Prevent duplicate first-run setup

[stefan-burke]

What changed

First-run setup now claims the setup state inside the same database transaction that creates the owner account and stores the keys. If another setup request finishes first, the later request fails closed and leaves the existing owner and keys in place.

I also added a regression test that submits two setup forms at the same time and checks that only one owner is created.

Why

Two setup requests could both see that setup was not complete before either one wrote the final setup state. Both requests could then create owner and key state, and the later request could replace the keys.

Checks

• nix develop -c deno task test:files test/integration/server/setup-concurrency.test.ts test/integration/server/setup.test.ts test/shared/db/settings.test.ts
• nix develop -c deno task precommit

Summary by CodeRabbit

• Bug Fixes

  • Prevented duplicate setup submissions from creating multiple users or inconsistent settings.
  • Concurrent setup attempts now complete safely, with the successful request continuing and others redirected appropriately.

• Tests

  • Added coverage for simultaneous setup requests, verifying correct redirects and single-user creation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: afc0b230-30dc-42dc-b403-4bb1c5712773

📥 Commits

Reviewing files that changed from the base of the PR and between dcc596e and 1a8f225.

📒 Files selected for processing (4)

• src/features/setup.ts
• src/shared/db/settings.ts
• src/shared/db/settings/setup.ts
• test/integration/server/setup-concurrency.test.ts

---

📝 Walkthrough

Walkthrough

Setup completion now claims setup state in a guarded transaction. Concurrent requests receive a specific error, while the winning request creates the owner and settings atomically.

Changes

Setup concurrency control

Layer / File(s)	Summary
Transactional setup claim src/shared/db/settings/setup.ts	Setup completion uses a conditional settings upsert inside a transaction. It throws SetupAlreadyCompleteError when the claim does not affect exactly one row, then creates the owner and settings atomically.
Setup route handling and validation src/shared/db/settings.ts, src/features/setup.ts, test/integration/server/setup-concurrency.test.ts	The error is re-exported and handled by redirecting to /. Integration coverage verifies concurrent requests, one created user, and completed setup state.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• chobbledotcom/tickets#1988: Both changes address concurrent first-run setup and ensure that only one request creates the initial owner.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preventing duplicate first-run setup during concurrent requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch work/security-finding-2-setup-race

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch work/security-finding-2-setup-race

---

_{Comment @coderabbitai help to get the list of available commands.}

[stefan-burke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[stefan-burke]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.