Commit `5e9732fb1d`

5e9732fb1d5142142fdae2985f07125cf852647c

parent: f686b22ad7

Verified · cmc ci/build: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-04 14:55 UTC

store: one admin's settings change no longer overwrites another's

settings_json is one blob, so changing one field means writing all of
them. Every caller read the struct off a Repo it had loaded earlier,
changed a field and wrote the whole blob back. Two admins at once and the
later write puts back what it read for the other's field. A test against
the old path loses an update in 39 of 40 races.

UpdateRepoSettings takes a mutate function and does the read and the
write itself, inside one transaction. BEGIN IMMEDIATE takes the write
lock up front, so a second updater waits at the start rather than
discovering the conflict after reading a stale blob; the whole exchange
runs on one connection so BEGIN brackets it.

json_set in the UPDATE was the other option in the issue. It cannot
express turning a flag off: the JSON tags are omitempty, so false is an
absent key, and a merge patch built from the struct is empty exactly when
the change is "set this to its zero value". Passing paths as strings
instead would put JSON-path knowledge in twelve call sites and make a
typo a silent write nothing reads.

Protected branches read and rewrite the list inside the update, so two
admins protecting different branches both land.

SetForkOf, which the issue names alongside this, has no callers — #108's
CreateFork replaced it. Left in place; it is not a read-modify-write and
deleting it is not this change's business.

Closes #123

Layout: unified · split

internal/control/migrate.go +3 −1

 		if len(cmds) > 0 {
 			deferrals = append(deferrals, deferred{path, cmds})
 		}
+		// An import writes the whole blob: the repository was created a
+		// few lines up and nobody else holds settings on it yet.
 		s.GitDaemon = false // instance-dependent; opt back in explicitly
-		c.Store.SetRepoSettings(repo.ID, s)
+		c.Store.UpdateRepoSettings(repo.ID, func(cur *store.RepoSettings) { *cur = s })
 		for _, bi := range br.Issues {
 			key := fmt.Sprintf("mig-issue:%d", bi.Number)

internal/control/mr.go +10 −15

 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.RequireApprovals = n })
-	s.RequireApprovals = n
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) {
 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.RequireResolved = args[1] == "on" })
-	s.RequireResolved = args[1] == "on"
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) {
 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.RequireCodeowners = args[1] == "on" })
-	s.RequireCodeowners = args[1] == "on"
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) {
 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.RequireChecks = args[1] == "on" })
-	s.RequireChecks = args[1] == "on"
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) {
 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.RequireSignedCommits = args[1] == "on" })
-	s.RequireSignedCommits = args[1] == "on"
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) {

internal/control/repo.go +19 −22

 	if code >= 0 {
 		return code
 	}
-	s := repo.Settings
+	if _, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.Website = site }); err != nil {
-	s.Website = site
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(map[string]string{"website": site}, func(w io.Writer) {
 	// Going private takes the repository off every anonymous surface, so
 	// git:// exposure cannot outlive the change.
 	if visibility == "private" && repo.Settings.GitDaemon {
-		s := repo.Settings
+		c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.GitDaemon = false })
-		s.GitDaemon = false
-		c.Store.SetRepoSettings(repo.ID, s)
 	}
 	c.Store.Audit(c.User.ID, "repo.visibility", map[string]any{"repo": repo.ID, "visibility": visibility})
 	return c.emit(map[string]string{"visibility": visibility}, func(w io.Writer) {
 	if on && !c.Cfg.GitDaemon.Enabled {
 		return c.fail(protocol.ExitUsage, "this instance does not run the git:// daemon ([git_daemon] enabled = false)")
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.GitDaemon = on })
-	s.GitDaemon = on
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	return c.emit(s, func(w io.Writer) { fmt.Fprintf(w, "git-daemon %s on %s\n", args[1], repo.Path()) })
 	if repo.Settings.Archived == archived {
 		return c.fail(protocol.ExitUsage, "%s is already %sd", repo.Path(), verb)
 	}
-	s := repo.Settings
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) { s.Archived = archived })
-	s.Archived = archived
+	if err != nil {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	c.Store.RecordEvent(repo.ID, c.User.ID, "repo."+verb+"d", "{}")
 		return code
 	}
 	branch := args[1]
-	s := repo.Settings
+	// The list is read and rewritten inside the update, so two admins
-	has := slices.Contains(s.ProtectedBranches, branch)
+	// protecting different branches at once both land.
-	if protect && !has {
+	s, err := c.Store.UpdateRepoSettings(repo.ID, func(s *store.RepoSettings) {
-		s.ProtectedBranches = append(s.ProtectedBranches, branch)
+		has := slices.Contains(s.ProtectedBranches, branch)
-		slices.Sort(s.ProtectedBranches)
+		if protect && !has {
-	}
+			s.ProtectedBranches = append(s.ProtectedBranches, branch)
-	if !protect && has {
+			slices.Sort(s.ProtectedBranches)
-		s.ProtectedBranches = slices.DeleteFunc(s.ProtectedBranches, func(b string) bool { return b == branch })
+		}
-	}
+		if !protect && has {
-	if err := c.Store.SetRepoSettings(repo.ID, s); err != nil {
+			s.ProtectedBranches = slices.DeleteFunc(s.ProtectedBranches, func(b string) bool { return b == branch })
+		}
+	})
+	if err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
 	verb := "protected"

