New locking mechanism (#2408)

Co-authored-by: Richard Schreiber <schreiber@rami.io>

src/tests/api/test_idempotency.py

@@ -168,15 +168,14 @@ def order(event):
 def test_allow_retry_409(token_client, organizer, event, order):
     order.status = Order.STATUS_EXPIRED
     order.save()
-    with event.lock():
-        resp = token_client.post(
-            '/api/v1/organizers/{}/events/{}/orders/{}/mark_paid/'.format(
-                organizer.slug, event.slug, order.code
-            ), format='json', HTTP_X_IDEMPOTENCY_KEY='foo'
-        )
-        assert resp.status_code == 409
-        order.refresh_from_db()
-        assert order.status == Order.STATUS_EXPIRED
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/{}/mark_paid/?_debug_flag=fail-locking'.format(
+            organizer.slug, event.slug, order.code
+        ), format='json', HTTP_X_IDEMPOTENCY_KEY='foo'
+    )
+    assert resp.status_code == 409
+    order.refresh_from_db()
+    assert order.status == Order.STATUS_EXPIRED
     resp = token_client.post(
         '/api/v1/organizers/{}/events/{}/orders/{}/mark_paid/'.format(
             organizer.slug, event.slug, order.code

src/tests/api/test_orders.py

@@ -1188,15 +1188,14 @@ def test_order_mark_paid_expired_quota_fill(token_client, organizer, event, orde
 def test_order_mark_paid_locked(token_client, organizer, event, order):
     order.status = Order.STATUS_EXPIRED
     order.save()
-    with event.lock():
-        resp = token_client.post(
-            '/api/v1/organizers/{}/events/{}/orders/{}/mark_paid/'.format(
-                organizer.slug, event.slug, order.code
-            )
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/{}/mark_paid/?_debug_flag=fail-locking'.format(
+            organizer.slug, event.slug, order.code
         )
-        assert resp.status_code == 409
-        order.refresh_from_db()
-        assert order.status == Order.STATUS_EXPIRED
+    )
+    assert resp.status_code == 409
+    order.refresh_from_db()
+    assert order.status == Order.STATUS_EXPIRED
 
 
 @pytest.mark.django_db

src/tests/base/test_locking.py

@@ -1,77 +0,0 @@
-#
-# This file is part of pretix (Community Edition).
-#
-# Copyright (C) 2014-2020 Raphael Michel and contributors
-# Copyright (C) 2020-2021 rami.io GmbH and contributors
-#
-# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
-# Public License as published by the Free Software Foundation in version 3 of the License.
-#
-# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
-# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
-# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
-# this file, see <https://pretix.eu/about/en/license>.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
-# details.
-#
-# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
-# <https://www.gnu.org/licenses/>.
-#
-import time
-
-import pytest
-from django.utils.timezone import now
-from django_scopes import scope, scopes_disabled
-
-from pretix.base.models import Event, Organizer
-from pretix.base.services import locking
-from pretix.base.services.locking import (
-    LockReleaseException, LockTimeoutException,
-)
-
-
-@pytest.fixture
-def event():
-    o = Organizer.objects.create(name='Dummy', slug='dummy')
-    event = Event.objects.create(
-        organizer=o, name='Dummy', slug='dummy',
-        date_from=now()
-    )
-    with scope(organizer=o):
-        yield event
-
-
-@pytest.mark.django_db
-def test_locking_exclusive(event):
-    with event.lock():
-        with pytest.raises(LockTimeoutException):
-            with scopes_disabled():
-                ev = Event.objects.get(id=event.id)
-                with ev.lock():
-                    pass
-
-
-@pytest.mark.django_db
-def test_locking_different_events(event):
-    other = Event.objects.create(
-        organizer=event.organizer, name='Dummy', slug='dummy2',
-        date_from=now()
-    )
-    with event.lock():
-        with other.lock():
-            pass
-
-
-@pytest.mark.django_db
-def test_lock_timeout_steal(event):
-    locking.LOCK_TIMEOUT = 1
-    locking.lock_event(event)
-    with pytest.raises(LockTimeoutException):
-        ev = Event.objects.get(id=event.id)
-        locking.lock_event(ev)
-    time.sleep(1.5)
-    locking.lock_event(ev)
-    with pytest.raises(LockReleaseException):
-        locking.release_event(event)

