Fix race condition on identity/group membership check

backend/src/services/membership-group/membership-group-service.ts

@@ -93,15 +93,6 @@ export const membershipGroupServiceFactory = ({
     }
 
     const scopeDatabaseFields = factory.getScopeDatabaseFields(dto.scopeData);
-    const existingMembership = await membershipGroupDAL.findOne({
-      scope: scopeData.scope,
-      ...scopeDatabaseFields,
-      actorGroupId: dto.data.groupId
-    });
-    if (existingMembership)
-      throw new BadRequestError({
-        message: "Group is already a member"
-      });
 
     await factory.onCreateMembershipGroupGuard(dto);
 
@@ -122,6 +113,19 @@ export const membershipGroupServiceFactory = ({
     const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
 
     const membership = await membershipGroupDAL.transaction(async (tx) => {
+      const existingMembership = await membershipGroupDAL.findOne(
+        {
+          scope: scopeData.scope,
+          ...scopeDatabaseFields,
+          actorGroupId: dto.data.groupId
+        },
+        tx
+      );
+      if (existingMembership)
+        throw new BadRequestError({
+          message: "Group is already a member"
+        });
+
       const doc = await membershipGroupDAL.create(
         {
           scope: scopeData.scope,

backend/src/services/membership-identity/membership-identity-service.ts

@@ -102,19 +102,22 @@ export const membershipIdentityServiceFactory = ({
       throw new NotFoundError({ message: "One or more custom roles not found" });
     }
 
-    const existingMembership = await membershipIdentityDAL.findOne({
+    const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
+
+    const membership = await membershipIdentityDAL.transaction(async (tx) => {
+      const existingMembership = await membershipIdentityDAL.findOne(
+        {
           scope: scopeData.scope,
           ...scopeDatabaseFields,
           actorIdentityId: dto.data.identityId
-    });
+        },
+        tx
+      );
       if (existingMembership)
         throw new BadRequestError({
           message: "Identity is already a member"
         });
 
-    const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
-
-    const membership = await membershipIdentityDAL.transaction(async (tx) => {
       const doc = await membershipIdentityDAL.create(
         {
           scope: scopeData.scope,