fix(requests): serialize request creation per user

[fallenbagel]

Description

The quota check reads its counts and then saves, with nothing in between stopping another request from the same user passing the same check. Several requests submitted at once could all clear a quota with room for one. That is not theoretical, the collection request modal submits one request per selected part in parallel, so requesting a collection has always been able to go past the limit.

Creating a request now runs under a per-user lock, so the check and the save that follows it cannot interleave with that user's other requests. The lock also closes the same-user duplicate submit and the auto-request duplicate check, which had the same shape. It is taken before any database work, so a request waiting on it holds no pool connection.

How Has This Been Tested?

• Only via the unit test attached to this PR

Screenshots / Logs (if applicable)

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8423d3be-c7a1-452c-8bca-5528d395c2be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

[Copilot]

Pull request overview

This PR addresses a race condition in request creation where multiple concurrent requests from the same user could interleave quota/duplicate checks and exceed limits. It introduces a per-user async lock so quota validation and persistence are serialized for each user within a single running instance.

Changes:

• Added a shared per-user requestLock and wrapped MediaRequest.request() in it.
• Generalized AsyncLock.dispatch() to return the callback result (generic Promise<T>).
• Added a unit test to verify concurrent quota enforcement and duplicate request rejection.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
server/utils/requestLock.ts	Introduces a shared AsyncLock instance intended to serialize request creation per user.
server/utils/asyncLock.ts	Updates dispatch to be generic and return the callback’s result while preserving lock release semantics.
server/entity/MediaRequest.ts	Wraps request creation in the per-user lock and extracts the original logic into a private helper.
server/entity/MediaRequest.test.ts	Adds concurrency-focused tests for quota and duplicate-request behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.