Lock Pay::Customer while creating a Stripe customer

[mpvosseller]

Pull Request

Summary:

Lock the Pay::Customer while creating its associated Stripe customer. This is to prevent a race condition where more than one Stripe customers can be created for a single Pay::Customer.

Related Issue:

See discussion: #857

Description:

We have twice now encountered a race condition where more than one Stripe customer was created for a single Pay::Customer. This was discovered because of bugs in our React frontend which caused it to accidentally fire multiple API requests to the backend at the same time. Two requests (two threads) would enter the customer method at the same time. Both would see that no Stripe customer yet existed and both would begin creating one. The last one to complete would overwrite the previous one in the database. This was especially bad in our app because we use Stripe checkout. In our case our user ended up checking out with a Stripe customer that was no longer associated with their Pay::Customer. With this change we now lock the Pay::Customer while creating a Stripe customer to prevent more than one from being created.

The change simply updates the customer method by moving the existing code inside a top level with_lock block on the Pay::Customer.

Testing:

I didn't add any new tests as I didn't see an existing pattern for verifying this type of locking code (which is difficult) or an existing tests for similar locking code. I did some manual testing though (using log statements and sleep statements) to verify that only one thread will run the critical section at a time.

Screenshots (if applicable):

Checklist:

• Code follows the project's coding standards
• Tests have been added or updated to cover the changes
• Documentation has been updated (if applicable)
• All existing tests pass
• Conforms to the contributing guidelines

Additional Notes:

[excid3]

This would only protect in the case that you already have a Pay::Customer record in the database, not the situation where it's lazy created, right?

Actually, I think this'll work fine. If you call set_payment_processor :stripe, it'll create the Pay::Customer record so you'll be able to lock it before creating the Stripe customer. Should handle most all cases. 👍