fix(facility): patch TOCTOU vulnerability in assignment repository

Author: jobin2005

src/modules/event/facility-assignments/repository.ts

@@ -18,10 +18,30 @@ export const insertFacilityAssignment = dbAction(
 				})
 				.from(schema.facility)
 				.where(and(eq(schema.facility.id, data.facilityId), isNull(schema.facility.deletedAt)))
-				.limit(1);
+				.limit(1)
+				.for("update");
 
 			if (facilityInfo == null) return;
 
+			const [duplicate] = await tx
+				.select({ id: schema.eventFacility.id })
+				.from(schema.eventFacility)
+				.where(
+					and(
+						eq(schema.eventFacility.eventId, eventId),
+						eq(schema.eventFacility.facilityId, data.facilityId),
+						data.venueAllotmentId != null
+							? eq(schema.eventFacility.venueAllotmentId, data.venueAllotmentId)
+							: isNull(schema.eventFacility.venueAllotmentId),
+						isNull(schema.eventFacility.deletedAt),
+					),
+				)
+				.limit(1);
+
+			if (duplicate != null) {
+				return { success: false as const, conflict: { event: { id: eventId } } };
+			}
+
 			if (facilityInfo.overlapPolicy === "exclusive") {
 				const [overlap] = await tx
 					.select({
@@ -45,7 +65,7 @@ export const insertFacilityAssignment = dbAction(
 				if (overlap != null) return { success: false as const, conflict: overlap };
 			}
 
-			const [assignment] = await db
+			const [assignment] = await tx
 				.insert(schema.eventFacility)
 				.values({
 					eventId: eventId,

test/integration/facility.test.ts

@@ -362,7 +362,7 @@ describe("Facility Integration Tests", () => {
 			).rejects.toThrow("The facility is already assigned to the event");
 		});
 
-		test("TOCTOU duplicate checker fails atomically under concurrent assignments", async () => {
+		test("TOCTOU duplicate checker natively blocks duplicates under concurrent assignments", async () => {
 			const { event, admin } = await createOrganizerTestSetup();
 			const facility = await createFacility({
 				name: `RaceAssoc-${nanoid()}`,
@@ -385,7 +385,7 @@ describe("Facility Integration Tests", () => {
 				),
 			});
 
-			expect(allAssignments.length).toBeGreaterThan(1);
+			expect(allAssignments.length).toBe(1);
 		});
 
 		test("rejects assignment if venueAllotmentId exists but belongs to a totally different event", async () => {