src/tests/concurrency_tests/__init__.py

@@ -0,0 +1,21 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#

src/tests/concurrency_tests/conftest.py

@@ -0,0 +1,144 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+from datetime import datetime, timedelta
+
+import aiohttp
+import pytest
+import pytest_asyncio
+from django.utils.timezone import now
+from django_scopes import scopes_disabled
+from pytz import UTC
+
+from pretix.base.models import (
+    Device, Event, Item, Organizer, Quota, SeatingPlan,
+)
+from pretix.base.models.devices import generate_api_token
+
+
+@pytest.fixture(autouse=True)
+def autoskip(request, settings):
+    if 'sqlite3' in settings.DATABASES['default']['ENGINE']:
+        pytest.skip("cannot be run on sqlite")
+    if not request.config.getvalue("reuse_db"):
+        pytest.skip("only works with --reuse-db due to some weird connection handling bug")
+
+
+@pytest.fixture
+@scopes_disabled()
+def organizer():
+    return Organizer.objects.create(name='Dummy', slug='dummy')
+
+
+@pytest.fixture
+@scopes_disabled()
+def event(organizer):
+    e = Event.objects.create(
+        organizer=organizer, name='Dummy', slug='dummy',
+        date_from=datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC),
+        presale_end=now() + timedelta(days=300),
+        plugins='pretix.plugins.banktransfer,pretix.plugins.ticketoutputpdf',
+        is_public=True, live=True
+    )
+    e.item_meta_properties.create(name="day", default="Monday")
+    e.settings.timezone = 'Europe/Berlin'
+    e.settings.payment_banktransfer__enabled = True
+    return e
+
+
+@pytest.fixture
+@scopes_disabled()
+def item(event):
+    return Item.objects.create(
+        event=event,
+        name='Regular ticket',
+        default_price=0,
+    )
+
+
+@pytest.fixture
+@scopes_disabled()
+def quota(event, item):
+    q = Quota.objects.create(
+        event=event,
+        size=10,
+        name='Regular tickets'
+    )
+    q.items.add(item)
+    return q
+
+
+@pytest.fixture
+@scopes_disabled()
+def voucher(event, item):
+    return event.vouchers.create(code="Foo", max_usages=1)
+
+
+@pytest.fixture
+@scopes_disabled()
+def membership_type(event):
+    return event.organizer.membership_types.create(name="foo", allow_parallel_usage=False)
+
+
+@pytest.fixture
+@scopes_disabled()
+def customer(event, membership_type):
+    return event.organizer.customers.create(email="admin@localhost", is_active=True, is_verified=True)
+
+
+@pytest.fixture
+@scopes_disabled()
+def membership(event, membership_type, customer):
+    return customer.memberships.create(
+        membership_type=membership_type,
+        date_start=datetime(2017, 1, 1, 0, 0, tzinfo=UTC),
+        date_end=datetime(2099, 1, 1, 0, 0, tzinfo=UTC),
+    )
+
+
+@pytest.fixture
+@scopes_disabled()
+def seat(event, organizer, item):
+    SeatingPlan.objects.create(
+        name="Plan", organizer=organizer, layout="{}"
+    )
+    event.seat_category_mappings.create(
+        layout_category='Stalls', product=item
+    )
+    return event.seats.create(seat_number="A1", product=item, seat_guid="A1")
+
+
+@pytest.fixture
+@scopes_disabled()
+def device(organizer):
+    return Device.objects.create(
+        organizer=organizer,
+        all_events=True,
+        name='Foo',
+        initialized=now(),
+        api_token=generate_api_token()
+    )
+
+
+@pytest_asyncio.fixture
+async def session(live_server, event):
+    async with aiohttp.ClientSession() as session:
+        yield session

src/tests/concurrency_tests/test_cart_creation_locking.py

@@ -0,0 +1,140 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import asyncio
+
+import pytest
+from asgiref.sync import sync_to_async
+from django_scopes import scopes_disabled
+from tests.concurrency_tests.utils import post
+
+from pretix.base.models import CartPosition
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_happens_if_we_disable_locks(live_server, session, event, item, quota):
+    # This test exists to ensure that our test setup makes sense. If it fails, all tests down below
+    # might be useless.
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=skip-locking&_debug_flag=sleep-after-quota-check"
+    payload = {
+        f'item_{item.pk}': '1',
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 2
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 2
+
+
+@pytest.mark.asyncio
+async def test_cart_race_condition_prevented_by_locks(live_server, session, event, item, quota):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {
+        f'item_{item.pk}': '1',
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 1
+
+
+@pytest.mark.asyncio
+async def test_cart_race_condition_possible_in_repeatable_read(live_server, session, event, item, quota):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=repeatable-read&_debug_flag=sleep-before-commit"
+    payload = {
+        f'item_{item.pk}': '1',
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 2
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 2
+
+
+@pytest.mark.asyncio
+async def test_cart_race_condition_prevented_by_read_committed(live_server, session, event, item, quota):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=sleep-before-commit"
+    payload = {
+        f'item_{item.pk}': '1',
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 1
+
+
+@pytest.mark.asyncio
+async def test_cart_voucher_race_condition_prevented_by_locks(live_server, session, event, item, quota, voucher):
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {
+        f'item_{item.pk}': '1',
+        '_voucher_code': voucher.code,
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item, voucher=voucher).count)() == 1
+
+
+@pytest.mark.asyncio
+async def test_cart_seat_race_condition_prevented_by_locks(live_server, session, event, item, quota, seat):
+    url = f"/{event.organizer.slug}/{event.slug}/cart/add?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {
+        f'seat_{item.pk}': seat.seat_guid,
+    }
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload),
+        post(session, f"{live_server}{url}", data=payload)
+    )
+    assert ['alert-success' in r1, 'alert-success' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item, seat=seat).count)() == 1

