHeader !== undefined && versionIdHeader !== 'null') {
+                        const decoded = decode(versionIdHeader);
+                        if (!(decoded instanceof Error)) {
+                            versionId = decoded;
+                        }
+                    }
+                }
                 if (useMultipleBackend) {
                     if (request.resourceType === 'multiplebackendmetadata') {
                         return backbeatRoutes[request.method][request.resourceType](request, response, log, next);

tests/functional/backbeat/putData.js

@@ -106,6 +106,43 @@ describe('putData : VersionId collision detection', () => {
         const output = await putData(key, { versionId: differentVersionId });
         assert.ok(output.Location, 'should return a Location when data is written normally');
     });
+
+    it('should throw VersionIdCollisionException when a non-current version already exists', async () => {
+        const key = 'putdata-non-current-collision';
+
+        const v1Result = await s3.send(
+            new PutObjectCommand({
+                Bucket: TEST_BUCKET,
+                Key: key,
+                Body: Buffer.from(OBJECT_BODY),
+                ContentType: 'text/plain',
+            }),
+        );
+        const v1VersionId = v1Result.VersionId;
+        assert.ok(v1VersionId, 'first PutObject should return a VersionId');
+
+        const v2Result = await s3.send(
+            new PutObjectCommand({
+                Bucket: TEST_BUCKET,
+                Key: key,
+                Body: Buffer.from(OBJECT_BODY),
+                ContentType: 'text/plain',
+            }),
+        );
+        assert.ok(v2Result.VersionId, 'second PutObject should return a VersionId');
+
+        // putData on v1 (non-current) must detect the collision, not just compare against master
+        try {
+            await putData(key, { versionId: v1VersionId });
+            assert.fail('expected VersionIdCollisionException');
+        } catch (err) {
+            assert.ok(
+                err instanceof VersionIdCollisionException,
+                `expected VersionIdCollisionException, got ${err.constructor.name}`,
+            );
+            assert.strictEqual(err.microVersionId, '', 'microVersionId should be empty for original write state');
+        }
+    });
 });
 
 describe('putData : null-version objects (ExternalNullVersionId)', () => {