create-dacosta-proj 1.0.25 → 1.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-dacosta-proj",
-  "version": "1.0.25",
+  "version": "1.0.26",
   "bin": {
     "create-dacosta-proj": "./index.js"
   }

package/template/src/helpers/redisLock.js

@@ -1,23 +1,39 @@
 'use strict';
 
-const DEFAULT_TIMEOUT = 5000;
+const crypto = require('crypto');
+
+const DEFAULT_TIMEOUT = 5_000;
 const DEFAULT_RETRY_DELAY = 50;
+const DEFAULT_WAIT_TIMEOUT = 30_000;
+
+// Atomic compare-and-delete so we only release a lock we still hold.
+// Without this, an expired lock that another caller already re-acquired
+// would be deleted by our release(), letting a third caller acquire it
+// while the second is still inside its critical section.
+const RELEASE_SCRIPT = 'if redis.call("GET", KEYS[1]) == ARGV[1] then return redis.call("DEL", KEYS[1]) else return 0 end';
 
 function redisLock(client, retryDelay = DEFAULT_RETRY_DELAY) {
-	async function lock(lockName, timeout = DEFAULT_TIMEOUT) {
+	async function lock(lockName, timeout = DEFAULT_TIMEOUT, waitTimeout = DEFAULT_WAIT_TIMEOUT) {
 		const lockKey = `lock.${lockName}`;
-		const lockExpiry = Date.now() + timeout + 1;
+		const token = crypto.randomBytes(16).toString('hex');
+		const deadline = Date.now() + waitTimeout;
+		let released = false;
+
 		while (true) {
-			const result = await client.set(lockKey, lockExpiry, { PX: timeout, NX: true });
+			const result = await client.set(lockKey, token, { PX: timeout, NX: true });
 			if (result !== null) {
 				return async () => {
-					if (lockExpiry > Date.now()) await client.del(lockKey);
+					if (released) return;
+					released = true;
+					try { await client.sendCommand(['EVAL', RELEASE_SCRIPT, '1', lockKey, token]); }
+					catch {}
 				};
 			}
+			if (Date.now() >= deadline) throw new Error(`redisLock: timed out waiting for "${lockName}" after ${waitTimeout}ms`);
 			await new Promise(r => setTimeout(r, retryDelay));
 		}
 	}
 	return lock;
 }
 
-module.exports = redisLock;
+module.exports = redisLock;