fix(requests): enforce the quota when editing a request

[fallenbagel]

Description

Editing a request never checked the requester's quota at all. A user could add seasons beyond their limit on a request that already existed, which is #633, and an admin could move a request onto a user with no room for it.

An edit is charged for every season getQuota did not already count against the owner. Reassignment pays in full because none of the request's seasons count towards the new owner yet, a declined request pays in full because declined requests are excluded from the count, and a request older than the quota window pays in full because the window filters on when the request was created. An ordinary edit inside the window pays only the difference. Requests created with the quota bypass keep it, and users whose quota is unlimited are unaffected.

The handler serializes on the request id from the url so both parties to a reassignment queue behind each other, then takes the owner lock from the PR below around the quota check and save. The prefix on that first key is load bearing, since a request id and a user id would otherwise stringify to the same key on the same lock instance.

• Fixes series request limit can be bypassed by users #633

How Has This Been Tested?

• Via the attached unit test only

Screenshots / Logs (if applicable)

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

Summary by CodeRabbit

• Bug Fixes
  • Improved request update handling to prevent conflicting simultaneous updates.
  • Enforced movie and TV quotas when requests are reassigned.
  • Correctly recalculated TV season usage when changing requested seasons or ownership.
  • Preserved support for unlimited quotas and intentionally bypassing quota checks.
  • Prevented declined and reassigned requests from incorrectly affecting quota usage.
  • Ensured request details and season selections remain accurate after updates.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 55b61c75-9727-4e51-9934-b6021aa28914

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 57c8499c-630d-477f-9a0b-5a7cbdff9e38

📥 Commits

Reviewing files that changed from the base of the PR and between ff14bb2 and 0624bb8.

📒 Files selected for processing (2)

• server/routes/request.test.ts
• server/routes/request.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• server/routes/request.ts
• server/routes/request.test.ts

---

📝 Walkthrough

Walkthrough

The PUT request handler serializes updates, reloads requests inside the lock, and enforces movie and TV quotas during updates and reassignment. Tests cover quota limits, reassignment, unlimited quotas, declined requests, and ignoreQuota.

Changes

Request quota enforcement

Layer / File(s)	Summary
Locked request updates and quota accounting server/routes/request.ts	The PUT handler locks request and target-user updates, reloads the request, tracks ownership changes, and enforces movie and TV quotas before persistence.
Quota and reassignment test coverage server/routes/request.test.ts	Reusable helpers support request setup. Tests cover season additions, replacement, reassignment limits, unlimited quotas, declined requests, ignoreQuota, and persisted ownership.

Estimated code review effort: 4 (Complex) | ~45 minutes

Mergeability Score: ⚪ Minimal · up to 0624b

The quota enforcement change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant PUTHandler
  participant requestLock
  participant RequestRepository
  Client->>PUTHandler: Submit request update
  PUTHandler->>requestLock: Lock by request and target user
  requestLock->>RequestRepository: Reload current request
  RequestRepository-->>requestLock: Current request
  requestLock->>PUTHandler: Validate quotas and persist update
  PUTHandler-->>Client: Return updated request

Loading

Possibly related PRs

• seerr-team/seerr#2742: Modifies the same request PUT handler and request route tests.
• seerr-team/seerr#3265: Covers related TV request quota enforcement and ignoreQuota behavior.

Poem

A rabbit counts seasons in a row,
Locked request updates safely flow.
Quotas hold ownership clear,
Unlimited requests pass without fear.
“Hop!” says the test as results appear.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes prevent users from bypassing season limits when editing pending requests, satisfying issue #633.
Out of Scope Changes check	✅ Passed	The locking, reassignment, quota, bypass, and test changes directly support the stated request quota objectives.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes enforcing request quotas during request edits, which is the main change.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the /request/:requestId PUT handler to enforce quota constraints correctly (including during reassignment) and to serialize quota-sensitive edits via a per-user lock, with accompanying test coverage for quota edge cases.

Changes:

• Wrap request edits in a user-keyed requestLock.dispatch(...) to prevent concurrent quota/race issues during PUT updates.
• Add quota enforcement for TV season edits (delta vs full charge on reassignment) and for movie reassignment when the target user is at quota.
• Refactor and expand request route tests with seed helpers and new quota-focused test cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
server/routes/request.ts	Adds user-keyed locking and new quota/reassignment checks in the PUT request update flow.
server/routes/request.test.ts	Adds seed helpers and introduces quota-specific PUT tests for TV seasons and reassignment scenarios.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.