fix: require explicit opt-in to republish a published post

A schedule-type save targeting a PUBLISHED post silently requeues it:
state back to QUEUE, releaseURL/releaseId nulled, workflow restarted -
and since the workflow's initial sleep is max(0, publishDate - now), a
save that carries (or leaves) a past date publishes again within
seconds. When editing an existing published post the date field holds
its old (past) date, so confirming a reschedule without touching the
date is an accidental instant republish. The existing protection
(2813ed0) is a frontend-only modal: it doesn't cover the public API or
MCP agents at all, and even in the dashboard it never states that
republishing can mean publishing right now.

- changeDate now defaults action to 'update': clients that don't send an
  action can no longer requeue a post by accident
- schedule/now saves (createPost) and action 'schedule' (changeDate)
  targeting a PUBLISHED post are rejected with a 400 explaining what
  happened and how to proceed, unless the new optional republish flag is
  sent - the error body is the confirmation dialog for automation
- the dashboard modals send republish: true on explicit confirmation and
  now state the consequence (channel, date, recurring note)
- new modal strings added to the locale files via lingo.dev

No behavior change for DRAFT/QUEUE posts.

Testing: 16 service-layer assertions against a stubbed repository + local
Temporal (400 + message for schedule/now saves, rejection before any
write, republish passthrough requeues and restarts the workflow, update
stays date-only, QUEUE posts unaffected), plus a live end-to-end run in
the dashboard: modal confirm -> republish: true -> requeue -> real
publish to an Instagram channel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: giladresisi

apps/backend/src/api/routes/posts.controller.ts

@@ -273,9 +273,12 @@ export class PostsController {
     @GetOrgFromRequest() org: Organization,
     @Param('id') id: string,
     @Body('date') date: string,
-    @Body('action') action: 'schedule' | 'update' = 'schedule'
+    // 'update' is the safe default: clients that don't send an action must
+    // never requeue (and thereby republish) a post by accident
+    @Body('action') action: 'schedule' | 'update' = 'update',
+    @Body('republish') republish = false
   ) {
-    return this._postsService.changeDate(org.id, id, date, action);
+    return this._postsService.changeDate(org.id, id, date, action, republish);
   }
 
   @Post('/separate-posts')

apps/frontend/src/components/launches/calendar.tsx

@@ -679,8 +679,18 @@ export const CalendarColumn: FC<{
                 <div className="flex flex-col">
                   <div className="text-[20px] mb-[20px]">
                     {t(
-                      'post_already_published_drag',
-                      'This post was already published, what do you want to do?'
+                      'post_already_published_republish_warning',
+                      'This post was already published. Republishing will publish it again to'
+                    )}{' '}
+                    {post.integration?.name}{' '}
+                    {t('republish_at', 'at')} {getDate.format('DD/MM/YYYY HH:mm')}.
+                    {(!!item.interval || !!post.intervalInDays) && (
+                      <div className="mt-[10px]">
+                        {t(
+                          'republish_recurring_note',
+                          'This is a recurring post: your changes apply to all future recurrences starting now.'
+                        )}
+                      </div>
                     )}
                   </div>
                   <div className="flex w-full gap-[10px]">
@@ -730,6 +740,9 @@ export const CalendarColumn: FC<{
         body: JSON.stringify({
           date: getDate.utc().format('YYYY-MM-DDTHH:mm:ss'),
           action,
+          // published posts always confirm via the modal before reaching here;
+          // for QUEUE posts the flag is a no-op on the server
+          ...(action === 'schedule' ? { republish: true } : {}),
         }),
       });
       if (status !== 500) {

apps/frontend/src/components/new-launch/manage.modal.tsx

@@ -192,19 +192,39 @@ export const ManageModal: FC<AddEditModalProps> = (props) => {
 
