Enhance Persistence Middleware and Options

- Introduced a debounce lock in PersistenceMiddleware to prevent memory leaks during state saving.
- Added checks for maximum state size and improved error handling for storage quota exceptions.
- Implemented a RequireSignature option in PersistenceOptions to enforce state integrity.
- Enhanced Query class to use atomic operations for fetching state, preventing race conditions.
- Improved cache entry expiration checks using a non-generic interface for better performance.
- Updated ServerSyncMiddleware to handle deeply nested JSON payloads and added session validation timeout.
- Added cancellation support for pending debounced and throttled actions in respective managers.
- Introduced tests for optimistic updates to ensure concurrent modification exceptions are handled correctly.
- Enhanced DevToolsMiddleware tests to run only in DEBUG builds for security reasons.

Author: mashrulhaque

src/EasyAppDev.Blazor.Store/Blazor/SelectorStoreComponent.cs

@@ -36,9 +36,10 @@ public abstract class SelectorStoreComponent<TState> : ComponentBase, IDisposabl
 {
     private IDisposable? _subscription;
     private bool _disposed;
-    private object? _selectedValue;
+    private volatile object? _selectedValue;
     private object? _lastRenderedValue;
-    private bool _isFirstRender = true;
+    private int _isFirstRender = 1; // 1 = true, 0 = false (for thread-safe access)
+    private readonly object _valueLock = new();
 #if DEBUG
     private Guid _subscriptionId;
 #endif
@@ -141,15 +142,19 @@ protected override void OnInitialized()
     /// <inheritdoc />
     protected override bool ShouldRender()
     {
-        // Always render on first render
-        if (_isFirstRender)
+        // Always render on first render (thread-safe read using Volatile)
+        if (Volatile.Read(ref _isFirstRender) == 1)
         {
             return true;
         }
 
         // Only render if the selected value has actually changed since last render
         // This prevents duplicate renders from Blazor's internal rendering mechanism
-        var currentSelected = _selectedValue;
+        object? currentSelected;
+        lock (_valueLock)
+        {
+            currentSelected = _selectedValue;
+        }
 
         if (currentSelected == null && _lastRenderedValue == null)
         {
@@ -169,8 +174,12 @@ protected override void OnAfterRender(bool firstRender)
     {
         base.OnAfterRender(firstRender);
 
-        _isFirstRender = false;
-        _lastRenderedValue = _selectedValue;
+        // Thread-safe write using Volatile
+        Volatile.Write(ref _isFirstRender, 0);
+        lock (_valueLock)
+        {
+            _lastRenderedValue = _selectedValue;
+        }
 
 #if DEBUG
         // Record render event for diagnostics
@@ -225,8 +234,20 @@ protected virtual void SubscribeToStore()
                 // This is now safe with ShouldRender() optimization preventing cascade renders
                 DiagnosticsService?.RecordSubscriptionNotification(_subscriptionId);
 #endif
-                _selectedValue = value;
-                InvokeAsync(StateHasChanged);
+                // Thread-safe write to _selectedValue
+                lock (_valueLock)
+                {
+                    _selectedValue = value;
+                }
+                // Use try-catch to handle component disposal during async invoke
+                try
+                {
+                    InvokeAsync(StateHasChanged);
+                }
+                catch (ObjectDisposedException)
+                {
+                    // Component was disposed during notification - this is expected
+                }
             });
     }
 

src/EasyAppDev.Blazor.Store/Blazor/StoreComponent.cs

@@ -20,7 +20,7 @@ public abstract class StoreComponent<TState> : ComponentBase, IDisposable
     where TState : notnull
 {
     private IDisposable? _subscription;
-    private bool _disposed;
+    private volatile bool _disposed;
 #if DEBUG
     private Guid _subscriptionId;
 #endif
@@ -55,6 +55,11 @@ public abstract class StoreComponent<TState> : ComponentBase, IDisposable
     /// </summary>
     protected TState State => Store.GetState();
 
+    /// <summary>
+    /// Gets whether the component has been disposed.
+    /// </summary>
+    protected bool IsDisposed => _disposed;
+
     /// <summary>
     /// Updates the state using a transformation function (Zustand-style).
     /// </summary>
@@ -162,7 +167,19 @@ protected IDisposable SubscribeToSelector<TSelected>(
             value =>
             {
                 callback?.Invoke(value);
-                InvokeAsync(StateHasChanged);
+                // Use try-catch to handle component disposal during async invoke
+                try
+                {
+                    InvokeAsync(StateHasChanged);
+                }
+                catch (ObjectDisposedException)
+                {
+                    // Component was disposed during notification - this is expected
+                }
+                catch (Exception ex)
+                {
+                    Logger?.LogWarning(ex, "Error invoking StateHasChanged in {ComponentType}", GetType().Name);
+                }
             });
     }
 

src/EasyAppDev.Blazor.Store/Blazor/StoreComponentWithUtilities.cs

@@ -17,6 +17,10 @@ namespace EasyAppDev.Blazor.Store.Blazor;
 public abstract class StoreComponentWithUtilities<TState> : StoreComponent<TState>
     where TState : notnull
 {
+    private readonly HashSet<string> _registeredDebounceKeys = new();
+    private readonly HashSet<string> _registeredThrottleKeys = new();
+    private readonly object _keysLock = new();
+
     /// <summary>
     /// Gets the injected debounce manager.
     /// </summary>
@@ -69,12 +73,24 @@ protected Task UpdateDebounced(
         ArgumentNullException.ThrowIfNull(updater);
 
         var key = $"{GetType().Name}_{action ?? "update"}";
+        TrackDebounceKey(key);
         return DebounceManager.Debounce(key, async () =>
         {
-            await InvokeAsync(async () =>
+            // Check if disposed before invoking to prevent operations on disposed component
+            if (IsDisposed) return;
+
+            try
+            {
+                await InvokeAsync(async () =>
+                {
+                    if (IsDisposed) return;
+                    await Store.UpdateAsync(updater, action);
+                });
+            }
+            catch (ObjectDisposedException)
             {
-                await Store.UpdateAsync(updater, action);
-            });
+                // Component was disposed during async invoke - expected behavior
+            }
         }, delayMilliseconds);
     }
 
