From 5d88f9beb3b120bbf48b6abcfadd84154e2c7926 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 4 Mar 2026 18:55:41 +0000
Subject: [PATCH] Wrap first-user admin check in transaction to prevent race
 condition

Co-authored-by: xCyanGrizzly <53275238+xCyanGrizzly@users.noreply.github.com>
---
 src/app/(auth)/register/actions.ts | 32 ++++++++++++++++--------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/src/app/(auth)/register/actions.ts b/src/app/(auth)/register/actions.ts
index 9b493c8..68463eb 100644
--- a/src/app/(auth)/register/actions.ts
+++ b/src/app/(auth)/register/actions.ts
@@ -22,24 +22,26 @@ export async function registerUser(input: unknown): Promise<ActionResult<{ id: s
   const hashedPassword = await bcrypt.hash(parsed.data.password, 10);
 
   // First user to register becomes ADMIN (self-hosted owner)
-  const userCount = await prisma.user.count();
-  const role = userCount === 0 ? "ADMIN" : "USER";
+  const user = await prisma.$transaction(async (tx) => {
+    const userCount = await tx.user.count();
+    const role = userCount === 0 ? "ADMIN" : "USER";
 
-  const user = await prisma.user.create({
-    data: {
-      name: parsed.data.name,
-      email: parsed.data.email,
-      hashedPassword,
-      role,
-      settings: {
-        create: {
-          lowStockThreshold: 10,
-          currency: "USD",
-          theme: "dark",
-          units: "metric",
+    return tx.user.create({
+      data: {
+        name: parsed.data.name,
+        email: parsed.data.email,
+        hashedPassword,
+        role,
+        settings: {
+          create: {
+            lowStockThreshold: 10,
+            currency: "USD",
+            theme: "dark",
+            units: "metric",
+          },
         },
       },
-    },
+    });
   });
 
   return { success: true, data: { id: user.id } };