clawbot
763e722607
Add mutex and INSERT ON CONFLICT to CreateUser to prevent TOCTOU race where concurrent requests could create multiple admin users. Changes: - Add sync.Mutex to auth.Service to serialize CreateUser calls - Add models.CreateUserAtomic using INSERT ... ON CONFLICT(username) DO NOTHING - Check RowsAffected to detect conflicts at the DB level (defense-in-depth) - Add concurrent race condition test (10 goroutines, only 1 succeeds) The existing UNIQUE constraint on users.username was already in place. This fix adds the application-level protection (items 1 & 2 from #26). |
||
|---|---|---|
| .. | ||
| app.go | ||
| deployment.go | ||
| env_var.go | ||
| label.go | ||
| models_test.go | ||
| port.go | ||
| user.go | ||
| volume.go | ||
| webhook_event.go | ||