fix(api): handle MongoDB duplicate key race conditions

Author: KRUSHAL2956

app/api/track-user/route.test.ts

@@ -10,7 +10,7 @@ vi.mock('@/lib/mongodb', () => ({
 
 vi.mock('@/models/User', () => ({
   User: {
-    findOneAndUpdate: vi.fn(),
+    updateOne: vi.fn(),
   },
 }));
 
@@ -98,10 +98,10 @@ describe('POST /api/track-user', () => {
       expect(dbConnect).toHaveBeenCalled();
 
       // Trims and lowercases
-      expect(User.findOneAndUpdate).toHaveBeenCalledWith(
+      expect(User.updateOne).toHaveBeenCalledWith(
         { username: 'octocat' },
         { $setOnInsert: { username: 'octocat' } },
-        { upsert: true, new: true }
+        { upsert: true }
       );
 
       expect(response.status).toBe(200);
@@ -123,5 +123,50 @@ describe('POST /api/track-user', () => {
 
       consoleErrorSpy.mockRestore();
     });
+
+    it('gracefully handles concurrent duplicate key (code 11000) race conditions', async () => {
+      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+      const mongoError = new Error('E11000 duplicate key error collection: username') as Error & {
+        code?: number;
+        keyPattern?: Record<string, number>;
+      };
+      mongoError.code = 11000;
+      mongoError.keyPattern = { username: 1 };
+      vi.mocked(User.updateOne).mockRejectedValueOnce(mongoError);
+
+      const response = await POST(makeRequest({ username: 'octocat' }));
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data.success).toBe(true);
+      expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+      consoleErrorSpy.mockRestore();
+    });
+
+    it('rethrows duplicate key (code 11000) error if it is not related to username', async () => {
+      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+      const mongoError = new Error(
+        'E11000 duplicate key error collection: other_field'
+      ) as Error & {
+        code?: number;
+        keyPattern?: Record<string, number>;
+      };
+      mongoError.code = 11000;
+      mongoError.keyPattern = { other_field: 1 };
+      vi.mocked(User.updateOne).mockRejectedValueOnce(mongoError);
+
+      const response = await POST(makeRequest({ username: 'octocat' }));
+
+      expect(response.status).toBe(500);
+      const data = await response.json();
+      expect(data.success).toBe(false);
+      expect(data.error).toBe('Internal server error');
+      expect(consoleErrorSpy).toHaveBeenCalled();
+
+      consoleErrorSpy.mockRestore();
+    });
   });
 });

app/api/track-user/route.ts

@@ -34,12 +34,36 @@ export async function POST(req: Request) {
     // Connect to database
     await dbConnect();
 
-    // Upsert the user: create if doesn't exist, do nothing if exists
-    await User.findOneAndUpdate(
-      { username: trimmedUsername },
-      { $setOnInsert: { username: trimmedUsername } },
-      { upsert: true, new: true }
-    );
+    try {
+      // Upsert the user: create if doesn't exist, do nothing if exists
+      await User.updateOne(
+        { username: trimmedUsername },
+        { $setOnInsert: { username: trimmedUsername } },
+        { upsert: true }
+      );
+    } catch (upsertError) {
+      // Gracefully handle MongoDB E11000 duplicate key race conditions under high concurrency.
+      // Concurrent upserts for the same username can race on the unique index, causing
+      // MongoDB to throw a duplicate key error (code 11000) for one of the requests.
+      // We can safely treat this as a successful no-op because another request already created it.
+      if (
+        upsertError &&
+        typeof upsertError === 'object' &&
+        'code' in upsertError &&
+        upsertError.code === 11000
+      ) {
+        const err = upsertError as Record<string, unknown>;
+        const isUsernameConflict =
+          (err.keyPattern && typeof err.keyPattern === 'object' && 'username' in err.keyPattern) ||
+          (err.keyValue && typeof err.keyValue === 'object' && 'username' in err.keyValue) ||
+          (typeof err.message === 'string' && err.message.includes('username'));
+
+        if (isUsernameConflict) {
+          return NextResponse.json({ success: true });
+        }
+      }
+      throw upsertError;
+    }
 
     return NextResponse.json({ success: true });
   } catch (error) {