mirrors/mastodon
mirrors/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2024-05-18 01:52:43 +00:00
Code Issues Projects Releases Wiki Activity

Fix race condition in POST /api/v1/push/subscription

Browse source 
Fixes #30103
This commit is contained in:
Claire 2024-05-03 16:26:24 +02:00
parent 33368e3e79
commit 61b7a04528
1 changed files with 16 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
app/controllers/api/v1/push/subscriptions_controller.rb
View file

@ -1,9 +1,12 @@
# frozen_string_literal: true
class Api::V1::Push::SubscriptionsController < Api::BaseController
include Redisable
include Lockable
before_action -> { doorkeeper_authorize! :push }
before_action :require_user!
before_action :set_push_subscription
before_action :set_push_subscription, only: [:show, :update]
before_action :check_push_subscription, only: [:show, :update]
def show
@ -11,16 +14,18 @@ class Api::V1::Push::SubscriptionsController < Api::BaseController
end
def create
@push_subscription&.destroy!
with_redis_lock("push_subscription:#{current_user.id}") do
Web::PushSubscription.where(access_token_id: doorkeeper_token.id).destroy_all
@push_subscription = Web::PushSubscription.create!(
endpoint: subscription_params[:endpoint],
key_p256dh: subscription_params[:keys][:p256dh],
key_auth: subscription_params[:keys][:auth],
data: data_params,
user_id: current_user.id,
access_token_id: doorkeeper_token.id
)
@push_subscription = Web::PushSubscription.create!(
endpoint: subscription_params[:endpoint],
key_p256dh: subscription_params[:keys][:p256dh],
key_auth: subscription_params[:keys][:auth],
data: data_params,
user_id: current_user.id,
access_token_id: doorkeeper_token.id
)
end
render json: @push_subscription, serializer: REST::WebPushSubscriptionSerializer
end
@ -31,7 +36,7 @@ class Api::V1::Push::SubscriptionsController < Api::BaseController
end
def destroy
@push_subscription&.destroy!
Web::PushSubscription.where(access_token_id: doorkeeper_token.id).destroy_all
render_empty
end