implementer dac3679e33 fix: memoize in-flight acquire so concurrent acquire() is re-entrant-safe (E00-S03-T04) ...

Security-review finding F2: two concurrent acquire() calls on the same
MigrationLock instance could each check out a connection; the second
pg_advisory_lock would overwrite this.client, leaking the first locked
connection until session end.

acquire() now memoizes the in-flight acquire in acquireInFlight and
returns it on re-entry, so exactly one connection is checked out and no
locked connection leaks. The memo is cleared once the acquire settles.
tryAcquire()/release() paths unchanged.

Locked in by:
- static criterion test: acquireInFlight field, re-entry guard returns
  the in-flight acquire, memo cleared on settle
- mutation probe: removing the re-entry guard fails the criterion
- real-stack probe: two concurrent acquire() calls on one instance leave
  pool.totalCount at 1 (exactly one connection), the lock granted once,
  nothing left after release; probe fails (hangs) on the pre-fix code
- CI job comment updated to reflect the re-entrancy criterion

2026-08-30 00:29:20 +00:00

..

src

fix: memoize in-flight acquire so concurrent acquire() is re-entrant-safe (E00-S03-T04)

2026-08-30 00:29:20 +00:00

package.json

feat: add migration advisory lock to database-postgres (E00-S03-T04)

2026-08-30 00:08:57 +00:00

tsconfig.json

feat: add database-postgres driver boundary package (E00-S03-T02)

2026-08-29 11:14:14 +00:00