Mark CBCsrf as threadSafe to avoid handing out a half-wired singleton

[davidsf]

Problem

csrfToken() intermittently throws variable [CACHESTORAGE] doesn't exist at models/cbcsrf.cfc when several requests run concurrently against a cold singleton cache — in our case the first requests after every framework reinit on deploy.

Singleton.getFromScope() publishes the instance to the singleton cache before autowiring it (so circular dependencies can resolve), and the first containsKey() check runs outside the lock:

if ( NOT variables.singletons.containsKey( cacheKey ) ) {      // unlocked check
  lock ... {
    if ( NOT variables.singletons.containsKey( cacheKey ) ) {
      var tmpSingleton = variables.injector.buildInstance( ... );
      if ( NOT arguments.mapping.getThreadSafe() ) {
        variables.singletons.put( cacheKey, tmpSingleton );     // published here
      }
      variables.injector.autowire( target = tmpSingleton, ... ); // injected after

A thread that passes the unlocked check between the put() and the end of autowire() gets the instance without variables.cacheStorage.

Fix

Annotate the component as threadSafe: WireBox then stores it only after autowiring, and other threads wait on the lock. CacheStorage in cbstorages already carries the annotation for the same reason.

CBCsrf has no circular dependencies (settings comes from the coldbox:moduleSettings DSL, cacheStorage from cacheStorage@cbcsrf), so nothing relies on the early publication.

Changelog entry added under Unreleased.

[lmajano]

Gracias amigo