src/tests/concurrency_tests/test_order_creation_locking.py

@@ -0,0 +1,189 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import asyncio
+from datetime import timedelta
+from importlib import import_module
+
+import pytest
+from asgiref.sync import sync_to_async
+from django.conf import settings
+from django.utils.timezone import now
+from django_scopes import scopes_disabled
+from tests.concurrency_tests.utils import post
+
+from pretix.base.models import CartPosition, OrderPosition
+
+SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
+
+
+@pytest.fixture
+@scopes_disabled()
+def cart1_expired(event, organizer, item, customer):
+    cp = CartPosition.objects.create(
+        event=event,
+        item=item,
+        datetime=now(),
+        expires=now() - timedelta(days=1),
+        price=item.default_price,
+        cart_id="cart1"
+    )
+    session = SessionStore("cart1")
+    session['current_cart_event_{}'.format(event.pk)] = "cart1"
+    session['carts'] = {
+        'cart1': {
+            'payment': 'banktransfer',
+            'email': 'admin@localhost',
+            'customer': customer.pk,
+        }
+    }
+    session[f'customer_auth_id:{event.organizer.pk}'] = customer.pk
+    session[f'customer_auth_hash:{event.organizer.pk}'] = customer.get_session_auth_hash()
+    session.save()
+    return cp, session
+
+
+@pytest.fixture
+@scopes_disabled()
+def cart2_expired(event, organizer, item, customer):
+    cp = CartPosition.objects.create(
+        event=event,
+        item=item,
+        datetime=now(),
+        expires=now() - timedelta(days=1),
+        price=item.default_price,
+        cart_id="cart2"
+    )
+    session = SessionStore("cart2")
+    session['current_cart_event_{}'.format(event.pk)] = "cart2"
+    session['carts'] = {
+        'cart2': {
+            'payment': 'banktransfer',
+            'email': 'admin@localhost',
+            'customer': customer.pk,
+        }
+    }
+    session[f'customer_auth_id:{event.organizer.pk}'] = customer.pk
+    session[f'customer_auth_hash:{event.organizer.pk}'] = customer.get_session_auth_hash()
+    session.save()
+    return cp, session
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_happens_if_we_disable_locks(live_server, session, event, item, quota,
+                                                                cart1_expired, cart2_expired):
+    # This test exists to ensure that our test setup makes sense. If it fails, all tests down below
+    # might be useless.
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=skip-locking&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 2
+    with scopes_disabled():
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 0
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 2
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_voucher_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, voucher):
+    cart1_expired[0].voucher = voucher
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].voucher = voucher
+    await sync_to_async(cart2_expired[0].save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item, voucher=voucher).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item, voucher=voucher).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_seat_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, seat):
+    cart1_expired[0].seat = seat
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].seat = seat
+    await sync_to_async(cart2_expired[0].save)()
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item, seat=seat).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item, seat=seat).count)() == 0
+
+
+@pytest.mark.asyncio
+async def test_membership_race_condition_prevented_by_locks(live_server, session, event, item, quota, cart1_expired, cart2_expired, membership):
+    cart1_expired[0].used_membership = membership
+    await sync_to_async(cart1_expired[0].save)()
+    cart2_expired[0].used_membership = membership
+    await sync_to_async(cart2_expired[0].save)()
+    item.require_membership = True
+    await sync_to_async(item.save)()
+    await sync_to_async(item.require_membership_types.set)([membership.membership_type])
+
+    url = f"/{event.organizer.slug}/{event.slug}/checkout/confirm/?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    payload = {}
+
+    r1, r2 = await asyncio.gather(
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart1_expired[1].session_key}),
+        post(session, f"{live_server}{url}", data=payload, cookies={settings.SESSION_COOKIE_NAME: cart2_expired[1].session_key}),
+    )
+    assert ['thank-you' in r1, 'thank-you' in r2].count(True) == 1
+    with scopes_disabled():
+        assert await sync_to_async(OrderPosition.objects.filter(item=item).count)() == 1
+        assert await sync_to_async(CartPosition.objects.filter(item=item).count)() == 1

