test(database): reject MySQLi lockForUpdate with fromSubquery

Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com>

Author: memleakd

system/Database/MySQLi/Builder.php

@@ -58,6 +58,24 @@ protected function _fromTables(): string
         return implode(', ', $this->QBFrom);
     }
 
+    /**
+     * Compile the SELECT lock clause.
+     */
+    protected function compileLockForUpdate(): string
+    {
+        if (! $this->QBLockForUpdate) {
+            return '';
+        }
+
+        foreach ($this->QBFrom as $value) {
+            if (str_starts_with($value, '(SELECT')) {
+                throw new DatabaseException('MySQLi does not support lockForUpdate() with fromSubquery().');
+            }
+        }
+
+        return parent::compileLockForUpdate();
+    }
+
     /**
      * Generates a platform-specific batch update string from the supplied data
      */

tests/system/Database/Builder/SelectTest.php

@@ -16,6 +16,7 @@
 use CodeIgniter\Database\BaseBuilder;
 use CodeIgniter\Database\Exceptions\DatabaseException;
 use CodeIgniter\Database\Exceptions\DataException;
+use CodeIgniter\Database\MySQLi\Builder as MySQLiBuilder;
 use CodeIgniter\Database\OCI8\Builder as OCI8Builder;
 use CodeIgniter\Database\Postgre\Builder as PostgreBuilder;
 use CodeIgniter\Database\RawSql;
@@ -440,6 +441,21 @@ public function testLockForUpdateThrowsExceptionWithSQLSRVUnion(): void
         $builder->union(new SQLSRVBuilder('jobs', $this->db))->lockForUpdate()->getCompiledSelect();
     }
 
+    public function testLockForUpdateThrowsExceptionOnMySQLiSubquery(): void
+    {
+        $this->db = new MockConnection(['DBDriver' => 'MySQLi']);
+
+        $subquery = new MySQLiBuilder('users', $this->db);
+        $builder  = new MySQLiBuilder('jobs', $this->db);
+
+        $builder->fromSubquery($subquery, 'users_1');
+
+        $this->expectException(DatabaseException::class);
+        $this->expectExceptionMessage('MySQLi does not support lockForUpdate() with fromSubquery().');
+
+        $builder->lockForUpdate()->getCompiledSelect();
+    }
+
     public function testLockForUpdateWithOCI8(): void
     {
         $builder = new OCI8Builder('users', $this->db);

user_guide_src/source/database/query_builder.rst

@@ -783,6 +783,10 @@ Some databases restrict which query shapes can be used with row locking. When
 CodeIgniter can detect an unsupported combination, it throws a
 ``DatabaseException``. See the following warnings for driver-specific behavior.
 
+.. warning:: MySQLi does not support ``lockForUpdate()`` with ``fromSubquery()``
+    because an outer locking read on a derived table does not lock the underlying
+    rows as users may expect.
+
 .. warning:: Postgre does not support ``lockForUpdate()`` with ``distinct()``,
     ``groupBy()``, ``having()``, or aggregate helper selections such as
     ``selectCount()``.