feat: implement atomic secret provisioning in userSecretRepositoryExtension

[Artuomka]

Summary by CodeRabbit

• Bug Fixes
  • Concurrent first-time connection requests now use the same persisted signing key, preventing inconsistent authentication tokens.
  • Subsequent connection requests continue to use the stored key, keeping token validation consistent.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e0a5828-6290-4ee1-be0b-2fd9debae39d

📥 Commits

Reviewing files that changed from the base of the PR and between 475f4f1 and 252a93c.

📒 Files selected for processing (4)

• backend/src/entities/user-secret/repository/user-secret-repository.extension.ts
• backend/src/entities/user-secret/repository/user-secret-repository.interface.ts
• backend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.ts
• backend/test/ava-tests/non-saas-tests/non-saas-sitenova-microservice-e2e.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The user-secret repository adds conflict-tolerant secret creation. The Sitenova authentication service uses the persisted secret as its signing key. End-to-end tests cover concurrent requests, key reuse, visitor-token validation, and unauthenticated requests.

Changes: Sitenova signing-key creation

Layer / File(s)	Summary
Conflict-tolerant secret repository operation backend/src/entities/user-secret/repository/user-secret-repository.interface.ts, backend/src/entities/user-secret/repository/user-secret-repository.extension.ts	The repository interface and extension add createSecretUnlessExists. It attempts an insert while ignoring conflicts, then returns the row matching the slug and company ID, or throws if no row is found.
Persisted signing key and endpoint tests backend/src/microservices/sitenova-microservice/services/sitenova-enduser-auth.service.ts, backend/test/ava-tests/non-saas-tests/non-saas-sitenova-microservice-e2e.test.ts	The service decrypts the secret returned by the repository. Tests check that eight concurrent authenticated requests return the same key, that one matching secret is stored, that a visitor token validates with the key, that a later request returns the stored key, and that a request without a microservice JWT returns 401.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 252a9

This change makes first-time signing key creation consistent under concurrent requests, so all callers use the same stored key. No merge-blocking risk was found in the supplied context.

Pre-merge checks · 6

Passed checks (6 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: adding atomic secret provisioning to userSecretRepositoryExtension to address concurrent secret creation.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No OWASP-relevant security regression is introduced. The new repository method uses TypeORM parameter binding and the existing unique (companyId, slug) index with conflict-ignore, then reads the exa…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{This rabbit watched eight requests arrive,
One stored key kept each reply alive.
A visitor token passed the test,
Later calls found the same secret.
I twitch my nose and hop away!}

_{Comment @coderabbitai help to get the list of available commands.}