internal/store/repos.go +57 −5

	@@ -1,6 +1,7 @@
1	package store	1	package store
2		2
3	import (	3	import (
		4	"context"
4	"database/sql"	5	"database/sql"
5	"encoding/json"	6	"encoding/json"
6	"errors"	7	"errors"
	@@ -92,13 +93,64 @@ func (s *Store) SetRepoVisibility(repoID int64, visibility string) error {
92	return err	93	return err
93	}	94	}
94		95
95	func (s *Store) SetRepoSettings(repoID int64, settings RepoSettings) error {	96	// UpdateRepoSettings applies mutate to the repository's settings and
96	raw, err := json.Marshal(settings)	97	// stores the result, returning what was stored.
		98	//
		99	// settings_json is one blob, so changing one field means writing all of
		100	// them. Callers used to read the struct off a Repo they had loaded
		101	// earlier, change a field and write the whole blob back, which loses the
		102	// other admin's change whenever two ran at once — last write wins over a
		103	// value it never read. The read and the write happen here instead, inside
		104	// one transaction, and BEGIN IMMEDIATE takes the write lock up front: a
		105	// second updater waits at the start rather than discovering the conflict
		106	// after it has already read a stale blob.
		107	func (s Store) UpdateRepoSettings(repoID int64, mutate func(RepoSettings)) (RepoSettings, error) {
		108	ctx := context.Background()
		109	var out RepoSettings
		110	// The whole exchange must run on one connection for BEGIN to bracket
		111	// it; the pool would otherwise be free to hand the statements out
		112	// separately.
		113	conn, err := s.DB.Conn(ctx)
97	if err != nil {	114	if err != nil {
98	return err	115	return out, err
99	}	116	}
100	_, err = s.DB.Exec("UPDATE repos SET settings_json = ? WHERE id = ?", string(raw), repoID)	117	defer conn.Close()
101	return err	118	if _, err := conn.ExecContext(ctx, "BEGIN IMMEDIATE"); err != nil {
		119	return out, err
		120	}
		121	committed := false
		122	defer func() {
		123	if !committed {
		124	conn.ExecContext(ctx, "ROLLBACK")
		125	}
		126	}()
		127	var raw string
		128	if err := conn.QueryRowContext(ctx,
		129	"SELECT settings_json FROM repos WHERE id = ?", repoID).Scan(&raw); err != nil {
		130	if errors.Is(err, sql.ErrNoRows) {
		131	return out, ErrNotFound
		132	}
		133	return out, err
		134	}
		135	if raw != "" {
		136	if err := json.Unmarshal([]byte(raw), &out); err != nil {
		137	return out, err
		138	}
		139	}
		140	mutate(&out)
		141	next, err := json.Marshal(out)
		142	if err != nil {
		143	return out, err
		144	}
		145	if _, err := conn.ExecContext(ctx,
		146	"UPDATE repos SET settings_json = ? WHERE id = ?", string(next), repoID); err != nil {
		147	return out, err
		148	}
		149	if _, err := conn.ExecContext(ctx, "COMMIT"); err != nil {
		150	return out, err
		151	}
		152	committed = true
		153	return out, nil
102	}	154	}
103		155
104	// CreateFork is CreateRepo with fork_of set in the same insert, so a fork	156	// CreateFork is CreateRepo with fork_of set in the same insert, so a fork

