Add per-user request locks to prevent race conditions#54
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Use DashMap<ObjectId, Arc<tokio::sync::Mutex<()>>> to serialize all mutating requests per user. Covers create_user, update_user, add_stored_password, change_stored_password, and delete_user. Read-only handlers are unaffected. Closes #6. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
State provides compile-time guarantees that the state was provided, unlike Extension which panics at runtime if missing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Locking protects DB operations, so it belongs in the db layer. Handlers no longer need to know about locks, and the duplicated user2oid calls are eliminated. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Grab the per-user lock after authenticate_user returns, using the en_user it already computed. Removes the duplicate user2oid calls without needing a separate function. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
xumaple
force-pushed
the
xumaple/copilot/locks
branch
from
7e8fb2e to
3b02a07
Compare
After acquiring the per-user lock in change_master_password and add_stored_password, re-read the user from DB and verify the master key hasn't changed since authentication. Prevents concurrent requests from proceeding with stale credentials after another request changed the master password. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DashMap-based per-user locking for all mutating API handlers (create user, update user, add/change password, delete user)Arc<tokio::sync::Mutex<()>>— concurrent writes to the same user are serialized, different users are unblockedCloses #6
Test plan
test_concurrent_password_adds_are_serialized— fires 10 concurrent password additions, verifies no data loss🤖 Generated with Claude Code