18F / identity-idp

Login.gov Core App: Identity Provider (IdP)
https://secure.login.gov/
Other
524 stars 112 forks source link

Fix account reset cancel race condition #11329

Closed mitchellhenke closed 3 weeks ago

mitchellhenke commented 3 weeks ago

🛠 Summary of changes

Rarely, when a pending account reset cancellation is submitted, a race condition can be triggered that results in an exception. This is due to separate select queries. The first is used for validation, and the latter's to execute the update query to cancel. If another request runs the database update in the time between the first and second select, the result for the second query will be nil, and the #update call will raise an exception. NewRelic Link

This set of changes involves a slight refactor to bring the select and update queries together in the same class. To address the race condition, update_all is used, and the resulting number of updates is used to determine whether a change was applied and if notifications should be sent.