Fix Security Issue: Resolve TOCTOU Race Condition in User Tracking

[tamilr0727-ux]

Description

Fixes a race condition in verifyAndDeduplicate() that allows concurrent /api/track-user requests for the same username to bypass the cooldown and perform duplicate GitHub validations and database writes.

Changes

• Made the cooldown check and reservation operation atomic.
• Updated the protection flow so a request reserves the username before starting asynchronous validation or database operations.
• Prevented concurrent requests from passing the cooldown check simultaneously.
• Aligned the behavior with the atomic acquisition pattern used by tryAcquire() in services/github/refresh-policy.ts.
• Added regression tests covering concurrent requests and cooldown behavior.

Verification

✅ vitest run passes successfully.
✅ Concurrent requests cannot bypass the cooldown.
✅ Only one request can reserve a username within the cooldown window.
✅ GitHub validation and database writes are no longer unnecessarily duplicated.
✅ Existing cooldown behavior remains intact.

Fixes #9035

Pillar

• 🎨 Pillar 1 — New Theme Design
• 📐 Pillar 2 — Geometric SVG Improvement
• 🕐 Pillar 3 — Timezone Logic Optimization
• 🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

Can Check in the Files Changed Section,

Checklist before requesting a review:

• I have read the CONTRIBUTING.md file.
• I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
• I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
• My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
• I have updated README.md if I added a new theme or URL parameter.
• I have started the repo.
• I have made sure that i have only one commit to merge in this PR.
• The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
• (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

[vercel]

@tamilr0727-ux is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[retenta-bot]

This PR effectively resolves a critical race condition that could lead to security vulnerabilities by ensuring that concurrent requests are handled correctly. It aligns with previous decisions made to enhance security in the GitHub API, particularly regarding error handling and enforcing cooldowns. Great job on adding regression tests to cover these scenarios! Looking forward to your contributions. 😊

[github-actions]

🚨 Hey @tamilr0727-ux, the CI Pipeline is failing on this PR and it has been marked as status:blocked.

Please fix the issues before this can be reviewed. Here's how:

1. Run checks locally before pushing:

npm run format:check   # Check Prettier formatting
npm run lint           # Run ESLint
npm run typecheck      # TypeScript type check
npm run test           # Run unit tests (Vitest)
npm run build          # Verify production build passes

2. Auto-fix common issues:

npm run format         # Auto-fix formatting with Prettier
npm run lint -- --fix  # Auto-fix lint errors where possible

3. Check the full failure log here:
👉 View CI Run

Once you push a fix and the CI passes, the status:blocked label will be removed automatically. 💪

[Aamod007]

This is a great security fix for the TOCTOU race condition by atomically reserving the slot before async validation.

However, the PR is currently blocked by failing CI checks. Please resolve the CI issues so we can get this merged! I am requesting changes to withhold approval until the block is resolved.