apps/kiezradar: fix race condition with kiez creation (#6587)

Author: partizipation

CHANGELOG.md

@@ -29,6 +29,7 @@ This project (not yet) adheres to [Semantic Versioning](https://semver.org/spec/
 
 - Kiezradar filter projects by organisation
 - Kiezradar show projects/plans with the same name in Projects List
+- Kiezradar kiez creation race condition prevented
 - Accessibility improvements regarding alternative texts
 - Accessibility improvements regarding semantic structure and adaptability
 - Accessibility improvements regarding structured navigation and consistent focus indication

meinberlin/apps/kiezradar/api.py

@@ -1,4 +1,8 @@
+from django.db import transaction
+from rest_framework import status
 from rest_framework import viewsets
+from rest_framework.exceptions import ValidationError
+from rest_framework.response import Response
 
 from adhocracy4.api.permissions import ViewSetRulesPermission
 
@@ -17,11 +21,33 @@ class KiezRadarViewSet(viewsets.ModelViewSet):
     serializer_class = KiezRadarSerializer
     permission_classes = [ViewSetRulesPermission]
 
-    def perform_create(self, serializer):
-        """
-        Override to save the user from the request.
-        """
-        serializer.save(creator=self.request.user)
+    def create(self, request, *args, **kwargs):
+        user = request.user
+
+        with transaction.atomic():
+            from django.contrib.auth import get_user_model
+
+            User = get_user_model()
+
+            locked_user = User.objects.select_for_update().get(id=user.id)
+
+            current_count = KiezRadar.objects.filter(creator=locked_user).count()
+
+            if current_count >= KiezRadar.KIEZRADAR_LIMIT:
+                raise ValidationError(
+                    detail={
+                        "error": f"Users can only have up to {KiezRadar.KIEZRADAR_LIMIT} kiezradar filters."
+                    }
+                )
+
+            # Create serializer WITHOUT the validation check (or with safe version)
+            serializer = self.get_serializer(data=request.data)
+            serializer.is_valid(raise_exception=True)
+
+            instance = serializer.save(creator=locked_user)
+
+            response_serializer = self.get_serializer(instance)
+            return Response(response_serializer.data, status=status.HTTP_201_CREATED)
 
     def get_permission_object(self):
         return None