feat(core): block workflow update on interim change (#4397)

* ⚡ Add `updatedAt` to store

* ⚡ Set `updatedAt` in store

* 👕 Update FE types

* 👕 Update BE types

* ⚡ Set `updatedAt` on workflow open

* ⚡ Add endpoint check

* ⚡ Add first update check

* 🔥 Remove log

* ⚡ Simplify check

* ⚡ Make `makeWorkflow` more flexible

* 🗃️ Make `updatedAt` default consistent

* 🧪 Adjust tests checking for `updatedAt`

* 🧪 Add tests for interim changes block

* ✏️ Remove unneeded quotes

* ⏪ Simplify without using `-1`

* 👕 Simplify interfaces

* 🐛 Fix calls to `setWorkflowUpdatedAt` setter

* :track: Move update to API call

* ⚡ Restrict check to multiple users only

* 🧪 Add more tests

* 🐛 Account for activation outside of canvas

* ✏️ Add warning comment

* 🔥 Remove unneeded check

* ⏪ Revert to `new Date()` for `-1`

* 🐛 Fix display for never updated

packages/cli/src/workflows/workflows.controller.ts

@@ -329,6 +329,7 @@ workflowsController.patch(
 	`/:id`,
 	ResponseHelper.send(async (req: WorkflowRequest.Update) => {
 		const { id: workflowId } = req.params;
+		const { forceSave } = req.query;
 
 		const updateData = new WorkflowEntity();
 		const { tags, ...rest } = req.body;
@@ -355,6 +356,22 @@ workflowsController.patch(
 			);
 		}
 
+		const lastKnownDate = new Date(req.body.updatedAt).getTime();
+		const storedDate = new Date(shared.workflow.updatedAt).getTime();
+
+		if (!forceSave && lastKnownDate !== storedDate) {
+			LoggerProxy.info(
+				'User was blocked from updating a workflow that was changed by another user',
+				{ workflowId, userId: req.user.id },
+			);
+
+			throw new ResponseHelper.ResponseError(
+				`Workflow ID ${workflowId} cannot be saved because it was changed by another user.`,
+				undefined,
+				400,
+			);
+		}
+
 		// check credentials for old format
 		await WorkflowHelpers.replaceInvalidCredentials(updateData);