Bug: PATCH appointment skips conflict detection when staffId omitted #19
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
In
apps/api/src/routes/appointments.ts, the PATCH endpoint's conflict detection condition requiresbody.staffIdto be truthy. If a user reschedules an appointment (changesstartTime/endTime) without resendingstaffId, conflict detection is skipped entirely — even when the appointment already has a staff member assigned.Context
Flagged in CEO review on PR #15. Merged without fix.
Fix
When
staffIdis not in the request body, read the existing appointment'sstaffIdfrom the database and use it for conflict detection.Impact
Rescheduling an appointment to an overlapping timeslot bypasses conflict detection.
Fixed in PR #24 (merged 2026-03-17). See commit
43e50255.