race condition security patch

web/src/lib/pocketbase.ts

@@ -1,8 +1,15 @@
+import { browser } from '$app/environment';
 import { env } from '$env/dynamic/public'
 import PocketBase from 'pocketbase'
 
-export function createInstance() {
-  return new PocketBase(env.PUBLIC_POCKETBASE_URL)
-}
+let pb: PocketBase;
 
-export const pb = createInstance()
+export function getPb(): PocketBase {
+  if(!browser) {
+    throw Error("Only available client side!")
+  }
+  if (!pb) {
+    pb = new PocketBase(env.PUBLIC_POCKETBASE_URL);
+  }
+  return pb;
+}