Race condition: consent-status derivation reads stale auth-resource state outside transaction in authresource service

[coderabbitai]

Summary

In consent-server/internal/authresource/service.go, both CreateAuthResource and UpdateAuthResource read auth-resource state (via store.GetByConsentID and s.stores.Consent.GetByID) before calling ExecuteTransaction. The derived consent status is then used inside the transaction to conditionally update consent status. Because the read happens outside the transaction boundary, concurrent writes can make the snapshot stale by commit time, potentially leading to incorrect consent status derivation.

Affected methods

• CreateAuthResource — approximately lines 124–147
• UpdateAuthResource — approximately lines 319–344

Expected fix

Move the auth-resource state reads (store.GetByConsentID, s.stores.Consent.GetByID) and the call to validator.EvaluateConsentStatusFromAuthStatuses inside the ExecuteTransaction callback so the snapshot and derived consent status are computed atomically within the transaction boundary.

References

• PR: Implement consent element and purpose versioning and namespace support with Integration tests #41
• Review comment: Implement consent element and purpose versioning and namespace support with Integration tests #41 (comment)

Reported by @hasithakn