Repository navigation
Concurrent /checkin requests can create duplicate log posts and lose progress #107
Description
Bug
recordCheckin reads the member's KV record, validates the daily limit, posts to Discord, and only then writes the updated record. There is no per-user/roadmap serialization or atomic claim around that sequence.
If two /checkin interactions for the same member and roadmap run concurrently, both can read the same previous record and both pass applyCheckin. Both then post a check-in, while the last KV write wins. On a first check-in, this can create two forum log threads and leave one unreferenced; on an existing log, it can post the same day twice while incrementing checkins only once.
Reproduction
- Start two
/checkininteractions at nearly the same time for the same user and roadmap (for example, withPromise.allagainst an empty test KV state and the samenow). - Both executions can read
nullbefore either writes the record. - Observe that both return success and both post to Discord, although only one record is stored.
Expected behavior
At most one concurrent request should record and post a check-in for a user and roadmap on a given day. The other should report that today's check-in is already recorded, without creating another post or thread.
Activity
piyusshhjangid commentedon Oct 29, 2026
hey @anurag629, could you assign this to me once codercops/ogcops#303 gets merged? Also, could you add the Hacktoberfest label to it?
anurag629 commentedon Oct 29, 2026
Hey @piyusshhjangid, fair catch: two
/checkincalls close together can both read the old record before either one writes. KV has no compare-and-swap, so it can't be fully atomic, but writing the day's record before posting (and putting the old one back if the post fails) shrinks the window from the Discord round trips to a few milliseconds, which is enough here. It's yours once codercops/ogcops#303 is merged, just say so here then.