Server: stop a team being archived while a vault is created in it

src/DodoSSH.Api/Features/Teams/VaultGrantService.cs

@@ -1,5 +1,6 @@
 using System.Security.Cryptography;
 using DodoSSH.Api.Features.Events;
+using DodoSSH.Api.Setup;
 using DodoSSH.Contracts;
 using DodoSSH.Domain;
 using DodoSSH.Infrastructure;
@@ -76,19 +77,7 @@ internal sealed class VaultGrantService(
                 "That vault id is already in use. Generate a new UUIDv7 and retry.");
         }
 
-        AddVaultWithSelfGrant(user, team, request, name, key, clock.GetUtcNow());
-
-        try
-        {
-            await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
-        }
-        catch (DbUpdateException exception) when (IsUniqueViolation(exception))
-        {
-            // The pre-check covers the ordinary case; this is the race between two creates choosing
-            // the same id, which must not surface as a 500 about a constraint.
-            throw new TeamInvalidException(
-                "That vault id is already in use. Generate a new UUIDv7 and retry.");
-        }
+        await WriteVaultAsync(user, team, request, name, key, cancellationToken).ConfigureAwait(false);
 
         TeamLog.TeamVaultCreated(logger, request.VaultId, team.Id, user.Id);
 
@@ -103,6 +92,55 @@ internal sealed class VaultGrantService(
             RekeyRequired: false);
     }
 
+    /// <summary>Writes the vault and its first grant, under the team's lock, in one transaction.</summary>
+    private Task WriteVaultAsync(
+        UserAccount user,
+        Team team,
+        CreateTeamVaultRequest request,
+        string name,
+        UserKey key,
+        CancellationToken cancellationToken) =>
+        database.ExecuteFreshAsync([team], async () =>
+        {
+            var transaction = await database.Database
+                .BeginTransactionAsync(cancellationToken)
+                .ConfigureAwait(false);
+            await using var _ = transaction.ConfigureAwait(false);
+
+            // Under the lock an archive takes, and the team re-read under it: see TeamLock.
+            await TeamLock.AcquireAsync(database, team.Id, cancellationToken).ConfigureAwait(false);
+            await RequireTeamStillLiveAsync(team.Id, cancellationToken).ConfigureAwait(false);
+
+            AddVaultWithSelfGrant(user, team, request, name, key, clock.GetUtcNow());
+
+            try
+            {
+                await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+            }
+            catch (DbUpdateException exception) when (IsUniqueViolation(exception))
+            {
+                // The pre-check covers the ordinary case; this is the race between two creates choosing
+                // the same id, which must not surface as a 500 about a constraint.
+                throw new TeamInvalidException(
+                    "That vault id is already in use. Generate a new UUIDv7 and retry.");
+            }
+
+            await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+        });
+
+    /// <summary>Refuses a vault for a team archived since the request resolved it.</summary>
+    private async Task RequireTeamStillLiveAsync(Guid teamId, CancellationToken cancellationToken)
+    {
+        var live = await database.Teams
+            .AnyAsync(t => t.Id == teamId && t.DeletedAtUtc == null, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (!live)
+        {
+            throw new TeamInvalidException("This team has been archived, so it can no longer own a new vault.");
+        }
+    }
+
     /// <summary>Adds the vault row and the creator's own grant, in one unit of work.</summary>
     private void AddVaultWithSelfGrant(
         UserAccount user,