[Bug] Race condition in card creation — concurrent requests can create multiple default cards

[Midoriya-w]

Summary

In apps/backend/src/routes/cards.ts, the POST /api/cards endpoint checks if the user has zero cards to decide whether the new card should be the default:

const cardCount = await app.prisma.card.count({ where: { userId } });

const card = await app.prisma.card.create({
  data: {
    isDefault: cardCount === 0,
    ...
  }
});

These are two separate database operations with no transaction or lock between them. If two requests arrive simultaneously when a user has zero cards, both will read cardCount === 0 and both will create a card with isDefault: true — leaving the user with two default cards.

Location

apps/backend/src/routes/cards.ts — POST / handler

Steps to Reproduce

1. Send two simultaneous POST /api/cards requests for a new user with no existing cards
2. Both requests read cardCount === 0
3. Both cards are created with isDefault: true
4. User now has two default cards data integrity violation

Fix

Wrap the count check and card creation in a single Prisma transaction to prevent the race window.

Impact

Data integrity violation user ends up with multiple default cards causing undefined behaviour in the UI.

[Midoriya-w]

Hey @Harxhit I discovered this race condition while auditing the codebase and would love to fix it under GSSoC 2026. Can I get assigned?

[Harxhit]

@Midoriya-w I have assigned this issue to you.

[Midoriya-w]

hey @Harxhit Implemented the fix for the race condition described in #333 by wrapping the card count check and card creation logic inside a Prisma transaction.

PR: #349