fix: UpdateItem ignores ConditionExpression on non-existent items

[AnatolyRugalev]

Summary

UpdateItem and TransactWriteItems Update with ConditionExpression: attribute_exists(PK) succeed and create a new item when the key does not exist. DynamoDB (and DynamoDB Local) correctly reject with ConditionalCheckFailed.

Version: dynoxide 0.9.8

Reproduction

dynoxide --port 8000 &

export AWS_ACCESS_KEY_ID=fake AWS_SECRET_ACCESS_KEY=fake \
       AWS_DEFAULT_REGION=us-east-1 EP=http://localhost:8000

# Create table
aws dynamodb create-table --endpoint-url $EP \
  --table-name test-condition --billing-mode PAY_PER_REQUEST \
  --attribute-definitions AttributeName=PK,AttributeType=S AttributeName=SK,AttributeType=S \
  --key-schema AttributeName=PK,KeyType=HASH AttributeName=SK,KeyType=RANGE

# TransactWrite Update with attribute_exists on a key that does NOT exist
aws dynamodb transact-write-items --endpoint-url $EP \
  --transact-items '[{
    "Update": {
      "TableName": "test-condition",
      "Key": {"PK": {"S": "does-not-exist"}, "SK": {"S": "nope"}},
      "UpdateExpression": "ADD TagCount :inc",
      "ExpressionAttributeValues": {":inc": {"N": "1"}},
      "ConditionExpression": "attribute_exists(PK)"
    }
  }]'
# => succeeds (should fail)

# Ghost record was created
aws dynamodb get-item --endpoint-url $EP \
  --table-name test-condition \
  --key '{"PK": {"S": "does-not-exist"}, "SK": {"S": "nope"}}'
# => {PK: "does-not-exist", SK: "nope", TagCount: 1}

Expected

TransactionCanceledException with ConditionalCheckFailed. Same for standalone UpdateItem.

Root cause

Both execute_update in transact_write_items.rs and the UpdateItem handler in update_item.rs populate key attributes on the item for the upsert path before evaluating the ConditionExpression. This makes attribute_exists(PK) always pass because PK was just inserted.

Fix

Evaluate the condition against the original existing item (empty for non-existent keys) before populating key attributes. The PR includes regression tests for both code paths.

[hicksy]

Thanks for this - the root cause writeup makes it easy to review, and good that the tests cover both the UpdateItem and TransactWrite paths. I'll get to it in the next few days.

[hicksy]

Two small edits pushed to your branch:

1. Rebased onto current main as our workflows have been updated there recently.
2. cargo fmt (minor formatting fixes). No logic change.

As you were a first time contributor the CI checks needed approval. CI is approved and running; I'm leaving benchmark-regression unapproved for now (unrelated housekeeping). Will merge once CI is green.