Discord stream caps are check-then-write: concurrent starts can exceed the per-server and per-node limits #223

New Issue

2026-10-04T21:36:58-04:00

logan commented

2026-10-04 21:36:58 -04:00

Found reviewing PR #220 (server-26#213 item 3). Not fixed there; low severity.

Where:

drb-c2-core/app/internal/discord_streams.py start_stream: the per-server cap (max_streams) counts live discord_streams docs, then leases later, outside any transaction.
drb-c2-core/app/routers/discord_web.py start_node_stream (PR #220): the per-node cap (discord_node_max_streams) counts this node's live streams, then calls start_stream.

Failure: two starts for different channels arriving together (two browser tabs, or the web picker plus /radio play) both read N-1 and both write, so a server or node ends up with cap+1 streams. The lease itself is a Firestore transaction, so no bot token is double-leased; only the cap is soft.

Fix shape: count and place in one transaction (or a per-guild / per-node asyncio lock, given one c2-core process already serialises publishes per node via _publish_locks).

Found reviewing PR #220 (server-26#213 item 3). Not fixed there; low severity. **Where:** - `drb-c2-core/app/internal/discord_streams.py` `start_stream`: the per-server cap (`max_streams`) counts live `discord_streams` docs, then leases later, outside any transaction. - `drb-c2-core/app/routers/discord_web.py` `start_node_stream` (PR #220): the per-node cap (`discord_node_max_streams`) counts this node's live streams, then calls `start_stream`. **Failure:** two starts for different channels arriving together (two browser tabs, or the web picker plus `/radio play`) both read N-1 and both write, so a server or node ends up with cap+1 streams. The lease itself is a Firestore transaction, so no bot token is double-leased; only the cap is soft. **Fix shape:** count and place in one transaction (or a per-guild / per-node asyncio lock, given one c2-core process already serialises publishes per node via `_publish_locks`).

logan referenced this issue

2026-10-04 21:37:04 -04:00

Node page Discord picker: org's servers + voice channels, not raw IDs (#213 item 3) #220

logan referenced this issue

2026-10-05 00:30:06 -04:00

Discord: customers shouldn't need the main DRB bot in their server — radio bots (via C2) should cover linking, channel directory and permission checks #225

logan referenced this issue from a commit

2026-10-05 00:30:57 -04:00

Discord: several radio streams per voice channel; adding never overwrites (#213)

logan referenced this issue

2026-10-05 00:31:33 -04:00

Discord: several radio streams per voice channel; adding never overwrites (#213) #227

logan commented

2026-10-05 00:31:58 -04:00

PR #227 (server-26#213 follow-up) fixes the per-guild half: start_stream now holds a per-guild asyncio lock around the already-on and server-cap checks and the create, with a test that fails if the lock is removed. The per-node cap in discord_web.start_node_stream (discord_node_max_streams) is still check-then-write across guilds, so this stays open for that half.

PR #227 (server-26#213 follow-up) fixes the **per-guild** half: `start_stream` now holds a per-guild asyncio lock around the already-on and server-cap checks and the create, with a test that fails if the lock is removed. The **per-node** cap in `discord_web.start_node_stream` (`discord_node_max_streams`) is still check-then-write across guilds, so this stays open for that half.

logan referenced this issue

2026-10-05 00:40:30 -04:00

Discord multi-stream follow-ups: /leave stream: rough edges; find_channel_stream ignores org_id #229

logan added the area/discord

labels 2026-10-05 02:05:05 -04:00

logan referenced this issue