From 9c96d05c695f59a55cd994dae24a6cfac934c1a4 Mon Sep 17 00:00:00 2001
From: Damien Chomat <damien.chomat@gmail.com>
Date: Tue, 10 Feb 2026 22:46:51 +0100
Subject: [PATCH] fix: /PUT state not following spec with 409 -  Conflict

---
 .../lrs/pedestal/routes/documents.cljc        | 46 ++++++++++---------
 src/test/com/yetanalytics/lrs_test.clj        | 40 ++++++++++++++++
 2 files changed, 64 insertions(+), 22 deletions(-)

diff --git a/src/main/com/yetanalytics/lrs/pedestal/routes/documents.cljc b/src/main/com/yetanalytics/lrs/pedestal/routes/documents.cljc
index ef76b19..cd67e66 100644
--- a/src/main/com/yetanalytics/lrs/pedestal/routes/documents.cljc
+++ b/src/main/com/yetanalytics/lrs/pedestal/routes/documents.cljc
@@ -306,17 +306,18 @@
                                      lrs
                                      ctx
                                      auth-identity params))]
-                  (if (and (or
-                            ;; In 2.0, no headers ok for no doc
-                            (= "2.0.0"
-                               (:com.yetanalytics.lrs/version ctx))
-                            ;; prior tests seem to want this for everything but
-                            ;; profiles
-                            (not (#{:xapi.activities.profile.PUT.request/params
-                                    :xapi.agents.profile.PUT.request/params}
-                                  params-type)))
-                           (not (:error doc-res))
-                           (nil? (:document doc-res)))
+                  (if (and (not (:error doc-res))
+                           (or
+                            ;; State resources are exempt from concurrency
+                            ;; header requirements in all xAPI versions
+                            (= :xapi.activities.state.PUT.request/params
+                               params-type)
+                            (and (nil? (:document doc-res))
+                                 (or (= "2.0.0"
+                                        (:com.yetanalytics.lrs/version ctx))
+                                     (not (#{:xapi.activities.profile.PUT.request/params
+                                             :xapi.agents.profile.PUT.request/params}
+                                           params-type))))))
                     (put-response ctx
                                   (a/<! (lrs/set-document-async
                                          lrs
@@ -344,17 +345,18 @@
                              lrs
                              ctx
                              auth-identity params)]
-                (if (and (or
-                          ;; In 2.0, no headers ok for no doc
-                          (= "2.0.0"
-                             (:com.yetanalytics.lrs/version ctx))
-                          ;; prior tests seem to want this for everything but
-                          ;; profiles
-                          (not (#{:xapi.activities.profile.PUT.request/params
-                                  :xapi.agents.profile.PUT.request/params}
-                                params-type)))
-                         (not (:error doc-res))
-                         (nil? (:document doc-res)))
+                (if (and (not (:error doc-res))
+                         (or
+                          ;; State resources are exempt from concurrency
+                          ;; header requirements in all xAPI versions
+                          (= :xapi.activities.state.PUT.request/params
+                             params-type)
+                          (and (nil? (:document doc-res))
+                               (or (= "2.0.0"
+                                      (:com.yetanalytics.lrs/version ctx))
+                                   (not (#{:xapi.activities.profile.PUT.request/params
+                                           :xapi.agents.profile.PUT.request/params}
+                                         params-type))))))
                   (put-response ctx
                                 (lrs/set-document
                                  lrs
diff --git a/src/test/com/yetanalytics/lrs_test.clj b/src/test/com/yetanalytics/lrs_test.clj
index e76cb33..8f36f9d 100644
--- a/src/test/com/yetanalytics/lrs_test.clj
+++ b/src/test/com/yetanalytics/lrs_test.clj
@@ -284,3 +284,43 @@
           "2.0.0" 200)
         (finally
           (http/stop lrs))))))
+
+(def agent-json
+  "{\"objectType\":\"Agent\",\"account\":{\"homePage\":\"http://www.example.com/agentId/1\",\"name\":\"Rick James\"}}")
+
+(defn- put-document
+  "PUT a document to the given url with query-params, version header, and body."
+  [url query-params version body]
+  (curl/put
+   url
+   {:basic-auth    ["username" "password"]
+    :headers       {"X-Experience-API-Version" version
+                    "Content-Type"             "application/octet-stream"}
+    :query-params  query-params
+    :body          body
+    :throw         false}))
+
+(deftest document-concurrency-test
+  (testing "Document PUT concurrency without If-Match/If-None-Match headers"
+    (let [server (support/test-server :port 8081)]
+      (try
+        (http/start server)
+        ;; https://github.com/adlnet/xAPI-Spec/blob/1.0.3/xAPI-Communication.md?plain=1#L1424
+        ;; State resources: xAPI 1.0.3 and 2.0 exempt state from concurrency
+        ;; header requirements, so PUTs without headers should always go through.
+        (testing "xAPI 2.0.0 - state: PUTs without concurrency headers go through"
+          (let [params {"activityId" "http://www.example.com/activity/1"
+                        "agent"      agent-json
+                        "stateId"    "concurrency-test-200-state"}
+                url    "http://localhost:8081/xapi/activities/state"]
+            (is (= 204 (:status (put-document url params "2.0.0" "first"))))
+            (is (= 204 (:status (put-document url params "2.0.0" "second"))))))
+        (testing "xAPI 1.0.3 - state: PUTs without concurrency headers go through"
+          (let [params {"activityId" "http://www.example.com/activity/2"
+                        "agent"      agent-json
+                        "stateId"    "concurrency-test-103-state"}
+                url    "http://localhost:8081/xapi/activities/state"]
+            (is (= 204 (:status (put-document url params "1.0.3" "first"))))
+            (is (= 204 (:status (put-document url params "1.0.3" "second"))))))
+        (finally
+          (http/stop server))))))