src/tests/concurrency_tests/test_order_paid_locking.py

@@ -0,0 +1,113 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import asyncio
+from datetime import timedelta
+from decimal import Decimal
+from importlib import import_module
+
+import pytest
+from asgiref.sync import sync_to_async
+from django.conf import settings
+from django.utils.timezone import now
+from django_scopes import scopes_disabled
+from tests.concurrency_tests.utils import get
+
+from pretix.base.models import Order, OrderPayment, OrderPosition
+
+SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
+
+
+@pytest.fixture
+@scopes_disabled()
+def order1_expired(event, organizer, item):
+    order = Order.objects.create(
+        code='FOO', event=event, email='dummy@dummy.test',
+        status=Order.STATUS_EXPIRED, locale='en',
+        datetime=now(), expires=now() - timedelta(days=10),
+        total=Decimal('0.00'),
+    )
+    OrderPosition.objects.create(
+        order=order, item=item, variation=None,
+        price=Decimal("0.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+    )
+    p = OrderPayment.objects.create(
+        order=order, amount=Decimal("0.00"), provider="free", state=OrderPayment.PAYMENT_STATE_CREATED,
+    )
+    return order, p
+
+
+@pytest.fixture
+@scopes_disabled()
+def order2_expired(event, organizer, item, customer):
+    order = Order.objects.create(
+        code='BAR', event=event, email='dummy@dummy.test',
+        status=Order.STATUS_EXPIRED, locale='en',
+        datetime=now(), expires=now() - timedelta(days=10),
+        total=Decimal('0.00'),
+    )
+    OrderPosition.objects.create(
+        order=order, item=item, variation=None,
+        price=Decimal("0.00"), attendee_name_parts={'full_name': "Peter"}, positionid=1
+    )
+    p = OrderPayment.objects.create(
+        order=order, amount=Decimal("0.00"), provider="free", state=OrderPayment.PAYMENT_STATE_CREATED,
+    )
+    return order, p
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_happens_if_we_disable_locks(live_server, session, event, item, quota,
+                                                                order1_expired, order2_expired):
+    # This test exists to ensure that our test setup makes sense. If it fails, all tests down below
+    # might be useless.
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url1 = f"/{event.organizer.slug}/{event.slug}/order/{order1_expired[0].code}/{order1_expired[0].secret}/" \
+           f"pay/{order1_expired[1].pk}/complete?_debug_flag=skip-csrf&_debug_flag=skip-locking&_debug_flag=sleep-after-quota-check"
+    url2 = f"/{event.organizer.slug}/{event.slug}/order/{order2_expired[0].code}/{order2_expired[0].secret}/" \
+           f"pay/{order2_expired[1].pk}/complete?_debug_flag=skip-csrf&_debug_flag=skip-locking&_debug_flag=sleep-after-quota-check"
+    await asyncio.gather(
+        get(session, f"{live_server}{url1}"),
+        get(session, f"{live_server}{url2}"),
+    )
+    await sync_to_async(order1_expired[0].refresh_from_db)()
+    await sync_to_async(order2_expired[0].refresh_from_db)()
+    assert {order1_expired[0].status, order2_expired[0].status} == {Order.STATUS_PAID}
+
+
+@pytest.mark.asyncio
+async def test_quota_race_condition_happens_prevented_by_lock(live_server, session, event, item, quota, order1_expired, order2_expired):
+    quota.size = 1
+    await sync_to_async(quota.save)()
+
+    url1 = f"/{event.organizer.slug}/{event.slug}/order/{order1_expired[0].code}/{order1_expired[0].secret}/" \
+           f"pay/{order1_expired[1].pk}/complete?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    url2 = f"/{event.organizer.slug}/{event.slug}/order/{order2_expired[0].code}/{order2_expired[0].secret}/" \
+           f"pay/{order2_expired[1].pk}/complete?_debug_flag=skip-csrf&_debug_flag=sleep-after-quota-check"
+    await asyncio.gather(
+        get(session, f"{live_server}{url1}"),
+        get(session, f"{live_server}{url2}"),
+    )
+    await sync_to_async(order1_expired[0].refresh_from_db)()
+    await sync_to_async(order2_expired[0].refresh_from_db)()
+    assert {order1_expired[0].status, order2_expired[0].status} == {Order.STATUS_PAID, Order.STATUS_EXPIRED}

src/tests/concurrency_tests/utils.py

@@ -0,0 +1,29 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+async def post(session, url, data, **kwargs):
+    async with session.post(url, data=data, **kwargs) as response:
+        return await response.text()
+
+
+async def get(session, url, **kwargs):
+    async with session.get(url, **kwargs) as response:
+        return await response.text()