Fix duplicate onboarding client names

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "private": false,
   "description": "Pulse Signage application with MySQL and media uploads",
   "repository": {

src/client-name-check.js

@@ -1,3 +1,5 @@
+const crypto = require('crypto');
+
 function normalizeClientName(value) {
   return String(value || '').trim();
 }
@@ -68,9 +70,49 @@ async function isClientNameAvailable(pool, clientName, excludeDeviceId, liveConn
   }
 }
 
+function buildClientNameLockName(clientName) {
+  return `ps_client_name_${crypto.createHash('sha1').update(String(clientName || '').trim().toLowerCase()).digest('hex')}`;
+}
+
+async function withClientNameReservation(pool, clientName, handler) {
+  if (!pool || typeof pool.getConnection !== 'function') {
+    return handler();
+  }
+
+  const normalizedName = normalizeClientName(clientName);
+  if (!normalizedName) {
+    return handler();
+  }
+
+  const connection = await pool.getConnection();
+  const lockName = buildClientNameLockName(normalizedName);
+  let lockAcquired = false;
+
+  try {
+    const [lockRows] = await connection.query('SELECT GET_LOCK(?, 5) AS lock_result', [lockName]);
+    const lockResult = lockRows && lockRows[0] ? Number(lockRows[0].lock_result) : 0;
+    if (lockResult !== 1) {
+      const error = new Error('Client name is busy. Please try again.');
+      error.statusCode = 409;
+      throw error;
+    }
+
+    lockAcquired = true;
+    return await handler();
+  } finally {
+    if (lockAcquired) {
+      try {
+        await connection.query('SELECT RELEASE_LOCK(?)', [lockName]);
+      } catch (_error) {}
+    }
+    connection.release();
+  }
+}
+
 module.exports = {
   normalizeClientName: normalizeClientName,
   normalizeDeviceId: normalizeDeviceId,
   collectLiveConnections: collectLiveConnections,
-  isClientNameAvailable: isClientNameAvailable
+  isClientNameAvailable: isClientNameAvailable,
+  withClientNameReservation: withClientNameReservation
 };

src/player/onboarding.js

@@ -1,4 +1,4 @@
-const { isClientNameAvailable } = require('../client-name-check');
+const { isClientNameAvailable, withClientNameReservation } = require('../client-name-check');
 const { isTransientDbError } = require('./onboarding-store');
 function normalizeDeviceId(value) {
   return String(value || '').trim().replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 128);
@@ -48,15 +48,14 @@ async function commitDeviceBinding(pool, deviceId, clientName, screenSlug, isNam
     throw new Error('Screen is required.');
   }
 
+  return withClientNameReservation(pool, normalizedClientName, async function () {
     const [screenRows] = await pool.query('SELECT id, name, slug FROM screens WHERE slug = ?', [normalizedScreenSlug]);
     if (!screenRows.length) {
       throw new Error('Screen not found.');
     }
     const screen = screenRows[0];
 
-  const available = typeof isClientNameAvailableOnScreen === 'function'
-    ? await isClientNameAvailable(pool, normalizedClientName, normalizedDeviceId, liveConnections)
-    : true;
+    const available = await isClientNameAvailable(pool, normalizedClientName, normalizedDeviceId, liveConnections);
     if (!available) {
       const error = new Error('Client name already exists.');
       error.statusCode = 400;
@@ -69,6 +68,7 @@ async function commitDeviceBinding(pool, deviceId, clientName, screenSlug, isNam
     );
 
     return getOnboardingStatus(pool, normalizedDeviceId);
+  });
 }
 
 async function bindDeviceToScreen(pool, deviceId, clientName, screenSlug, isNameAvailableOnScreen, playerRuntime, onboardingStore) {

src/web.js

@@ -16,7 +16,7 @@ const registerAdminScreenCommandRoutes = require('./web/routes/admin-screen-comm
 const registerAdminContentRoutes = require('./web/routes/admin-content');
 const { createWebBootstrap } = require('./web/bootstrap');
 const { createPlayerActionService } = require('./web/player-actions');
-const { isClientNameAvailable } = require('./client-name-check');
+const { isClientNameAvailable, withClientNameReservation } = require('./client-name-check');
 const { createSessionService } = require('./web/session');
 const {
   formatDashboardDate,
@@ -179,7 +179,8 @@ async function start() {
     pool: pool,
     forwardPlayerCommand: playerActionService.forwardPlayerCommand,
     getScreenConnections: playerActionService.getScreenConnections,
-    isClientNameAvailable: isClientNameAvailable
+    isClientNameAvailable: isClientNameAvailable,
+    withClientNameReservation: withClientNameReservation
   });
 
   registerAdminContentRoutes(app, {

src/web/routes/admin-screen-commands.js

@@ -3,6 +3,7 @@ module.exports = function registerAdminScreenCommandRoutes(app, deps) {
   const forwardPlayerCommand = deps.forwardPlayerCommand;
   const getScreenConnections = deps.getScreenConnections;
   const isClientNameAvailable = deps.isClientNameAvailable;
+  const withClientNameReservation = deps.withClientNameReservation;
 
   app.post('/admin/screens/:slug/commands', async function (req, res, next) {
     try {
@@ -56,6 +57,11 @@ module.exports = function registerAdminScreenCommandRoutes(app, deps) {
             unchanged: true
           });
         }
+        if (typeof withClientNameReservation !== 'function') {
+          return res.status(500).json({ error: 'Client name reservation is unavailable.' });
+        }
+
+        return withClientNameReservation(pool, clientName, async function () {
           let liveConnections = [];
           try {
             const [screenSlugs] = await pool.query('SELECT slug FROM screens ORDER BY slug ASC');
@@ -76,9 +82,7 @@ module.exports = function registerAdminScreenCommandRoutes(app, deps) {
             liveConnections = [];
           }
 
-        const available = typeof isClientNameAvailable === 'function'
-          ? await isClientNameAvailable(pool, clientName, deviceId, liveConnections)
-          : true;
+          const available = await isClientNameAvailable(pool, clientName, deviceId, liveConnections);
           if (!available) {
             return res.status(409).json({ error: 'Client name already exists.' });
           }
@@ -123,6 +127,7 @@ module.exports = function registerAdminScreenCommandRoutes(app, deps) {
             clientName: clientName,
             ok: true
           });
+        });
       }
 
       const commandPayload = req.body && typeof req.body === 'object' && !Array.isArray(req.body)