approveReviewObject race conditions after commitTransaction

[ElectricNroff]

cve-services/src/controller/review-object.controller/review-object.controller.js

Lines 91 to 97 in 69b2859

	reviewObj = await reviewRepo.approveReviewOrgObject(UUID, { session })
	await baseOrgRepo.updateOrgFull(org.short_name, dataToUpdate, { session }, false, requestingUserUUID, false, true)
	await session.commitTransaction()
	// Return the updated organization
	updatedOrgObj = await baseOrgRepo.findOneByUUID(reviewObject.target_object_uuid)

Because the findOneByUUID occurs after the commitTransaction, the return value of approveReviewObject can be any of:

• the approved data
• data that is newer than what was approved
• data that had been stored in a database replica before the approval was applied

It should be possible to obtain the approved data by working with the return value of await baseOrgRepo.updateOrgFull before the commitTransaction.

Admittedly, a caller might be interested in knowing about data that is newer than what was approved, but the await of findOneByUUID can throw even if the commitTransaction succeeds, and then - as far as I know - the session.abortTransaction within catch (updateErr) isn't allowed:

https://github.com/mongodb/specifications/blob/master/source/transactions/transactions.md

If this session is in the "transaction committed" state, then drivers MUST raise an error containing
the message "Cannot call abortTransaction after calling commitTransaction".