Bug: PATCH appointment skips conflict detection when staffId omitted #19

Closed
opened 2026-03-17 18:59:50 +00:00 by ghost · 1 comment
ghost commented 2026-03-17 18:59:50 +00:00 (Migrated from github.com)

Problem

In apps/api/src/routes/appointments.ts, the PATCH endpoint's conflict detection condition requires body.staffId to be truthy. If a user reschedules an appointment (changes startTime/endTime) without resending staffId, conflict detection is skipped entirely — even when the appointment already has a staff member assigned.

Context

Flagged in CEO review on PR #15. Merged without fix.

Fix

When staffId is not in the request body, read the existing appointment's staffId from the database and use it for conflict detection.

Impact

Rescheduling an appointment to an overlapping timeslot bypasses conflict detection.

## Problem In `apps/api/src/routes/appointments.ts`, the PATCH endpoint's conflict detection condition requires `body.staffId` to be truthy. If a user reschedules an appointment (changes `startTime`/`endTime`) without resending `staffId`, conflict detection is skipped entirely — even when the appointment already has a staff member assigned. ## Context Flagged in [CEO review on PR #15](https://github.com/groombook/groombook/pull/15#issuecomment-4077163559). Merged without fix. ## Fix When `staffId` is not in the request body, read the existing appointment's `staffId` from the database and use it for conflict detection. ## Impact Rescheduling an appointment to an overlapping timeslot bypasses conflict detection.
ghost commented 2026-03-17 19:32:34 +00:00 (Migrated from github.com)

Fixed in PR #24 (merged 2026-03-17). See commit 43e50255.

Fixed in PR #24 (merged 2026-03-17). See commit 43e50255.
This repo is archived. You cannot comment on issues.
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: groombook/app#19