Refresh alog's VPN users only when needed

bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java

@@ -63,9 +63,10 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
         final var accountUuid = device.getAccount();
         final var uninitializedDevices = findByAccountAndUninitialized(accountUuid);
 
+        var newDevicesCreated = false;
         if (uninitializedDevices.size() < SPARE_DEVICES_PER_ACCOUNT_THRESHOLD
                 && !configuration.getBean(AccountDAO.class).findByUuid(accountUuid).isRoot()) {
-            ensureAllSpareDevices(accountUuid, device.getNetwork());
+            newDevicesCreated = ensureAllSpareDevices(accountUuid, device.getNetwork());
         }
 
         final Device result;
@@ -76,13 +77,14 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
             // just create the device now:
             device.initTotpKey();
             result = super.create(device);
+            newDevicesCreated = true;
         } else {
             final var uninitialized = uninitializedDevices.get(0);
             copy(uninitialized, device);
             result = super.update(uninitialized);
         }
 
-        refreshVpnUsers();
+        if (newDevicesCreated) refreshVpnUsers();
         return result;
     }
 
@@ -92,7 +94,6 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
         if (toUpdate.uninitialized()) die("Cannot update special devices: " + updateRequest.getName());
 
         final var updated = super.update(toUpdate);
-        refreshVpnUsers();
         return updated;
     }
 
@@ -120,6 +121,10 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
         return newDevicesCreated;
     }
 
+    /**
+     * This refresh should be done only if there was real change in device count. The script that is executed afterwards
+     * uses only devices' UUIDs, so this should be called . No need to call this method in any other case.
+     */
     public void refreshVpnUsers() {
         log.info("ensureSpareDevice: refreshing VPN users by touching: "+abs(VPN_REFRESH_USERS_FILE));
         touch(VPN_REFRESH_USERS_FILE);