@@ -92,12 +108,24 @@ protected Task UpdateDebouncedAsync(
         ArgumentNullException.ThrowIfNull(asyncUpdater);
 
         var key = $"{GetType().Name}_{action ?? "update"}";
+        TrackDebounceKey(key);
         return DebounceManager.Debounce(key, async () =>
         {
-            await InvokeAsync(async () =>
+            // Check if disposed before invoking to prevent operations on disposed component
+            if (IsDisposed) return;
+
+            try
+            {
+                await InvokeAsync(async () =>
+                {
+                    if (IsDisposed) return;
+                    await Store.UpdateAsync(asyncUpdater, action);
+                });
+            }
+            catch (ObjectDisposedException)
             {
-                await Store.UpdateAsync(asyncUpdater, action);
-            });
+                // Component was disposed during async invoke - expected behavior
+            }
         }, delayMilliseconds);
     }
 
@@ -115,12 +143,24 @@ protected Task UpdateThrottled(
         ArgumentNullException.ThrowIfNull(updater);
 
         var key = $"{GetType().Name}_{action ?? "update"}";
+        TrackThrottleKey(key);
         return ThrottleManager.Throttle(key, async () =>
         {
-            await InvokeAsync(async () =>
+            // Check if disposed before invoking to prevent operations on disposed component
+            if (IsDisposed) return;
+
+            try
             {
-                await Store.UpdateAsync(updater, action);
-            });
+                await InvokeAsync(async () =>
+                {
+                    if (IsDisposed) return;
+                    await Store.UpdateAsync(updater, action);
+                });
+            }
+            catch (ObjectDisposedException)
+            {
+                // Component was disposed during async invoke - expected behavior
+            }
         }, intervalMilliseconds);
     }
 
@@ -138,12 +178,24 @@ protected Task UpdateThrottledAsync(
         ArgumentNullException.ThrowIfNull(asyncUpdater);
 
         var key = $"{GetType().Name}_{action ?? "update"}";
+        TrackThrottleKey(key);
         return ThrottleManager.Throttle(key, async () =>
         {
-            await InvokeAsync(async () =>
+            // Check if disposed before invoking to prevent operations on disposed component
+            if (IsDisposed) return;
+
+            try
+            {
+                await InvokeAsync(async () =>
+                {
+                    if (IsDisposed) return;
+                    await Store.UpdateAsync(asyncUpdater, action);
+                });
+            }
+            catch (ObjectDisposedException)
             {
-                await Store.UpdateAsync(asyncUpdater, action);
-            });
+                // Component was disposed during async invoke - expected behavior
+            }
         }, intervalMilliseconds);
     }
 
@@ -239,4 +291,67 @@ protected Task<T> LazyLoad<T>(
 
         return LazyCache.GetOrLoadAsync(cacheKey, loader, cacheFor);
     }
+
+    /// <summary>
+    /// Tracks a debounce key for cleanup on disposal.
+    /// </summary>
+    private void TrackDebounceKey(string key)
+    {
+        lock (_keysLock)
+        {
+            _registeredDebounceKeys.Add(key);
+        }
+    }
+
+    /// <summary>
+    /// Tracks a throttle key for cleanup on disposal.
+    /// </summary>
+    private void TrackThrottleKey(string key)
+    {
+        lock (_keysLock)
+        {
+            _registeredThrottleKeys.Add(key);
+        }
+    }
+
+    /// <inheritdoc />
+    protected override void Dispose(bool disposing)
+    {
+        if (disposing)
+        {
+            // Cancel all registered debounce and throttle operations for this component
+            CancelPendingOperations();
+        }
+
+        base.Dispose(disposing);
+    }
+
+    /// <summary>
+    /// Cancels all pending debounce and throttle operations registered by this component.
+    /// </summary>
+    private void CancelPendingOperations()
+    {
+        string[] debounceKeys;
+        string[] throttleKeys;
+
+        lock (_keysLock)
+        {
+            debounceKeys = _registeredDebounceKeys.ToArray();
+            throttleKeys = _registeredThrottleKeys.ToArray();
+            _registeredDebounceKeys.Clear();
+            _registeredThrottleKeys.Clear();
+        }
+
+        // Cancel debounce operations (fire-and-forget since we're disposing)
+        foreach (var key in debounceKeys)
+        {
+            _ = DebounceManager.CancelAsync(key);
+        }
+
+        // Cancel throttle operations
+        foreach (var key in throttleKeys)
+        {
+            _ = ThrottleManager.CancelAsync(key);
+        }
+    }
 }

src/EasyAppDev.Blazor.Store/Core/ISubscriptionManager.cs

@@ -39,6 +39,13 @@ IDisposable Subscribe<TSelected>(
     /// </summary>
     void NotifyAll();
 
+    /// <summary>
+    /// Notifies all subscribers of a state change with a captured state snapshot.
+    /// This ensures subscribers see a consistent state even if concurrent updates occur.
+    /// </summary>
+    /// <param name="capturedState">The state snapshot captured before releasing the store lock.</param>
+    void NotifyAll(TState capturedState);
+
     /// <summary>
     /// Clears all active subscriptions. Typically called during store disposal.
     /// </summary>