fix: add DB constraints and retry-safe payout to prevent double-pay and ghost entries

Author: jackharrhy

luckypot/db.py

@@ -43,10 +43,15 @@ def init_database():
 
         CREATE INDEX IF NOT EXISTS idx_pots_guild_active
             ON pots(guild_id, is_active);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_pots_one_active_per_guild
+            ON pots(guild_id) WHERE is_active = TRUE;
         CREATE INDEX IF NOT EXISTS idx_pot_entries_pot_id
             ON pot_entries(pot_id);
         CREATE INDEX IF NOT EXISTS idx_pot_entries_request_id
             ON pot_entries(stackcoin_request_id);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_pot_entries_active_request_id_unique
+            ON pot_entries(stackcoin_request_id)
+            WHERE stackcoin_request_id IS NOT NULL AND status IN ('pending', 'confirmed');
 
         CREATE TABLE IF NOT EXISTS user_bans (
             ban_id INTEGER PRIMARY KEY AUTOINCREMENT,

luckypot/game.py

@@ -203,7 +203,7 @@ async def send_winnings_to_user(
     if bot_balance is None:
         logger.error("Could not check bot balance")
         return False
-    if bot_balance < amount:
+    if bot_balance < amount and idempotency_key is None:
         logger.error(
             f"Bot balance ({bot_balance}) insufficient to pay {amount} STK to {winner_discord_id}"
         )
@@ -249,7 +249,20 @@ async def process_pot_win(
         winner_id, winning_amount, idempotency_key=idempotency_key
     )
     if sent:
-        db.end_pot(conn, pot["pot_id"], winner_id, winning_amount, win_type)
+        try:
+            db.end_pot(conn, pot["pot_id"], winner_id, winning_amount, win_type)
+        except Exception:
+            # STK send already succeeded (idempotent). Retry the local write once
+            # with a fresh connection so a transient SQLite error doesn't leave
+            # the pot active while money has already been sent.
+            logger.exception(
+                f"end_pot failed after payout for pot #{pot['pot_id']}; retrying once"
+            )
+            retry_conn = db.get_connection()
+            try:
+                db.end_pot(retry_conn, pot["pot_id"], winner_id, winning_amount, win_type)
+            finally:
+                retry_conn.close()
         logger.info(
             f"Pot #{pot['pot_id']} won by {winner_id} for {winning_amount} STK ({win_type})"
         )