If-Overwritten-Version header not enforced when accessed via TinyNode

[thehabes]

Summary

The If-Overwritten-Version header for optimistic locking is documented in the RERUM API but does not appear to be enforced when /overwrite requests come through TinyNode (tiny.rerum.io).

Background

According to the RERUM API documentation and the server code in controllers/overwrite.js, the If-Overwritten-Version header should be checked against __rerum.isOverwritten to detect concurrent edit conflicts.

The server code shows this logic:

const expectedVersion = req.get('If-Overwritten-Version') ?? req.body.__rerum?.isOverwritten
const currentVersionTS = originalObject.__rerum?.isOverwritten ?? ""
if (expectedVersion !== undefined && expectedVersion !== currentVersionTS) {
    // Should return 409 Conflict
}

The Problem

When accessing RERUM through TinyNode (tiny.rerum.io/overwrite), the If-Overwritten-Version header is sent correctly but the version check is not enforced - requests succeed even with version mismatches.

Steps to Reproduce

1. Load an object via store.rerum.io/v1/id/{id} - note __rerum.isOverwritten (e.g., 2025-11-30T20:31:57.853)
2. Send /overwrite to tiny.rerum.io - this updates isOverwritten to new value
3. Send another /overwrite to tiny.rerum.io with header If-Overwritten-Version: 2025-11-30T20:31:57.853 (old value)
4. Expected: 409 Conflict
5. Actual: 200 OK, silent overwrite

Questions

1. Does TinyNode pass through the If-Overwritten-Version header to RERUM?
2. Is the optimistic locking check implemented in TinyNode or expected to be handled by RERUM?
3. Is there a configuration needed to enable this feature?

Related

• TinyNode issue: If-Overwritten-Version header not enforced on /overwrite endpoint TinyNode#106
• RERUM API docs: https://store.rerum.io/v1/API.html#overwrite