Lock resources more explicitly when creating databases or backups (#5613)

Addresses an issue where the concept of a lock was there, but no actual
lock was acquired.

Author: DaneEveritt

app/Http/Controllers/Api/Client/Servers/BackupController.php

@@ -78,7 +78,7 @@ public function store(StoreBackupRequest $request, Server $server): array
         }
 
         $backup = Activity::event('server:backup.start')->transaction(function ($log) use ($action, $server, $request) {
-            $server->backups()->lockForUpdate();
+            $server->backups()->lockForUpdate()->count();
 
             $backup = $action->handle($server, $request->input('name'));
 

app/Http/Controllers/Api/Client/Servers/DatabaseController.php

@@ -6,6 +6,7 @@
 use Pterodactyl\Models\Server;
 use Pterodactyl\Models\Database;
 use Pterodactyl\Facades\Activity;
+use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Services\Databases\DatabasePasswordService;
 use Pterodactyl\Transformers\Api\Client\DatabaseTransformer;
 use Pterodactyl\Services\Databases\DatabaseManagementService;
@@ -49,7 +50,9 @@ public function index(GetDatabasesRequest $request, Server $server): array
     public function store(StoreDatabaseRequest $request, Server $server): array
     {
         $database = Activity::event('server:database.create')->transaction(function ($log) use ($request, $server) {
-            $server->databases()->lockForUpdate();
+            if ($server->databases()->lockForUpdate()->count() >= $server->database_limit) {
+                throw new DisplayException('Cannot create additional databases on this server: limit has been reached.');
+            }
 
             $database = $this->deployDatabaseService->handle($server, $request->validated());
 
@@ -75,11 +78,7 @@ public function rotatePassword(RotatePasswordRequest $request, Server $server, D
         Activity::event('server:database.rotate-password')
             ->subject($database)
             ->property('name', $database->database)
-            ->transaction(function () use ($database) {
-                $database->lockForUpdate();
-
-                $this->passwordService->handle($database);
-            });
+            ->transaction(fn () => $this->passwordService->handle($database));
 
         return $this->fractal->item($database->refresh())
             ->parseIncludes(['password'])

app/Services/Allocations/FindAssignableAllocationService.php

@@ -39,6 +39,7 @@ public function handle(Server $server): Allocation
         // server.
         /** @var Allocation|null $allocation */
         $allocation = $server->node->allocations()
+            ->lockForUpdate()
             ->where('ip', $server->allocation->ip)
             ->whereNull('server_id')
             ->inRandomOrder()
@@ -102,6 +103,7 @@ protected function createNewAllocation(Server $server): Allocation
 
         /** @var Allocation $allocation */
         $allocation = $server->node->allocations()
+            ->lockForUpdate()
             ->where('ip', $server->allocation->ip)
             ->where('port', $port)
             ->firstOrFail();

app/Services/Databases/DatabasePasswordService.php

@@ -32,12 +32,11 @@ public function handle(Database|int $database): string
         $password = Utilities::randomStringWithSpecialCharacters(24);
 
         $this->connection->transaction(function () use ($database, $password) {
-            $this->dynamic->set('dynamic', $database->database_host_id);
-
-            $this->repository->withoutFreshModel()->update($database->id, [
+            $database->sharedLock()->update([
                 'password' => $this->encrypter->encrypt($password),
             ]);
 
+            $this->dynamic->set('dynamic', $database->database_host_id);
             $this->repository->dropUser($database->username, $database->remote);
             $this->repository->createUser($database->username, $database->remote, $password, $database->max_connections);
             $this->repository->assignUserToDatabase($database->database, $database->username, $database->remote);