feat: limit concurrent access to some parts of the api resources (#2379)

pkg/debugapi/chequebook.go

@@ -235,6 +235,14 @@ func (s *Service) swapCashoutHandler(w http.ResponseWriter, r *http.Request) {
 		ctx = sctx.SetGasLimit(ctx, l)
 	}
 
+	if !s.cashOutChequeSem.TryAcquire(1) {
+		s.logger.Debug("debug api: simultaneous on-chain operations not supported")
+		s.logger.Error("debug api: simultaneous on-chain operations not supported")
+		jsonhttp.TooManyRequests(w, "simultaneous on-chain operations not supported")
+		return
+	}
+	defer s.cashOutChequeSem.Release(1)
+
 	txHash, err := s.swap.CashCheque(ctx, peer)
 	if err != nil {
 		s.logger.Debugf("debug api: cashout peer: cannot cash %s: %v", addr, err)

pkg/debugapi/debugapi.go

@@ -31,6 +31,7 @@ import (
 	"github.com/ethersphere/bee/pkg/tracing"
 	"github.com/ethersphere/bee/pkg/transaction"
 	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/sync/semaphore"
 )
 
 // Service implements http.Handler interface to be used in HTTP server.
@@ -62,6 +63,11 @@ type Service struct {
 	// handler is changed in the Configure method
 	handler   http.Handler
 	handlerMu sync.RWMutex
+
+	// The following are semaphores which exists to limit concurrent access
+	// to some parts of the resources in order to avoid undefined behaviour.
+	postageCreateSem *semaphore.Weighted
+	cashOutChequeSem *semaphore.Weighted
 }
 
 // New creates a new Debug API Service with only basic routers enabled in order
@@ -79,6 +85,8 @@ func New(publicKey, pssPublicKey ecdsa.PublicKey, ethereumAddress common.Address
 	s.blockTime = blockTime
 	s.metricsRegistry = newMetricsRegistry()
 	s.transaction = transaction
+	s.postageCreateSem = semaphore.NewWeighted(1)
+	s.cashOutChequeSem = semaphore.NewWeighted(1)
 
 	s.setRouter(s.newBasicRouter())
 

pkg/debugapi/postage.go

@@ -68,6 +68,14 @@ func (s *Service) postageCreateHandler(w http.ResponseWriter, r *http.Request) {
 		immutable, _ = strconv.ParseBool(val[0])
 	}
 
+	if !s.postageCreateSem.TryAcquire(1) {
+		s.logger.Debug("create batch: simultaneous on-chain operations not supported")
+		s.logger.Error("create batch: simultaneous on-chain operations not supported")
+		jsonhttp.TooManyRequests(w, "simultaneous on-chain operations not supported")
+		return
+	}
+	defer s.postageCreateSem.Release(1)
+
 	batchID, err := s.postageContract.CreateBatch(ctx, amount, uint8(depth), immutable, label)
 	if err != nil {
 		if errors.Is(err, postagecontract.ErrInsufficientFunds) {