Prevent race during school creation per creator

[cocomarine]

Status

• Closes https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1612

What's changed?

Race fix during school creation

• Take a Postgres transaction-scoped advisory lock keyed on creator_id before save!.
  • Two concurrent creates by the same creator are now serialised: the loser blocks until the winner commits, so its uniqueness validation sees the winner's school instead of blowing up on the partial unique index on creator_id.
• Rescue ActiveRecord::RecordInvalid separately and only report to Sentry when the failure isn't creator_id: :taken
  • a double submit is expected user behaviour, not an error worth alerting on.
• Made failure/logging null-safe so an error raised before the school is built can't itself raise a NoMethodError.
• Specs cover the lock being acquired, and the "creator already has a school" path: no second school, failed response, validation error (not a DB uniqueness violation), no onboarding call, no Sentry capture.

[github-actions]

Test coverage

93.35% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/32358418419

[cocomarine]

addressed

[Copilot]

Pull request overview

This PR addresses a concurrency race in School::Create where two near-simultaneous school-creation requests from the same creator could bypass the model validation and fail at the database unique index. It introduces a transaction-scoped Postgres advisory lock keyed on creator_id, adjusts error/Sentry handling for expected double-submits, and adds specs to cover the new behavior.

Changes:

• Acquire a transaction-scoped advisory lock (per creator_id) before save! to serialize concurrent creates.
• Refine rescue behavior to avoid Sentry noise for expected creator_id: :taken validation failures and make logging/error construction nil-safe.
• Add specs asserting the advisory lock call and the “creator already has a school” failure path (no second school, no onboarding, no Sentry capture).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/concepts/school/operations/create.rb	Adds advisory-lock serialization and refines error/logging/Sentry handling for expected validation failures.
spec/concepts/school/create_spec.rb	Adds coverage for lock acquisition and the expected “creator already has a school” failure behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zetter-rpf]

Do you know if it's easy it is to double submit this form on the frontend (e.g. by clicking the button twice or hitting return in the form multiple times)? If it is, we might be able to avoid the user seeing an error at all by disabling the form while it's submitting.

This approach is good for stopping the error, but if we can prevent the user getting into this state in the first place it's a better experience for them and might mean this isn't needed.