Issue #1028: UI creates attribute+association in one call; add axios timeout

Frontend (mdr-frontend):
- ModelExplorer.handleCreateAttribute now passes EntityId to createAttribute when
  adding under an Entity, and no longer makes the separate createEntityAttributeAssociation
  request — the API creates both atomically (see attribute_service). Removes the two-request
  orphan window. (The separate-association dialog flow for EXISTING attributes is unchanged.)
- api.ts: add a 30s request timeout so a stalled request fails fast/clearly instead of
  hanging into the ambiguous 'Network error' that triggered the orphan bug.
- AttributeParams gains optional EntityId.

Backend:
- create_attribute sets the association's ExtendedByDataModelId for extension models
  (OrgLIF/PartnerLIF), mirroring the frontend template, so the single atomic call is correct
  for extension data models too.

Type-checks clean (tsc). Refs #1028.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bjagg

components/lif/mdr_services/attribute_service.py

@@ -110,12 +110,16 @@ async def create_attribute(session: AsyncSession, data: CreateAttributeDTO):
 
     if data.EntityId is not None:
         await session.flush()  # assign attribute.Id without committing
+        # For an extension model (OrgLIF/PartnerLIF — data.Extension is derived from the model's
+        # BaseDataModelId above), the association is an extension placement onto this model, matching
+        # the frontend's tmplCreateEntityAttributeAssociation (ExtendedByDataModelId = the model id).
         association = EntityAttributeAssociation(
             EntityId=data.EntityId,
             AttributeId=attribute.Id,
             Contributor=data.Contributor,
             ContributorOrganization=data.ContributorOrganization,
             Deleted=False,
+            ExtendedByDataModelId=data.DataModelId if data.Extension else None,
         )
         session.add(association)
 

frontends/mdr-frontend/src/components/ModelExplorer/ModelExplorer.tsx

@@ -407,21 +407,20 @@ const ModelTree: React.FC<ModelTreeProps> = ({
     const useEAA = parentNode?.type === 'entity';
       /** ^ Always want an association, but should also be under an Entity */
     const inclusionParams: any = useInclusion ? tmplCreateInclusion(model.Id, 0, 'Attribute') : {};
-    const eAAParams: any = useEAA ? tmplCreateEntityAttributeAssociation(parentNode.id, model) : {};
 
     const createdIds: any = {};
     try {
-      const newAttribute: any = await createAttribute({ ...params, DataModelId: model.Id });
+      // When adding under an Entity, pass EntityId so the API creates the attribute AND its
+      // entity association in a single transaction (#1028). This replaces the old two-request
+      // flow (create attribute, then create association), which orphaned the attribute if the
+      // first response was lost — persisted-but-unassociated: invisible + blocking re-create.
+      const newAttribute: any = await createAttribute({
+        ...params,
+        DataModelId: model.Id,
+        ...(useEAA ? { EntityId: parentNode.id } : {}),
+      });
       createdIds.Attribute = newAttribute?.Id;
       debugLog(">> Created Attribute:", newAttribute?.Id, newAttribute);
-      if (newAttribute?.Id && useEAA) {
-        eAAParams.AttributeId = newAttribute?.Id;
-        eAAParams.Contributor = params.Contributor;
-        eAAParams.ContributorOrganization = params.ContributorOrganization;
-        const newEAA: any = await createEntityAttributeAssociation(eAAParams);
-        createdIds.EntityAttributeAssociation = newEAA?.Id;
-        debugLog(">> Created Entity Attribute Association:", newEAA?.Id, newEAA);
-      }
       if (newAttribute?.Id && useInclusion) {
         inclusionParams.IncludedElementId = newAttribute?.Id;
         inclusionParams.Contributor = params.Contributor;

frontends/mdr-frontend/src/services/api.ts

@@ -12,6 +12,10 @@ const api = axios.create({
   // config to set Access-Control-Allow-Credentials: true and an explicit
   // origin (not "*"), which the MDR API already does.
   withCredentials: true,
+  // Fail a stalled request instead of hanging indefinitely. Without a timeout, a request
+  // whose response is lost hangs until the browser/OS gives up, surfacing as an ambiguous
+  // "Network error" — the trigger for the orphaned-attribute class of bugs (#1028).
+  timeout: 30000,
 });
 
 // Add a response interceptor to handle token refresh

frontends/mdr-frontend/src/services/attributesService.ts

@@ -25,6 +25,9 @@ export interface AttributeParams {
   ContributorOrganization?: string | null;
   Extension?: boolean;
   ExtensionNotes?: string | null;
+  // When set, the API creates the attribute AND its association to this entity in one
+  // transaction, so a dropped response can't orphan the attribute (#1028).
+  EntityId?: number;
 }
 
 export interface AttributeDTO {