Avoid ID clashes

Currently the the ID for a new paste is randomly generated in the caller
of the database insert() function.  Then the insert() function tries to
insert a new row into the database with that passed ID.  There can
however already exists a paste in the database with the same ID leading
to an insert failure, due to a constraint violation due to the PRIMARY
KEY attribute.  Checking prior the the INSERT via a SELECT query would
open the window for a race condition.

A failure to push a new paste is quite severe, since the user might have
spent some some to format the input.

Generate the ID in a loop inside, until the INSERT succeeds.

Author: cgzones

crates/wastebin_core/src/db.rs

@@ -326,32 +326,51 @@ impl Database {
         Ok(Self { conn })
     }
 
-    /// Insert `entry` under `id` into the database and optionally set owner to `uid`.
-    pub async fn insert(&self, id: Id, entry: write::Entry) -> Result<(), Error> {
+    /// Insert `entry` with a new generated `id` into the database and optionally set owner to `uid`.
+    pub async fn insert(&self, entry: write::Entry) -> Result<(Id, write::Entry), Error> {
         let conn = self.conn.clone();
         let write::DatabaseEntry { entry, data, nonce } = entry.compress().await?.encrypt().await?;
 
-        spawn_blocking(move || match entry.expires {
-            None => conn.lock().execute(
-                "INSERT INTO entries (id, uid, data, burn_after_reading, nonce, title) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-                params![id.to_i64(), entry.uid, data, entry.burn_after_reading, nonce, entry.title],
-            ),
-            Some(expires) => conn.lock().execute(
-                "INSERT INTO entries (id, uid, data, burn_after_reading, nonce, expires, title) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now', ?6), ?7)",
-                params![
-                    id.to_i64(),
-                    entry.uid,
-                    data,
-                    entry.burn_after_reading,
-                    nonce,
-                    format!("{expires} seconds"),
-                    entry.title,
-                ],
-            ),
-        })
-        .await??;
+        let title = entry.title.clone();
+
+        let id = spawn_blocking(move || {
+            let mut counter = 0;
+
+            loop {
+                let id = Id::rand();
+
+                let result = match entry.expires {
+                    None => conn.lock().execute(
+                        "INSERT INTO entries (id, uid, data, burn_after_reading, nonce, title) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                        params![id.to_i64(), entry.uid, data, entry.burn_after_reading, nonce, title],
+                    ),
+                    Some(expires) => conn.lock().execute(
+                        "INSERT INTO entries (id, uid, data, burn_after_reading, nonce, expires, title) VALUES (?1, ?2, ?3, ?4, ?5, datetime('now', ?6), ?7)",
+                        params![
+                            id.to_i64(),
+                            entry.uid,
+                            data,
+                            entry.burn_after_reading,
+                            nonce,
+                            format!("{expires} seconds"),
+                            title,
+                        ],
+                    ),
+                };
+
+                match result {
+                    Err(rusqlite::Error::SqliteFailure(rusqlite::ffi::Error { code, extended_code }, Some(ref _message))) if code == rusqlite::ErrorCode::ConstraintViolation && extended_code == 1555 && counter < 10 => {
+                        /* Retry if ID is already existent */
+                        counter += 1;
+                        continue;
+                    },
+                    Err(err) => break Err(err),
+                    Ok(rows) => { debug_assert!(rows == 1); break Ok(id) },
+                }
+            }
+        }).await??;
 
-        Ok(())
+        Ok((id, entry))
     }
 
     /// Get entire entry for `id`.
@@ -532,8 +551,7 @@ mod tests {
             ..Default::default()
         };
 
-        let id = Id::from(1234u32);
-        db.insert(id, entry).await?;
+        let (id, _entry) = db.insert(entry).await?;
 
         let entry = db.get(id, None).await?.unwrap_inner();
         assert_eq!(entry.text, "hello world");
@@ -555,8 +573,7 @@ mod tests {
             ..Default::default()
         };
 
-        let id = Id::from(1234u32);
-        db.insert(id, entry).await?;
+        let (id, _entry) = db.insert(entry).await?;
 
         tokio::time::sleep(tokio::time::Duration::from_secs(2)).await;
 
@@ -570,8 +587,7 @@ mod tests {
     async fn delete() -> Result<(), Box<dyn std::error::Error>> {
         let db = new_db()?;
 
-        let id = Id::from(1234u32);
-        db.insert(id, write::Entry::default()).await?;
+        let (id, _entry) = db.insert(write::Entry::default()).await?;
 
         assert!(db.get(id, None).await.is_ok());
         assert!(db.delete(id).await.is_ok());
@@ -589,14 +605,13 @@ mod tests {
             ..Default::default()
         };
 
-        let id = Id::from(1234u32);
-        db.insert(id, entry).await?;
+        let (id, _entry) = db.insert(entry).await?;
 
         tokio::time::sleep(tokio::time::Duration::from_secs(2)).await;
 
         let ids = db.purge()?;
         assert_eq!(ids.len(), 1);
-        assert_eq!(ids[0].to_i64(), 1234);
+        assert_eq!(ids[0], id);
 
         Ok(())
     }

crates/wastebin_server/src/handlers/insert/api.rs

@@ -39,10 +39,9 @@ pub async fn post(
     State(db): State<Database>,
     Json(entry): Json<Entry>,
 ) -> Result<Json<RedirectResponse>, JsonErrorResponse> {
-    let id = Id::rand();
     let entry: write::Entry = entry.into();
+    let (id, entry) = db.insert(entry).await.map_err(Error::Database)?;
     let path = format!("/{}", id.to_url_path(&entry));
-    db.insert(id, entry).await.map_err(Error::Database)?;
 
     Ok(Json::from(RedirectResponse { path }))
 }

crates/wastebin_server/src/handlers/insert/form.rs

@@ -79,14 +79,14 @@ pub async fn post<E: std::fmt::Debug>(
         let mut entry: write::Entry = entry.into();
         entry.uid = Some(uid);
 
-        let id = Id::rand();
+        let (id, entry) = db.insert(entry).await?;
+
         let mut url = id.to_url_path(&entry);
 
         if entry.burn_after_reading.unwrap_or(false) {
             url = format!("burn/{url}");
         }
 
-        db.insert(id, entry).await?;
         let url = format!("/{url}");
 
         let cookie = Cookie::build(("uid", uid.to_string()))