Amr Samir | Transactional Outbox Pattern & Reliable Registration

1. The Dual-Write Vulnerability in Distributed Registration

When a user signs up, the application must perform two actions:

Save the new user record in the primary database.

Send a verification email via an external service (e.g., SendGrid/SES) or publish an event to RabbitMQ/Kafka.

code

Scenario A (DB First):
User written to DB -> Server crashes before email dispatched -> Orphaned unverified user!

Scenario B (Email First):
Email sent -> DB transaction rolls back due to conflict -> User receives link to non-existent account!

2. The Transactional Outbox Pattern

code

+-------------------------------------------------------------+
|               Single Atomic DB Transaction                  |
|                                                             |
|  1. INSERT INTO users (id, email, password, ...)            |
|  2. INSERT INTO outbox_events (event_type, payload, status) |
+-------------------------------------------------------------+
                              |
                              v (Committed Atomically)
+-------------------------------------------------------------+
|             Background Outbox Worker (Debezium/CDC)         |
|                                                             |
|  Polls outbox_events -> Publishes to Queue -> Marks PROCESSED|
+-------------------------------------------------------------+

3. NestJS / PostgreSQL Implementation

typescript

@Injectable()
export class RegistrationService {
  constructor(private prisma: PrismaService) {}

  async registerUser(dto: RegisterDto) {
    const passwordHash = await argon2.hash(dto.password);

    // Atomic transaction guarantees outbox record is stored with user
    return this.prisma.$transaction(async (tx) => {
      const user = await tx.user.create({
        data: {
          email: dto.email,
          passwordHash,
          isVerified: false,
        },
      });

      const verificationToken = crypto.randomUUID();
      await tx.outboxEvent.create({
        data: {
          aggregateType: 'USER',
          aggregateId: user.id,
          eventType: 'USER_REGISTERED',
          payload: {
            userId: user.id,
            email: user.email,
            verificationToken,
          },
          status: 'PENDING',
        },
      });

      return { userId: user.id, message: 'Registration initiated successfully.' };
    });
  }
}

Reliable User Registration: Solving the Dual-Write Problem with Transactional Outbox

Recommended Posts

Building Resilience Against Third-Party Outages: Circuit Breakers & Exponential Backoff

JWT Authentication in Production: Access Tokens, Refresh Token Rotation & Revocation

Designing Secure Password Reset & OTP Verification: Timing Attacks, Rate Limits & State

Related Projects

Related Certificates

Reliable User Registration: Solving the Dual-Write Problem with Transactional Outbox

1. The Dual-Write Vulnerability in Distributed Registration

2. The Transactional Outbox Pattern

3. NestJS / PostgreSQL Implementation

4. Key Takeaways