internal/store/reposettings_test.go added +120

@@ -0,0 +1,120 @@
	1	package store
	2
	3	import (
	4	"sync"
	5	"testing"
	6	)
	7
	8	func settingsFixture(t testing.T) (Store, int64) {
	9	t.Helper()
	10	s := open(t)
	11	if err := s.MigrateUp(); err != nil {
	12	t.Fatal(err)
	13	}
	14	uid, err := s.CreateUser("cmc", true)
	15	if err != nil {
	16	t.Fatal(err)
	17	}
	18	repoID, err := s.CreateRepo("user", uid, "lib", "public")
	19	if err != nil {
	20	t.Fatal(err)
	21	}
	22	return s, repoID
	23	}
	24
	25	func TestUpdateRepoSettingsRoundTrip(t *testing.T) {
	26	s, repoID := settingsFixture(t)
	27	got, err := s.UpdateRepoSettings(repoID, func(set *RepoSettings) { set.RequireApprovals = 2 })
	28	if err != nil {
	29	t.Fatal(err)
	30	}
	31	if got.RequireApprovals != 2 {
	32	t.Fatalf("returned %+v", got)
	33	}
	34	repo, err := s.RepoByID(repoID)
	35	if err != nil {
	36	t.Fatal(err)
	37	}
	38	if repo.Settings.RequireApprovals != 2 {
	39	t.Fatalf("stored %+v", repo.Settings)
	40	}
	41
	42	// Turning a flag back off must persist: the JSON tags are omitempty,
	43	// so "false" is an absent key, and a patch-style write would drop it.
	44	if _, err := s.UpdateRepoSettings(repoID, func(set *RepoSettings) { set.RequireChecks = true }); err != nil {
	45	t.Fatal(err)
	46	}
	47	got, err = s.UpdateRepoSettings(repoID, func(set *RepoSettings) { set.RequireChecks = false })
	48	if err != nil {
	49	t.Fatal(err)
	50	}
	51	if got.RequireChecks {
	52	t.Fatal("require_checks stayed on")
	53	}
	54	repo, _ = s.RepoByID(repoID)
	55	if repo.Settings.RequireChecks \|\| repo.Settings.RequireApprovals != 2 {
	56	t.Fatalf("stored %+v", repo.Settings)
	57	}
	58	}
	59
	60	func TestUpdateRepoSettingsMissingRepo(t *testing.T) {
	61	s, _ := settingsFixture(t)
	62	if _, err := s.UpdateRepoSettings(9999, func(*RepoSettings) {}); err != ErrNotFound {
	63	t.Fatalf("err = %v, want ErrNotFound", err)
	64	}
	65	}
	66
	67	// Concurrent updates to different fields both survive. Read-modify-write
	68	// through the caller lost one of them: each read the same blob and the
	69	// later write put back what it had read for the other's field.
	70	func TestUpdateRepoSettingsConcurrent(t *testing.T) {
	71	s, repoID := settingsFixture(t)
	72	var wg sync.WaitGroup
	73	errs := make(chan error, 2)
	74	wg.Add(2)
	75	go func() {
	76	defer wg.Done()
	77	_, err := s.UpdateRepoSettings(repoID, func(set *RepoSettings) { set.RequireApprovals = 3 })
	78	errs <- err
	79	}()
	80	go func() {
	81	defer wg.Done()
	82	_, err := s.UpdateRepoSettings(repoID, func(set *RepoSettings) { set.RequireResolved = true })
	83	errs <- err
	84	}()
	85	wg.Wait()
	86	close(errs)
	87	for err := range errs {
	88	if err != nil {
	89	t.Fatal(err)
	90	}
	91	}
	92	repo, err := s.RepoByID(repoID)
	93	if err != nil {
	94	t.Fatal(err)
	95	}
	96	if repo.Settings.RequireApprovals != 3 \|\| !repo.Settings.RequireResolved {
	97	t.Fatalf("one update was lost: %+v", repo.Settings)
	98	}
	99	}
	100
	101	// The protected-branch list is read and rewritten inside the update, so
	102	// two admins protecting different branches at once both land.
	103	func TestProtectedBranchesConcurrent(t *testing.T) {
	104	s, repoID := settingsFixture(t)
	105	var wg sync.WaitGroup
	106	for _, branch := range []string{"main", "release"} {
	107	wg.Add(1)
	108	go func(b string) {
	109	defer wg.Done()
	110	s.UpdateRepoSettings(repoID, func(set *RepoSettings) {
	111	set.ProtectedBranches = append(set.ProtectedBranches, b)
	112	})
	113	}(branch)
	114	}
	115	wg.Wait()
	116	repo, _ := s.RepoByID(repoID)
	117	if len(repo.Settings.ProtectedBranches) != 2 {
	118	t.Fatalf("protected branches = %v, want both", repo.Settings.ProtectedBranches)
	119	}
	120	}

Commit 5e9732fb1d

Commit `5e9732fb1d`