Community owner will register the same username twice when it should not

[kingalg]

Version: 2.0.3-alpha.13
System: MacOS, Windows, Linux
So far issue not spotted on mobile.

Issue: more then one user registered with the same username.
It was working before alpha.13. The last time we had a bug related to impersonation attack was around 5 weeks ago and it was fixed.

Steps to recreate (this is how I did it, but Wiktor and Kacper replicated it in different ways as well):

1. Create community and register owner on desktop.
2. Make sure that the owner is turn on.
3. Join with another desktop and the same username as the owner.

What happens - both users are registered with the same username and channel users get "possible impersonation attack" popup.

[siepra]

HYPOTHESIS:

certificatesRequestsStore.ts:71 emits LOADED_USER_CSRS on database load, which then triggers REPLICATED_CSR in storage.service.ts:334. It accepts an array of certificates as a payload field, which is being loaded from the certificates store.

Method extractPendingCsrs should filter out CSRs containing usernames already used in registered certificates, but if it received an empty list of certificates, then it won't filter out anything.

My hypothesis is there's a race condition when the certificates store is being loaded AFTER the CSRs store and as a result it isn't providing certificates to verify username uniqueness against.

HOW TO VERIFY:

Modify the code so it always passes an empty array of certificates and see if the problem becomes deterministic.

POSSIBLE SOLUTION:

Make sure certificates are always being loaded before CSRs.

[holmesworcester]

Lucas added this PR: #2157

@leblowl feel free to add this back to "in progress" if I jumped the gun in moving it to "waiting for review".

[holmesworcester]

This is a heisenbug but the warning works correctly (so there isn't a security issue, we do not think) and it happens only in unlikely cases. Moved to next sprint.

[holmesworcester]

Noting that we think this is fixed. We should wait to see if it comes up again and reopen.

@kingalg please reopen if you're still seeing this in the latest release.