Race Conditions

// Node.js/Express + MongoDB - SECURE with atomic operations

app.post('/api/purchase', authenticateToken, async (req, res) => {
  try {
    const userId = req.user.id;
    const itemCost = parseFloat(req.body.cost);
    
    // SECURE: Atomic update with condition
    // MongoDB's findOneAndUpdate with condition ensures atomicity
    const result = await User.findOneAndUpdate(
      {
        _id: userId,
        credits: { $gte: itemCost }  // Condition: only update if enough credits
      },
      {
        $inc: { credits: -itemCost }  // Atomic decrement
      },
      {
        new: true  // Return updated document
      }
    );
    
    // If result is null, condition failed (insufficient credits or race)
    if (!result) {
      return res.status(400).json({ error: 'Insufficient credits' });
    }
    
    // Create purchase record
    await Purchase.create({ userId, cost: itemCost });
    
    res.json({ success: true, newBalance: result.credits });
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

// SECURE: Coupon redemption with atomic check-and-set
app.post('/api/redeem-coupon', authenticateToken, async (req, res) => {
  const code = req.body.code;
  const userId = req.user.id;
  
  // SECURE: Atomic update - only marks as used if currently unused
  const coupon = await Coupon.findOneAndUpdate(
    {
      code: code,
      used: false  // Condition: only update if not already used
    },
    {
      $set: { used: true, usedBy: userId, usedAt: new Date() }
    },
    { new: true }
  );
  
  // If coupon is null, it was already used (race lost) or doesn't exist
  if (!coupon) {
    return res.status(400).json({ error: 'Invalid or already used coupon' });
  }
  
  // Atomic credit addition
  await User.findByIdAndUpdate(userId, { $inc: { credits: coupon.value } });
  
  res.json({ success: true, creditsAdded: coupon.value });
});

// ALTERNATIVE: Using transactions for multiple operations
app.post('/api/transfer-credits', authenticateToken, async (req, res) => {
  const session = await mongoose.startSession();
  session.startTransaction();
  
  try {
    const fromUserId = req.user.id;
    const toUserId = req.body.toUserId;
    const amount = parseFloat(req.body.amount);
    
    // Atomic debit
    const fromUser = await User.findOneAndUpdate(
      { _id: fromUserId, credits: { $gte: amount } },
      { $inc: { credits: -amount } },
      { session, new: true }
    );
    
    if (!fromUser) {
      await session.abortTransaction();
      return res.status(400).json({ error: 'Insufficient credits' });
    }
    
    // Atomic credit
    await User.findByIdAndUpdate(
      toUserId,
      { $inc: { credits: amount } },
      { session }
    );
    
    await session.commitTransaction();
    res.json({ success: true });
  } catch (err) {
    await session.abortTransaction();
    res.status(500).json({ error: 'Transfer failed' });
  } finally {
    session.endSession();
  }
});