   const schedule = useCallback(
     (type: 'draft' | 'now' | 'schedule' | 'update') => async () => {
+      let republish = false;
       if (
         (type === 'now' || type === 'schedule') &&
         (existingData?.posts?.[0]?.state === 'PUBLISHED' ||
           (existingData?.posts?.[0]?.state === 'QUEUE' &&
             dayjs().isAfter(date.utc())))
       ) {
+        const channels = selectedIntegrations
+          .map((p) => p.integration.name)
+          .join(', ');
+        const isRecurring =
+          !!repeater || !!existingData?.posts?.[0]?.intervalInDays;
+
         const whatToDo = await new Promise((resolve) => {
           modal.openModal({
-            title: 'What do you want to do?',
+            title: t('what_do_you_want_to_do', 'What do you want to do?'),
             children: (
               <div className="flex flex-col">
                 <div className="text-[20px] mb-[20px]">
-                  This post was already published, what do you want to do?
+                  {t(
+                    'post_already_published_republish_warning',
+                    'This post was already published. Republishing will publish it again to'
+                  )}{' '}
+                  {channels} {t('republish_at', 'at')}{' '}
+                  {date.format('DD/MM/YYYY HH:mm')}.
+                  {isRecurring && (
+                    <div className="mt-[10px]">
+                      {t(
+                        'republish_recurring_note',
+                        'This is a recurring post: your changes apply to all future recurrences starting now.'
+                      )}
+                    </div>
+                  )}
                 </div>
                 <div className="flex w-full gap-[10px]">
                   <div className="flex-1 flex">
@@ -213,7 +233,10 @@ export const ManageModal: FC<AddEditModalProps> = (props) => {
                       className="flex-1"
                       onClick={() => resolve('update')}
                     >
-                      Just update the post details
+                      {t(
+                        'just_update_post_details',
+                        'Just update the post details'
+                      )}
                     </Button>
                   </div>
                   <div className="flex-1 flex">
@@ -222,7 +245,7 @@ export const ManageModal: FC<AddEditModalProps> = (props) => {
                       className="flex-1"
                       onClick={() => resolve('republish')}
                     >
-                      Republish the post
+                      {t('republish_the_post', 'Republish the post')}
                     </Button>
                   </div>
                 </div>
@@ -234,6 +257,10 @@ export const ManageModal: FC<AddEditModalProps> = (props) => {
         if (whatToDo === 'update') {
           type = 'update';
         }
+
+        if (whatToDo === 'republish') {
+          republish = true;
+        }
       }
 
       setLoading(true);
@@ -385,6 +412,7 @@ export const ManageModal: FC<AddEditModalProps> = (props) => {
 
       const data = {
         type,
+        ...(republish ? { republish } : {}),
         ...(repeater ? { inter: repeater } : {}),
         tags,
         shortLink,

i18n.lock

@@ -735,3 +735,10 @@ checksums:
     cancel_coupon_title: 6a02a23e494728ddb694f591be65900d
     cancel_coupon_failed: 7bbb5c2646ba919b7df0879225eba918
     cancel_coupon_success: ded654a3b6c5fdfe7bdd23e9b5ad711c
+    what_do_you_want_to_do: c2c352197ed13cee73ed85f9706b35de
+    just_update_post_details: fb0d9cba2fe76d06571fc30dc8db0f13
+    reschedule_post: 103d1943e23d4f71b22439a3b03885dd
+    republish_the_post: 6c16f02f8d70ced4cc6ccc1112968704
+    post_already_published_republish_warning: b552a207c31d6381fb831da005dac9ed
+    republish_at: 282cf74a2c63ff46388104f9853bfaf8
+    republish_recurring_note: e0eafbc730f5e8d5f9f5cb5aab48fe2d

libraries/nestjs-libraries/src/database/prisma/posts/posts.service.ts

@@ -873,13 +873,46 @@ export class PostsService {
     return '';
   }
 
+  // A schedule-type save targeting an already-PUBLISHED post republishes it to
+  // the platform: require the explicit `republish` opt-in instead. The message
+  // doubles as the confirmation dialog for API/MCP automation.
+  private guardAgainstRepublish(
+    post: { state: State; publishDate: Date; integration?: { providerIdentifier: string } } | null,
+    source: 'createPost' | 'changeDate'
+  ) {
+    if (post?.state !== 'PUBLISHED') {
+      return;
+    }
+
+    const howToUpdate =
+      source === 'createPost' ? `use type 'update'` : `use action 'update'`;
+
+    throw new BadRequestException(
+      `This post was already published on ${dayjs
+        .utc(post.publishDate)
+        .format('YYYY-MM-DD HH:mm')} UTC. Saving it this way would publish it again to ${
+        post.integration?.providerIdentifier || 'the channel'
+      }. To edit without republishing, ${howToUpdate}. To intentionally publish again, pass republish: true.`
+    );
+  }
+
   async createPost(
     orgId: string,
     body: CreatePostDto,
     creationMethod: CreationMethod
   ): Promise<any[]> {
     const postList = [];
     for (const post of body.posts) {
+      if (
+        (body.type === 'schedule' || body.type === 'now') &&
+        !body.republish &&
+        post.value?.[0]?.id
+      ) {
+        this.guardAgainstRepublish(
+          await this._postRepository.getPostById(post.value[0].id, orgId),
+          'createPost'
+        );
+      }
       const provider = this._integrationManager.getSocialIntegration(
         (post.settings as any)?.__type
       );
@@ -970,10 +1003,15 @@ export class PostsService {
     orgId: string,
     id: string,
     date: string,
-    action: 'schedule' | 'update' = 'schedule'
+    action: 'schedule' | 'update' = 'schedule',
+    republish = false
   ) {
     const getPostById = await this._postRepository.getPostById(id, orgId);
 
+    if (action === 'schedule' && !republish) {
+      this.guardAgainstRepublish(getPostById, 'changeDate');
+    }
+
     // schedule: Set status to QUEUE and change date (reschedule the post)
     // update: Just change the date without changing the status
     const newDate = await this._postRepository.changeDate(

libraries/nestjs-libraries/src/dtos/posts/create.post.dto.ts

@@ -107,6 +107,12 @@ export class CreatePostDto {
   @IsNumber()
   inter?: number;
 
