How to handle multiple requests to purchase at same time - node.js

Question

Let's imagine we have a shopping website which the users are able to purchase items with their account-balance.
user A requests to purchase item B.
here are the steps:
Database gets user's balance.
Checks if balance is more than the cost.
Updates user's balance ( balance - cost = newBalance )
now this is where my question begins:
since javascript is single-threaded and we are requesting to db in an asynchronous way what happens if:
user A sends multiple requests to purchase the item
another user tries to purchase the item ( item should be out of stock after 1 purchase )
I've done some testing and I want to know what is the best way to prevent userA to purchase multiple items when in reality he should be out of balance after second purchase?
my test:
const fs = require('fs');
const cost = 500;
// .data.txt has `1000` as its content
function getMoneyFromDatabase() {
return new Promise((resolve, reject) => {
fs.readFile('./data.txt', 'utf-8', (err, data) => {
if (err) reject(err);
else resolve(Number(data));
});
});
}
function setMoneyToDatabase(newMoney) {
return new Promise((resolve, reject) => {
fs.writeFile('./data.txt', newMoney, (err) => {
if (err) reject(err);
else resolve();
});
});
}
async function getMoney() {
const money = await getMoneyFromDatabase();
if (money >= cost) {
// Able to purchase
console.log('able to purchase');
const newMoney = money - cost;
await setMoneyToDatabase(newMoney);
console.log('purchased');
}
}
getMoney();
getMoney();
getMoney();
getMoney();
this logs 4 purchased while in reality it should only be able to purchase two times
and the data saved inside data.txt is 500 while it should be -1000 ( 500, 0, -500, -1000 )

Answer 1

One thing you can do is make sure your API requests related to charging are idempotent, meaning they can be sent multiple times but will result in the same outcome as long as the request is the same.
You can implement idempotent requests by sending a unique key along with the request to make sure that only the first time it will be accepted as a new request otherwise it will be handled as a duplicate request. This is also useful when you want to safely retry a requests without accidentally charging the user multiple times.
Many payment processors have built-in support for this such as Stripe: https://stripe.com/docs/api/idempotent_requests
As for stock, you should only decrease it when a payment is verified or if it's not automatic the first user with a pending invoice for it. Otherwise the stock will go down even if the user for example has the balance but payment could not be processed.
Implementing payments is hard and can only be learned to be implemented in a decent way after trial and errors, I'd recommend you try to do a minimal app and handle payments with a payment gateway such as Stripe and advance by handling edge cases.