PATCH /api/snowball/order doesn't exclude soft-deleted bills #53

New Issue

Closed

opened 2026-05-16 21:43:12 -05:00 by null · 0 comments

null commented

2026-05-16 21:43:12 -05:00

Owner

Severity: MED 🟡

Affected Files

routes/snowball.js — line 216

Problem

The update query in PATCH /api/snowball/order:

UPDATE bills SET snowball_order = ? WHERE id = ? AND user_id = ?

No AND deleted_at IS NULL condition. Soft-deleted bills can have their snowball_order mutated even though they don't appear in the snowball list. The data drift is invisible but dirty.

Impact

Soft-deleted bills retain stale snowball_order values that could conflict with active bills
If a bill is restored, it may have an unexpected order position
No user-visible symptom — the data is silently wrong

Fix

Add AND deleted_at IS NULL to the WHERE clause:

UPDATE bills SET snowball_order = ? WHERE id = ? AND user_id = ? AND deleted_at IS NULL

Acceptance Criteria

Soft-deleted bills are excluded from snowball order updates
Restored bills retain their last active order (no stale override)

## Severity: MED 🟡 ## Affected Files - `routes/snowball.js` — line 216 ## Problem The update query in `PATCH /api/snowball/order`: ```sql UPDATE bills SET snowball_order = ? WHERE id = ? AND user_id = ? ``` No `AND deleted_at IS NULL` condition. Soft-deleted bills can have their `snowball_order` mutated even though they don't appear in the snowball list. The data drift is invisible but dirty. ## Impact - Soft-deleted bills retain stale `snowball_order` values that could conflict with active bills - If a bill is restored, it may have an unexpected order position - No user-visible symptom — the data is silently wrong ## Fix Add `AND deleted_at IS NULL` to the WHERE clause: ```sql UPDATE bills SET snowball_order = ? WHERE id = ? AND user_id = ? AND deleted_at IS NULL ``` ## Acceptance Criteria - [ ] Soft-deleted bills are excluded from snowball order updates - [ ] Restored bills retain their last active order (no stale override)