+  // explicit opt-in to publish an already-PUBLISHED post again; without it a
+  // schedule/now save targeting a published post is rejected
+  @IsOptional()
+  @IsBoolean()
+  republish?: boolean;
+
   @IsDefined()
   @IsDateString()
   date: string;

libraries/react-shared-libraries/src/translation/locales/ar/translation.json

@@ -730,5 +730,12 @@
   "yes_cancel_coupon": "نعم، إلغاء القسيمة",
   "cancel_coupon_title": "إلغاء القسيمة؟",
   "cancel_coupon_failed": "تعذّر إلغاء القسيمة",
-  "cancel_coupon_success": "تم إلغاء القسيمة"
+  "cancel_coupon_success": "تم إلغاء القسيمة",
+  "what_do_you_want_to_do": "ماذا تريد أن تفعل؟",
+  "just_update_post_details": "فقط قم بتحديث تفاصيل المنشور",
+  "reschedule_post": "إعادة جدولة المنشور",
+  "republish_the_post": "إعادة نشر المنشور",
+  "post_already_published_republish_warning": "تم نشر هذا المنشور بالفعل. إعادة النشر ستقوم بنشره مرة أخرى على",
+  "republish_at": "في",
+  "republish_recurring_note": "هذا منشور متكرر: ستنطبق تغييراتك على جميع التكرارات المستقبلية بدءًا من الآن."
 }

libraries/react-shared-libraries/src/translation/locales/bn/translation.json

@@ -730,5 +730,12 @@
   "yes_cancel_coupon": "হ্যাঁ, কুপন বাতিল করুন",
   "cancel_coupon_title": "কুপন বাতিল করবেন?",
   "cancel_coupon_failed": "কুপন বাতিল করা যায়নি",
-  "cancel_coupon_success": "কুপন বাতিল হয়েছে"
+  "cancel_coupon_success": "কুপন বাতিল হয়েছে",
+  "what_do_you_want_to_do": "আপনি কী করতে চান?",
+  "just_update_post_details": "শুধুমাত্র পোস্টের বিবরণ আপডেট করুন",
+  "reschedule_post": "পোস্ট পুনঃনির্ধারণ করুন",
+  "republish_the_post": "পোস্টটি পুনঃপ্রকাশ করুন",
+  "post_already_published_republish_warning": "এই পোস্টটি ইতিমধ্যে প্রকাশিত হয়েছে। পুনঃপ্রকাশ করলে এটি আবার প্রকাশিত হবে",
+  "republish_at": "সময়",
+  "republish_recurring_note": "এটি একটি পুনরাবৃত্তিমূলক পোস্ট: আপনার পরিবর্তনসমূহ এখন থেকে শুরু করে সকল ভবিষ্যৎ পুনরাবৃত্তিতে প্রয়োগ হবে।"
 }

libraries/react-shared-libraries/src/translation/locales/de/translation.json

@@ -730,5 +730,12 @@
   "yes_cancel_coupon": "Ja, Gutschein stornieren",
   "cancel_coupon_title": "Gutschein stornieren?",
   "cancel_coupon_failed": "Der Gutschein konnte nicht storniert werden",
-  "cancel_coupon_success": "Gutschein storniert"
+  "cancel_coupon_success": "Gutschein storniert",
+  "what_do_you_want_to_do": "Was möchten Sie tun?",
+  "just_update_post_details": "Nur die Post-Details aktualisieren",
+  "reschedule_post": "Beitrag neu terminieren",
+  "republish_the_post": "Beitrag erneut veröffentlichen",
+  "post_already_published_republish_warning": "Dieser Beitrag wurde bereits veröffentlicht. Durch erneutes Veröffentlichen wird er erneut veröffentlicht auf",
+  "republish_at": "um",
+  "republish_recurring_note": "Dies ist ein wiederkehrender Beitrag: Ihre Änderungen gelten ab jetzt für alle zukünftigen Wiederholungen."
 }

libraries/react-shared-libraries/src/translation/locales/en/translation.json

@@ -732,5 +732,12 @@
   "yes_cancel_coupon": "Yes, cancel coupon",
   "cancel_coupon_title": "Cancel Coupon?",
   "cancel_coupon_failed": "Could not cancel the coupon",
-  "cancel_coupon_success": "Coupon cancelled"
-}
+  "cancel_coupon_success": "Coupon cancelled",
+  "what_do_you_want_to_do": "What do you want to do?",
+  "just_update_post_details": "Just update the post details",
+  "reschedule_post": "Reschedule the post",
+  "republish_the_post": "Republish the post",
+  "post_already_published_republish_warning": "This post was already published. Republishing will publish it again to",
+  "republish_at": "at",
+  "republish_recurring_note": "This is a recurring post: your changes apply to all future recurrences starting now."
+}