fix(lock): release the Redis lock atomically

[rajanpanth]

The bug

withRedisLock releases with a GET followed by a separate DEL:

const currentToken = await redis.get<string>(key);
if (currentToken === token) {
  await redis.del(key);
}

The token comparison narrows the race but doesn't close it. If the lock's TTL expires between the GET and the DEL, another request can acquire the key in that gap — and this call then deletes a lock it no longer owns.

Why it matters

Not theoretical for the current callers:

• locks:announce-winners:${id} is taken with ttlSeconds: 300 on a route that itself declares export const maxDuration = 300. A slow announcement (winner updates, credit writes, referral bonuses) can run right up to expiry.
• locks:create-tranche:${applicationId} uses the same 300s TTL.

Losing mutual exclusion there means two concurrent winner announcements, or two concurrent tranche creations, for the same id — which is the whole reason these routes are locked.

The fix

Replace GET + DEL with the standard compare-and-delete Lua script, which Redis executes as a single atomic unit. @upstash/redis exposes eval(script, keys, args) for this.

if redis.call("get", KEYS[1]) == ARGV[1] then
  return redis.call("del", KEYS[1])
end
return 0

Error handling around the release is unchanged.

---

🤖 Generated with Claude Code

[vercel]

@rajanpanth is attempting to deploy a commit to the Superteam Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Warning

Review limit reached

@rajanpanth, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e89ae5aa-cd99-468e-a965-813c338595ab

📥 Commits

Reviewing files that changed from the base of the PR and between 145486c and 36eb3a0.

📒 Files selected for processing (1)

• src/lib/with-redis-lock.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}