Prevent one user from accessing a particular page when another user is already using it in .net core api and react js front end

Question

We have a requirement to create a kind of user session. Our front end is react and backend is .net core 6 api and db is postgres. When 1 user clicks on a delete button, he should not be allowed to delete that item when another user is already using that item and performing some actions. Can you guys suggest me an approach or any kind of service that is available to achieve this. Please help

Answer 1

I would say dont make it too complicated. A simple approach could be to add the properties 'BeingEditedByUserId' and 'ExclusiveEditLockEnd' (datetime) to the entity and check these when performing any action on this entity. When an action is performed on the entity, the id is assigned and a timeslot (for example 10 minutes) would be assigned for this user. If any other user would try to perform an action, you block them. If the timeslot is expired anyone can edit again.

Answer 2

I have had to do something similar with Java (also backed by a postgres db)

There are some pitfalls to avoid with a custom lock implementation, like forgetting to unlock when finished, given that there is not guarantee that a client makes a 'goodbye, unlock the table' call when they finish editing a page, they could simply close the browser tab, or have a power outage... Here is what i decided to do:

Decide if the lock should be implemented in the API or DB? Is this a distributed/scalable application? Does it run as just a single instance or multiple? If multiple, then you can not (as easily) implement an API lock (you could use something like a shared cache, but that might be more trouble than it is worth)

Is there a record in the DB that could be used as a lock, guaranteed to exist for each editable item in the DB? I would assume so, but if the app is backed by multiple DBs maybe not.

API locking is fairly easy, you just need to handle thread safety as most (if not all) REST/SOAP... implementations are heavily multithreaded.

If you implement at the DB consider looking into a 'Row Level Lock' which allows you to request a lock on a specific row in the DB, which you could use as a write lock.

If you want to implement in the API, consider something like this:

class LockManager
  {
    private static readonly object writeLock = new();
    // the `object` is whatever you want to use as the ID of the resource being locked, probably a UUID/GUID but could be a String too
    // the `holder` is an ID of the person/system that owns the lock
    Dictionary<object, _lock> locks = new Dictionary<object, _lock>();

    _lock acquireLock(object id, String holder)
    {
      _lock lok = new _lock();
      lok.id = id;
      lok.holder = holder;

      lock (writeLock)
      {
        if (locks.ContainsKey(id))
        {
          if (locks[id].release > DateTime.Now)
          {
            locks.Remove(id);
          }
          else
          {
            throw new InvalidOperationException("Resource is already locked, lock held by: " + locks[id].holder);
          }
        }

        lok.allocated = DateTime.Now;
        lok.release = lok.allocated.AddMinutes(5);
      }

      return lok;
    }
    void releaseLock(object id)
    {
      lock (writeLock)
      {
        locks.Remove(id);
      }
    }

    // called by .js code to renew the lock via ajax call if the user is determined to be active
    void extendLock(object id)
    {
      if (locks.ContainsKey(id))
      {
        lock (writeLock)
        {
          locks[id].release = DateTime.Now.AddMinutes(5);
        }
      }
    }
  }

  class _lock
  {
    public object id;
    public String holder;
    public DateTime allocated;
    public DateTime release;
  }
}

This is what i did because it does not depend on the DB or client. And was easy to implement. Also, it does not require configuring any lock timeouts or cleanup tasks to release locked items with expired locks on them, as that is taken care of in the locking step.