Do I need validation or can I rely on websocket events?

Question

Node.js

On the site, people go and edit their projects. Sometimes one of the following situations happens:
1. Two people came in to edit the project at the same time.
2. The person opened the edit form, started doing something, and left without closing or saving the changes. Then he came home and did something there. On the next morning returned to work and continued to edit the open form.
In general, problems happen, customers write to us, we figure it out for a long time, etc.
As a result, we decided to do this: as soon as the project is opened for editing, it is blocked for all other people who have access to it and it is reported that the project is currently being edited by someone.
I wrote a small nodejs program for this.

const WebSocket = require('ws');

let locked = [];

WSS.on('connection', ws => {
    ws.on('close', () => {
        delete locked[i];

        broadcastMessage(id, {type: 'updateLocks', data: locked);
    });

    ws.on('message', json => {
        if (message.type === 'lock') {
            locked.push({project_id: message.data.id});
        }

        broadcastMessage(id, {type: 'updateLocks', data: locked);
    });

    broadcastMessage(id, {type: 'updateLocks', data: locked);
});

I simplified the code, but everything is primitive. The person opened the project for editing - on the server, the project id was added to the array. Closed the project or closed the browser - remove the project id from the array.
The service has been working for several months and everything is fine, but from time to time (three times in all the time), people wrote that they closed the project, but it remained blocked.
I carefully analyzed everything several times, I did not find any errors in the code. Unless there is some kind of situation that I did not take into account, when the person left, but for some reason the message did not arrive on the server. I'm thinking of writing a check that will run every 10 seconds and bypass the array of connected people. If one of them fell off, then delete the projects.
Tell me, can there be any bugs? Is it a good idea to write an extra check?

Answer 1

It's a bad idea to check every 10 seconds - you can put the server down.
Is it possible to bypass the array of connected people forcibly by pressing a button from the web interface?
Let's say the user opens the editor, he displays a message about the lock and the "Update information" button, clicked on the button - the server did all the checks, if there is a lock - display information about who is editing the project at the moment, if there are no locks - give access.

Answer 2

Stop torturing people and use https://github.com/Operational-Transformation/ot.js/