Fix duplicate bookings: DB constraint + frontend result handling#1
Open
RadekHavelka wants to merge 3 commits into
Open
Fix duplicate bookings: DB constraint + frontend result handling#1RadekHavelka wants to merge 3 commits into
RadekHavelka wants to merge 3 commits into
Conversation
- Add UNIQUE INDEX on (stylist_id, start_time) via migration so the DB atomically rejects the second concurrent INSERT even under a race condition - Mirror the constraint in the Doctrine XML mapping for schema validation - Catch UniqueConstraintViolationException in DoctrineBookingRepository::save() and rethrow as DomainException so the GraphQL mutation returns a clean errors[] response instead of a 500 - Add .gitignore covering vendor/, node_modules/, .next/, temp/*, var/*, logs/*, .env.local files, .idea/, and .claude/ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The skill audits write paths for three layers of duplicate-write vulnerability: missing DB unique constraints, unguarded repository save methods, and frontend double-submit patterns. It reports findings and offers to apply fixes for each layer. Tighten .gitignore to exclude only .claude/settings.local.json instead of the whole .claude/ directory, so project-level skills are committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both concurrent calls still fire (intentional test harness), but now all results are checked — success is reported if any call succeeded. Previously only result[0] was checked, which failed ~50% of the time due to non-deterministic server-side processing order. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Customers were occasionally receiving two booking confirmations for the
same time slot. The root cause was twofold:
Frontend (
BookingForm.tsx) fires two identical GraphQL mutationsconcurrently via
Promise.allon every form submission, simulating adouble-click race condition.
Backend had no uniqueness protection — two concurrent
INSERTs forthe same stylist + time slot both succeeded. SQLite's write locking
caused the duplicate to be non-deterministic (it didn't happen every
time), masking the real issue.
Changes
Backend
Version20260625000000.php): adds aUNIQUE INDEXon(stylist_id, start_time)inbarbershop_bookings. The DB atomicallyrejects the second concurrent INSERT regardless of application-level timing.
Booking.dcm.xml): mirrors the constraint so schemavalidation tools stay consistent.
DoctrineBookingRepository::save(): catchesUniqueConstraintViolationExceptionand rethrows asDomainException,so the GraphQL mutation returns a clean
errors[]response instead ofa 500.
Frontend
BookingForm.tsx: the duplicatePromise.allcall is intentionallykept as a test harness. Fixed the result handling — previously only
result[0]was checked (non-deterministically the failed one ~50% ofthe time). Now all results are checked: success is reported if any call
succeeded, error is shown only if all calls failed.
Project
.gitignore: added to excludevendor/,node_modules/,.next/,runtime dirs,
.env.localfiles, and IDE folders..claude/commands/audit-duplicate-writes.md: Claude Code skill thataudits write paths for missing DB constraints, unguarded repository save
methods, and frontend double-submit patterns.