fix: address code review feedback on codeManager

isCodeRedeemedByUser: add qualifying status filter (Success / Already
Redeemed / Code Expired) so transient failures like Invalid Parameters
do not permanently block retries.

addNewPendingCodes: replace pre-read + N+1 loop with a single bulk
INSERT ... ON CONFLICT DO NOTHING RETURNING to avoid concurrency races
and excess round-trips.

getRedeemedCodesByUsers: rebase the codes.length guard on the combined
parameter budget (999 - codes - 3 statuses) and chunk discordIds to
stay within SQLite's 999-variable limit for large fan-outs.

Signed-off-by: Michael Cramer <michael@bigmichi1.de>

Author: BigMichi1

src/bot/database/codeManager.ts

@@ -117,10 +117,17 @@ class CodeManager {
   }
 
   async isCodeRedeemedByUser(code: string, discordId: string): Promise<boolean> {
+    const qualifyingStatuses = ['Success', 'Already Redeemed', 'Code Expired'] as const;
     const result = db
       .select({ code: redeemedCodes.code })
       .from(redeemedCodes)
-      .where(and(eq(redeemedCodes.code, code), eq(redeemedCodes.discordId, discordId)))
+      .where(
+        and(
+          eq(redeemedCodes.code, code),
+          eq(redeemedCodes.discordId, discordId),
+          inArray(redeemedCodes.status, qualifyingStatuses as unknown as string[])
+        )
+      )
       .get();
     return result !== undefined;
   }
@@ -271,20 +278,18 @@ class CodeManager {
   /**
    * Bulk-insert pending codes, skipping any that are already present.
    * Returns only the codes that were newly inserted.
+   * Uses a single INSERT … ON CONFLICT DO NOTHING RETURNING to avoid N+1
+   * queries and race conditions between pre-read and insert.
    */
   async addNewPendingCodes(codes: string[]): Promise<string[]> {
     if (codes.length === 0) return [];
-    const existing = new Set(
-      db.select({ code: pendingCodes.code }).from(pendingCodes)
-        .where(inArray(pendingCodes.code, codes))
-        .all()
-        .map((r) => r.code)
-    );
-    const fresh = codes.filter((c) => !existing.has(c));
-    for (const code of fresh) {
-      db.insert(pendingCodes).values({ code, discordId: null }).onConflictDoNothing().run();
-    }
-    return fresh;
+    const inserted = db
+      .insert(pendingCodes)
+      .values(codes.map((code) => ({ code, discordId: null })))
+      .onConflictDoNothing()
+      .returning({ code: pendingCodes.code })
+      .all();
+    return inserted.map((r) => r.code);
   }
 
   async deleteUserRedeemedCodes(discordId: string): Promise<number> {
@@ -301,34 +306,41 @@ class CodeManager {
    * discordId → Set<code> containing codes that user has any qualifying
    * redemption record for (Success, Already Redeemed, Code Expired).
    *
-   * Throws if codes.length exceeds the safe SQLite parameter limit.
+   * Throws if codes.length would exceed the safe SQLite parameter budget.
+   * Chunks discordIds automatically to stay within the 999-variable limit.
    */
   async getRedeemedCodesByUsers(
     codes: string[],
     discordIds: string[]
   ): Promise<Map<string, Set<string>>> {
-    if (codes.length > 995) {
+    const SQLITE_PARAM_LIMIT = 999;
+    const STATUS_COUNT = 3; // 'Success', 'Already Redeemed', 'Code Expired'
+    // codes + status params are fixed per query; remaining budget is for discordIds
+    const discordIdChunkSize = SQLITE_PARAM_LIMIT - codes.length - STATUS_COUNT;
+    if (discordIdChunkSize <= 0) {
       throw new Error('Too many codes provided to getRedeemedCodesByUsers');
     }
     const result = new Map<string, Set<string>>();
     if (codes.length === 0 || discordIds.length === 0) return result;
 
     const qualifyingStatuses = ['Success', 'Already Redeemed', 'Code Expired'] as const;
-    const rows = db
-      .select({ code: redeemedCodes.code, discordId: redeemedCodes.discordId })
-      .from(redeemedCodes)
-      .where(
-        and(
-          inArray(redeemedCodes.code, codes),
-          inArray(redeemedCodes.discordId, discordIds),
-          inArray(redeemedCodes.status, qualifyingStatuses as unknown as string[])
+    for (let i = 0; i < discordIds.length; i += discordIdChunkSize) {
+      const chunk = discordIds.slice(i, i + discordIdChunkSize);
+      const rows = db
+        .select({ code: redeemedCodes.code, discordId: redeemedCodes.discordId })
+        .from(redeemedCodes)
+        .where(
+          and(
+            inArray(redeemedCodes.code, codes),
+            inArray(redeemedCodes.discordId, chunk),
+            inArray(redeemedCodes.status, qualifyingStatuses as unknown as string[])
+          )
         )
-      )
-      .all();
-
-    for (const row of rows) {
-      if (!result.has(row.discordId)) result.set(row.discordId, new Set());
-      result.get(row.discordId)!.add(row.code);
+        .all();
+      for (const row of rows) {
+        if (!result.has(row.discordId)) result.set(row.discordId, new Set());
+        result.get(row.discordId)!.add(row.code);
+      }
     }
     return result;
   }