🚨 Race condition in game with actual video

[khushal-winner]

• Describe the bug
  A race condition occurs when multiple users (or the same user with rapid clicks) trigger the "Start Game" action at nearly the same time. Because card dealing and the started_at timestamp update are not wrapped in a transaction — and there is no unique constraint on DealtCard — both requests pass the game.started_at == nil check and then both execute the full card-dealing loop. This results in every card from the deck being inserted twice.

  Observed behavior

• Normal (single click): each player receives exactly 26 unique cards (correct for a 3-player game)

• Race condition triggered (two near-simultaneous "Start Game" clicks): each player receives 52 cards (the entire deck is dealt twice)

Before

2026-03-04.05-52-32.mp4

After (triggered the start game same time with mobile and laptop , mobile is not shown in the video because this is a screen recording)

2026-03-04.05-55-47.mp4

Expected behavior
Clicking "Start Game" should deal each card exactly once, mark the game as started (started_at set), and prevent any concurrent dealing process from duplicating cards.

Steps to reproduce
1. Create/join a game with >2 players
2. Ensure game is ready to start (both players present, deck loaded)
3. Have two browser tabs (or two users) click "Start Game" within ~100–300 ms of each other
4. Check the dealt cards — each player will have 52 cards instead of 26

Desktop environment
OS: Windows
Browser: Chrome
Version: 130+ (also reproducible in Edge/Firefox)

Additional context

• Root cause: Repo.insert! calls in show.ex (lines ~77–84) run outside a transaction
• No unique index exists on dealt_cards (card_id) or (card_id, player_id)
• The started_at nil check is not atomic with the inserts
• Fix suggestion: wrap both the card inserts and update_game call in Repo.transaction/1 (as previously shown)

[khushal-winner]

@sydseter , found a very interesting bug, would love to work on this ASAP :))

[sydseter]

@khushal-winner great, I have assigned you.

[khushal-winner]

@sydseter , seperately created tests and fix, to keep the changes islolated and for better maintainability for me as well as the maintainers

[sydseter]

I am leaving the issue open, for now. I am not particularly fond of the locking. It seems like it is creating new issues. This is not really a serious bug so I don't want to trade it for a new issue.

[sydseter]

• copi.owasp.org/lib/copi_web/live/game_live/show.ex:115-149 checks started_at before dealing, but the check, card inserts, and game update are not atomic.

• Concurrent start_game events can both observe started_at == nil and insert duplicate dealt cards.

• copi.owasp.org/priv/repo/migrations/20210522185023_create_dealt_cards.exs:14-15 has only non-unique indexes.

The issue’s suggested transaction/locking fix has not been implemented.