Add security hardening

api/internal/state/aggregator.go

@@ -11,6 +11,7 @@ import (
 	"log/slog"
 	"strconv"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/kamadopool/kamado-api/internal/bitcoind"
@@ -368,6 +369,11 @@ type Aggregator struct {
 	// reconstructible header. Never mutated after assignment, so the
 	// pointer is safe to hand out in snapshots.
 	bestPow *BestSharePow
+	// Set while a log rescan is running. The scan walks every line of a
+	// log that can hold millions, so overlapping runs would multiply the
+	// I/O for no benefit and give a caller a cheap way to load the box.
+	rebuilding atomic.Bool
+
 	// PoW data lines arrive on the share channel just before their
 	// matching "Accepted client" line. Park them here keyed by header
 	// hash until the accepted event confirms the share, so data from a
@@ -1007,6 +1013,10 @@ func (a *Aggregator) RebuildShareStatsFromLog() (adopted bool, scanned int64, er
 	if a.LogFilePath == "" {
 		return false, 0, errors.New("no ckpool log path configured")
 	}
+	if !a.rebuilding.CompareAndSwap(false, true) {
+		return false, 0, errors.New("a share statistics rebuild is already running")
+	}
+	defer a.rebuilding.Store(false)
 	st, err := logmon.ScanShareStats(a.LogFilePath)
 	if err != nil {
 		return false, 0, err