Offline queue prevents duplicate submissions on reconnect

A reconnect that fires while a previous sync is still in progress can submit the same queued action twice — a duplicate order, a duplicate payment, or a duplicate form entry. CWE-362 (Race Condition) and CWE-694 (Use of Multiple Primitives to Lock a Resource) both apply to queue processing without deduplication guards. Without idempotency keys, network flicker during sync transforms a reliability feature into a correctness hazard. On APIs that charge per-request or trigger side effects (emails, webhooks, charges), duplicates have direct financial and trust consequences.

Stamp each queued action with an idempotency key at enqueue time, then send it as a header on every retry. Mark items as synced rather than deleting them immediately, so a mid-sync crash doesn't re-enqueue an already-completed action.

type QueuedAction = {
  idempotencyKey: string;
  action: unknown;
  synced: boolean;
};

export async function enqueue(action: { type: string; payload: { id: string } }) {
  const raw = await AsyncStorage.getItem(QUEUE_KEY);
  const queue: QueuedAction[] = raw ? JSON.parse(raw) : [];
  queue.push({
    idempotencyKey: `${action.type}__${action.payload.id}__${Date.now()}`,
    action,
    synced: false,
  });
  await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
}

export async function processQueue() {
  const raw = await AsyncStorage.getItem(QUEUE_KEY);
  if (!raw) return;
  const queue: QueuedAction[] = JSON.parse(raw);
  for (const item of queue) {
    if (item.synced) continue;
    const res = await fetch('/api/action', {
      method: 'POST',
      headers: { 'Idempotency-Key': item.idempotencyKey, 'Content-Type': 'application/json' },
      body: JSON.stringify(item.action),
    });
    if (res.ok) item.synced = true;
  }
  await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue.filter(i => !i.synced)));
}

Your server must also honor the Idempotency-Key header and return the original response on replay.