mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
6bab2ce774
Concurrent uploads all read the same pre-insert usage SUM, so a burst could overshoot the per-user quota by rate-limit x cap in one window. A transaction-scoped advisory lock keyed on the user id serialises the sum-and-insert; uploads by different users never queue on each other. Integration probes pin both races: four parallel uploads against a two-file quota land exactly two, and two racing identical uploads collapse onto one row via the partial unique index. Also aligns the round-trip integration test with the serve-route CSP posture: the proxy carve-out owns the response CSP, the route sets none.