Hosam Tarade

// two buyers, one unit left, one winner
return this.dataSource.transaction(async (m) => {
  const record = await m.findOne(Inventory, {
    where: { id },
    lock: { mode: 'pessimistic_write' },
  });

  if (record.quantity + change < 0)
    throw new BadRequestException(
      'Insufficient stock in this branch');

  record.quantity += change;
  return m.save(record);
});

// only HR Admin may reshape the org chart
@Post()
@Roles(Role.HR_ADMIN)
@UseGuards(JwtAuthGuard, RolesGuard)
create(@Body() dto: CreateDepartmentDto) {
  return this.departmentsService.create(dto);
}

// login is throttled: 5 attempts per minute
@Post('login')
@Throttle({ default: { limit: 5, ttl: 60000 } })
login(@Body() dto: LoginDto) {
  return this.authService.login(dto);
}

// a refresh token is never stored in the clear
async refresh(userId: string, token: string) {
  const user =
    await this.users.findByIdWithRefreshToken(userId);

  if (!user?.hashedRefreshToken)
    throw new UnauthorizedException('Access denied');

  const matches = await bcrypt.compare(
    token, user.hashedRefreshToken);

  if (!matches)
    throw new UnauthorizedException('Access denied');

  return this.issueTokens(user);
}