DbUpdateConcurrencyException when using AutoSaveChanges

[Ben555555]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I'm using AutoSaveChanges = false on a custom UserStore implementation. Unfortunately, when I call multiple methods of UserManager which internally call "UpdateUserAsync(user)" I get a DbUpdateConcurrencyException. I took me a lot of time to figure out when this happens exactly. Is it possible that the UpdateUserAsync implementation attaches the same UserEntity multiple times? If so, can this be fixed please?

Expected Behavior

No DbUpdateConcurrencyException.

Steps To Reproduce

var userEntity = dbContext.Users.First();

await userManager.UpdateAsync(userEntity);

await userManager.RemoveAuthenticationTokenAsync(user, "provider", "tokenname");

await dbContext.SaveChangesAsync(cancellationToken);

Exceptions (if any)

Microsoft.EntityFrameworkCore.DbUpdateConcurrencyException: The database operation was expected to affect 1 row(s), but actually affected 0 row(s); data may have been modified or deleted since entities were loaded. See https://go.microsoft.com/fwlink/?LinkId=527962 for information on understanding and handling optimistic concurrency exceptions.
at Microsoft.EntityFrameworkCore.Update.AffectedCountModificationCommandBatch.ThrowAggregateUpdateConcurrencyExceptionAsync(RelationalDataReader reader, Int32 commandIndex, Int32 expectedRowsAffected, Int32 rowsAffected, CancellationToken cancellationToken)

.NET Version

8

Anything else?

No response

[marcominerva]

Could it be related to #18407?

[Ben555555]

@marcominerva It might be the same issue yes. I figured out in the meantime that the code of the UserStore is a bit problematic.

https://github.com/aspnet/Identity/blob/8003a5550e7c9b02de035de04b0758f898d8237f/src/EF/UserStore.cs#L185

I had to make a custom implementation like this:

public class CustomUserStore : UserStore<UserEntity, IdentityRole<Guid>, MyDbContext, Guid>
{
    public CustomUserStore(MyDbContext context)
        : base(context)
    {
        // Do not auto save changes (e.g. UserManager.Create), we want to handle this manually
        // to ensure that changes are saved in one transaction
        AutoSaveChanges = false;
    }

    /// <inheritdoc />
    public override async Task<IdentityResult> UpdateAsync(UserEntity user, CancellationToken cancellationToken = default(CancellationToken))
    {
        cancellationToken.ThrowIfCancellationRequested();
        ThrowIfDisposed();
        ArgumentNullException.ThrowIfNull(user);

        // Do not attach multiple times causing DbUpdateConcurrencyException
        var entry = Context.Entry(user);
        if (entry.State == EntityState.Detached)
        {
            Context.Attach(user);
        }
            
        user.ConcurrencyStamp = Guid.NewGuid().ToString();

        // Do not call Update because this can set the state Added to Modified resulting in an error
        // Context.Update(user);

        try
        {
            await SaveChanges(cancellationToken);
        }
        catch (DbUpdateConcurrencyException)
        {
            return IdentityResult.Failed(ErrorDescriber.ConcurrencyFailure());
        }
        return IdentityResult.Success;
    }
}

DbContext.Attach is called every time, which is not necessary when an entity is already tracked. Also an entity can be added in the same unit of work when Update is executed as well. Currently everytime DbContext.Update is executed which sets the entity's state to "Modified", BUT it could still be "Added" when the changes have not been saved yet.