Merge branch 'main' into dev

server/routers/auth/deleteMyAccount.ts

@@ -182,7 +182,14 @@ export async function deleteMyAccount(
         const allDeletedNewtIds: string[] = [];
         const allOlmsToTerminate: string[] = [];
 
-        for (const row of ownedOrgsRows) {
+        // Delete billing orgs last: deleting a child org decrements usage on
+        // its billing org, which fails (and aborts the transaction) if the
+        // billing org is already gone.
+        const orgsInDeleteOrder = [...ownedOrgsRows].sort(
+            (a, b) => Number(!!a.isBillingOrg) - Number(!!b.isBillingOrg)
+        );
+
+        for (const row of orgsInDeleteOrder) {
             try {
                 const result = await deleteOrgById(row.orgId);
                 allDeletedNewtIds.push(...result.deletedNewtIds);

server/routers/newt/handleNewtRegisterMessage.ts

@@ -112,7 +112,8 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
             return;
         }
 
-        const newSubnet = await getUniqueSubnetForExitNode(exitNode);
+        const { value: newSubnet, release: releaseSubnetLock } =
+            await getUniqueSubnetForExitNode(exitNode);
 
         if (!newSubnet) {
             logger.error(
@@ -124,15 +125,20 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
 
         siteSubnet = newSubnet;
 
-        await db
-            .update(sites)
-            .set({
-                pubKey: publicKey,
-                exitNodeId: exitNodeId,
-                exitNodeSubnet: newSubnet
-            })
-            .where(eq(sites.siteId, siteId))
-            .returning();
+        try {
+            await db
+                .update(sites)
+                .set({
+                    pubKey: publicKey,
+                    exitNodeId: exitNodeId,
+                    exitNodeSubnet: newSubnet
+                })
+                .where(eq(sites.siteId, siteId))
+                .returning();
+        } finally {
+            // only release once the subnet is persisted so no other node can pick it
+            await releaseSubnetLock();
+        }
     } else {
         await db
             .update(sites)

server/routers/olm/handleOlmRegisterMessage.ts

@@ -313,6 +313,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
     }
 
     let clientSubnet = client.exitNodeSubnet;
+    let releaseSubnetLock: (() => Promise<void>) | null = null;
     if (
         exitNodeId &&
         (client.exitNodeId !== exitNodeId || !client.exitNodeSubnet)
@@ -340,7 +341,8 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
 
         // TODO: IF WE DO NOT HAVE AN INFERENCE RESOURCE DO WE NEED TO BE HOLDING A SUBNET ON THE CLIENT?
 
-        const newSubnet = await getUniqueSubnetForExitNode(exitNode);
+        const { value: newSubnet, release } =
+            await getUniqueSubnetForExitNode(exitNode);
 
         if (!newSubnet) {
             logger.error(
@@ -352,6 +354,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
         }
 
         clientSubnet = newSubnet;
+        releaseSubnetLock = release;
     }
 
     if (
@@ -364,16 +367,21 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
             "[handleOlmRegisterMessage] Public key mismatch. Updating public key and clearing session info...",
             { orgId: client.orgId, clientId: client.clientId }
         );
-        // Update the client's public key
-        await db
-            .update(clients)
-            .set({
-                pubKey: publicKey,
-                archived: false,
-                exitNodeId: exitNodeId, // this can be undefined if no exit node was selected, which is fine just means we cant talk to the node or connect to it
-                exitNodeSubnet: clientSubnet
-            })
-            .where(eq(clients.clientId, client.clientId));
+        try {
+            // Update the client's public key
+            await db
+                .update(clients)
+                .set({
+                    pubKey: publicKey,
+                    archived: false,
+                    exitNodeId: exitNodeId, // this can be undefined if no exit node was selected, which is fine just means we cant talk to the node or connect to it
+                    exitNodeSubnet: clientSubnet
+                })
+                .where(eq(clients.clientId, client.clientId));
+        } finally {
+            // only release once the subnet is persisted so no other node can pick it
+            await releaseSubnetLock?.();
+        }
 
         // set isRelay to false for all of the client's sites to reset the connection metadata
         await db
@@ -396,6 +404,9 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
             );
     }
 
+    // safety net in case a subnet was locked but the update above was skipped (release is idempotent)
+    await releaseSubnetLock?.();
+
     if (client.pubKey && client.pubKey !== publicKey && client.exitNodeId) {
         // test the old client to see if its different then remove
         logger.info("Public key mismatch. Deleting old peer...");