Update/notify other User in Spring Web

Question

I have some design/implementation issue that I just can't wrap my head around it. I am currently working on a text-based game with multiple players. I kind of understand how it works for Player-to-Server, I meant that Server sees every individual Player as the same.

I'm using spring-boot 2, spring-web, thymeleaf, hibernate.

I implemented a custom UserDetails that returns after the user login.

@Entity
@Table(name = "USER")
public class User implements Serializable {

    @Id
    private long userId;

    @Column(unique = true, nullable = false)
    private String userName;

    @OneToOne(cascade = CascadeType.ALL)
    @JoinColumn(name = "playerStatsId")
    private PlayerStats stats;
}

public class CurrentUserDetailsService implements UserDetailsService {

    @Override
    public CurrentUser loadUserByUsername(String userName) {

        User user = this.accountRepository.findByUserName(userName)
                .orElseThrow(() -> 
                    new UsernameNotFoundException("User details not found with the provided username: " + userName));

        return new CurrentUser(user);
    }
}

public class CurrentUser implements UserDetails {

    private static final long serialVersionUID = 1L;
    private User user = new User();

    public CurrentUser(User user) {
        this.user = user;
    }

    public PlayerStats getPlayerStats() {
        return this.user.getStats();
    }

    // removed the rest for brevity 
}

Hence, in my controller, I can do this to get the CurrentUser. *Note each User is also a player.

@GetMapping("/attackpage")
public String viewAttackPage(@AuthenticationPrincipal CurrentUser currentUser) {

    // return the page view for list of attacks

    return "someview";
}

The currentUser here would reflect to the current user per say (Player 1 or 2 or 3 and so on). Which works fine for most of the stuff happening to themselves such as purchasing some stuff, updating profile and so on. But what I can't get or know how to achieve is when 2 players interact.

For example, Player 1 attacks Player 2. If I am Player 1, what I'll do is to click the "Attack" on the View and select the Player 2, and submit the command. Hence, in the controller, it will be something like this.

@GetMapping("/attack")
public String launchAttack(@AuthenticationPrincipal CurrentUser currentUser, @RequestParam("playername") String player2) {

    updatePlayerState(player2);

    return "someview";
}

public void updatePlayerState(String player) {

    User user = getUserByPlayername(player);
    // perform some update to player state (say health, etc)
    // update back to db?
}

Here's is what really got me confused. As seen previously, when each User/Player logs in, a set of user (player) current state will be pulled from the DB and store "in-memory". Hence, when Player 1 attacks Player 2,

1. How do I "notify" or update Player 2 that the stats has changed, and thus, Player 2 should pull updated stats from db to memory.

2. How to tackle the possible concurrency issue here? For example, Player 2 health is 50 in DB. Player 2 then perform some action (say purchase health potion + 30), which then update the DB (health to 80). However, just before the DB is updated, Player 1 has already launch the attack and grab from DB the state of Player 2 where it will return 50 since DB has yet to be updated. So now, whatever changes made in getUserByPlayername() and update to the DB will be wrong, and the entire state of the Player will be "de-sync". I hope I am making sense here.

I understand that there is @Version in hibernate for optimistic locking but I'm not sure if it's applicable in this case. And would spring-session be useful in such case?

Should I not store the any data in memory when user login? Should I always be retrieving data from DB only when some action is performed? Like when viewProfile, then I pull from accountRepository. or when viewStats then I pull from statsRepository and on so.

Do point me in the right direction. Would appreciate for any concrete example of sort, or some kind of video/articles. If there is any additional information required, do let me know and I'll try to explain my case better.

Thank you.

Answer 1

I think that you should not be updating the currentUser in your Controller methods, and should not be relying on the data in that object to represent a player's current state. There are probably ways to get that to work, but you'd need to mess around with updating the security context.

I also recommend that you lookup Users by id instead of userName, so will write the rest of this answer with that approach. If you insist on finding Users by userName, adjust where necessary.

So, keeping it simple, I would have a reference to the accountRepository in the Controller, and then, whenever you need to get or update a player's state, use

User user = accountRepository.findById(currentUser.getId())

Yes, @Version and optimistic locking will help with the concurrency issues that you're concerned about. You can reload the Entity from the database, and retry the operation if you catch an @OptimisticLockException. Or, you may want to respond to player 1 with something like "Player 2 has just purchased a potion of healing, and is now 80 heath, do you still want to attack?"

Answer 2

I'm not a spring user, but I think that the problem is more conceptual than technical.
I'll try to provide an answer which uses a general approach, while writing the examples in a JavaEE style so that they should be understandable, and hopefully, portable to spring.

First of all: every single DETACHED entity is stale data. And stale data is not "trustable".

So:

1. each method that modify the state of an object should re-fetch the object from DB inside the transaction:

   updatePlayerState() should be a transaction-boundary method (or called inside a tx), and getUserByPlayername(player) should fetch the target object from the DB.

   JPA speaking: em.merge() is forbidden (without proper locking, i.e. @Version).

   if you (or spring) are doing this already, there's little to add.
   WRT the "lost update problem" you mention in your 2. be aware that this covers the application server side (JPA/Hibernate), but the very same problem could be present on DB side, which should be properly configured for, at least, repeatable read isolation. Take a look at MySQL does not conform to Repeatable Read really, if you are using it.

2. you have to handle controller fields that refer stale Players/Users/Objects. You have, at least, two options.

   1. re-fetch for each request: suppose Player1 has attacked Player2 and diminished Player2 HP by 30. When Player2 goes to a view that shows his HP, the controller behind that view should have re-fetched the Player2/User2 entity before rendering the view.

      In other words, all of your presentation (detached) entities should be, sort of, request-scoped.

      i.e you can use a @WebListener to reload your Player/User:

      @WebListener
      public class CurrentUserListener implements ServletRequestListener {
      
          @Override
          public void requestInitialized(ServletRequestEvent sre) {
              CurrentUser currentUser = getCurrentUser();
              currentUser.reload();
          }
      
          @Override
          public void requestDestroyed(ServletRequestEvent sre) {
              // nothing to do
          }
      
          public CurrentUser getCurrentUser() {
              // return the CurrentUser
          }
      }
      

      or a request-scoped bean (or whatever-spring-equivalent):

      @RequestScoped
      public class RefresherBean {
          @Inject
          private CurrentUser currentUser;
      
          @PostConstruct
          public void init()
          {
              currentUser.reload();
          }
      }
      

   2. notify other controller instances: if the update succeeded a notification should be sent to other controllers.

      i.e. using CDI @Observe (if you have CDI available):

      public class CurrentUser implements UserDetails {
      
          private static final long serialVersionUID = 1L;
          private User user = new User();
      
          public CurrentUser(User user) {
              this.user = user;
          }
      
          public PlayerStats getPlayerStats() {
              return this.user.getStats();
          }
      
          public void onUpdate(@Observes(during = TransactionPhase.AFTER_SUCCESS) User user) {
              if(this.user.getId() == user.getId()) {
                  this.user = user;
              }
          }
      
          // removed the rest for brevity 
      }
      

      Note that CurrentUser should be a server-managed object.