fix(oidc): make authorization code redemption atomic (BUNYIP-199)

Claude-Run commented

2026-06-26 04:04:06 +02:00

Member

Authorization code redemption loaded the row, verified it, and marked it consumed in three separate round-trips with no locking, so two concurrent /token requests bearing the same code could both pass the consumed_at check and both mint tokens (double-spend / code-replay race).

Wrap load+consume in a SERIALIZABLE transaction with SELECT ... FOR UPDATE, exactly as rotate_refresh_token does. The row-level lock plus SERIALIZABLE isolation serialise concurrent redemptions: the loser blocks on the lock, then sees consumed_at set and loses the race. The final UPDATE is additionally guarded on consumed_at IS NULL with a zero-rows-affected check as defence-in-depth. On the lost race the token family minted from the same op_session is revoked (revoke_reason = 'reuse_detected'), mirroring refresh-token reuse detection, before returning invalid_grant.

#BUNYIP-199

Authorization code redemption loaded the row, verified it, and marked it consumed in three separate round-trips with no locking, so two concurrent /token requests bearing the same code could both pass the consumed_at check and both mint tokens (double-spend / code-replay race). Wrap load+consume in a SERIALIZABLE transaction with SELECT ... FOR UPDATE, exactly as rotate_refresh_token does. The row-level lock plus SERIALIZABLE isolation serialise concurrent redemptions: the loser blocks on the lock, then sees consumed_at set and loses the race. The final UPDATE is additionally guarded on consumed_at IS NULL with a zero-rows-affected check as defence-in-depth. On the lost race the token family minted from the same op_session is revoked (revoke_reason = 'reuse_detected'), mirroring refresh-token reuse detection, before returning invalid_grant. #BUNYIP-199

Claude-Run added 1 commit

2026-06-26 04:04:06 +02:00

fix(oidc): make authorization code redemption atomic (BUNYIP-199)

E2E / Playwright against deployment (pull_request) Successful in 1m8s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 32m31s

Details

e4a9e3ec76

Authorization code redemption loaded the row, verified it, and marked it consumed in three separate round-trips with no locking, so two concurrent /token requests bearing the same code could both pass the consumed_at check and both mint tokens (double-spend / code-replay race).

Wrap load+consume in a SERIALIZABLE transaction with SELECT ... FOR UPDATE, exactly as rotate_refresh_token does. The row-level lock plus SERIALIZABLE isolation serialise concurrent redemptions: the loser blocks on the lock, then sees consumed_at set and loses the race. The final UPDATE is additionally guarded on consumed_at IS NULL with a zero-rows-affected check as defence-in-depth. On the lost race the token family minted from the same op_session is revoked (revoke_reason = 'reuse_detected'), mirroring refresh-token reuse detection, before returning invalid_grant.

#BUNYIP-199

David added 1 commit

2026-06-26 11:25:03 +02:00

Merge branch 'main' into fix/bunyip-199-atomic-code-redemption

E2E / Playwright against deployment (pull_request) Failing after 57s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 10m45s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

bb01200d4c