From 40f0a04908f74137915a5a044917d9739decc1f7 Mon Sep 17 00:00:00 2001
From: Claude <claude@webklar.local>
Date: Fri, 2 Oct 2026 03:15:25 +0000
Subject: [PATCH] Gutschriften: Entscheidung und Verrechnung je Antrag gesperrt
 (gleichzeitige Klicks zweier Mitarbeiter)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 server/routes/takeoverCredits.js |  7 ++++---
 test/teamAdminRoutes.test.js     | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/server/routes/takeoverCredits.js b/server/routes/takeoverCredits.js
index 84dfa61..07f4c90 100644
--- a/server/routes/takeoverCredits.js
+++ b/server/routes/takeoverCredits.js
@@ -3,6 +3,7 @@ import { config } from '../config.js'
 import { getSessionCustomerId, requireSession } from '../middleware/session.js'
 import { getDocument, listDocuments, Query } from '../services/appwriteAdmin.js'
 import { signFileLink } from '../services/signedLinks.js'
+import { withLocks } from '../services/keyedLock.js'
 import {
   answerQuestion,
   applyTakeoverCredit,
@@ -214,7 +215,8 @@ takeoverAdminRouter.get('/:id/files/:fileId', async (req, res) => {
 takeoverAdminRouter.post('/:id/decision', async (req, res) => {
   try {
     const admin = { name: req.session.adminName || req.session.name, email: req.session.adminEmail || req.session.email }
-    const result = await decideTakeoverRequest(req.params.id, req.body || {}, admin)
+    // Je Antrag nur eine Entscheidung gleichzeitig: wer zweitens kommt, sieht den neuen Status (409 "bereits entschieden")
+    const result = await withLocks([`takeover:${req.params.id}`], () => decideTakeoverRequest(req.params.id, req.body || {}, admin))
     return res.json({
       success: true,
       status: result.doc.status,
@@ -231,8 +233,7 @@ takeoverAdminRouter.post('/:id/decision', async (req, res) => {
 /** Genehmigte, aber noch nicht verrechnete Gutschrift erneut an Stripe senden. */
 takeoverAdminRouter.post('/:id/apply', async (req, res) => {
   try {
-    const doc = await getTakeoverRequest(req.params.id)
-    const result = await applyTakeoverCredit(doc)
+    const result = await withLocks([`takeover:${req.params.id}`], async () => applyTakeoverCredit(await getTakeoverRequest(req.params.id)))
     return res.json({ success: result.applied, applied: result.applied, reason: result.reason || '' })
   } catch (err) {
     return sendError(res, err, 'Verrechnung fehlgeschlagen')
diff --git a/test/teamAdminRoutes.test.js b/test/teamAdminRoutes.test.js
index 15cf1a2..64c7317 100644
--- a/test/teamAdminRoutes.test.js
+++ b/test/teamAdminRoutes.test.js
@@ -131,3 +131,20 @@ test('Nachweis: signierter Link ohne JWT 200 mit Inhalt, fremder Antrag/abgelauf
   assert.equal(expired.status, 403)
   assert.equal(expired.body.error, 'Link abgelaufen. Bitte den Antrag neu öffnen.')
 })
+
+// Abschlussreview: zwei Mitarbeiter entscheiden im selben Moment -> genau eine Entscheidung, eine Kunden-Mail
+test('gleichzeitige Entscheidungen: eine gewinnt, die andere bekommt 409', async () => {
+  credit('tc7', 'c2', 'offen')
+  const sink = mailSink()
+  setMailTransportForTests(sink)
+  const checks = { recipient: true, service: true, period: true, replaced: true }
+  const figures = { invoiceAmountCents: 12000, billingMonths: 12, paidUntil: '2026-12-31', takeoverFrom: '2026-10-01' }
+  const [a, b] = await Promise.all([
+    post('/api/team/takeover-credits/tc7/decision', { action: 'approve', amountCents: 5000, checks, note: '', ...figures }, staff),
+    post('/api/team/takeover-credits/tc7/decision', { action: 'reject', note: 'Leider nicht moeglich' }, staff),
+  ])
+  assert.deepEqual([a.status, b.status].sort(), [200, 409], JSON.stringify([a.body, b.body]))
+  const loser = a.status === 409 ? a : b
+  assert.equal(loser.body.error, 'Über diesen Antrag wurde bereits entschieden.')
+  assert.equal(sink.sent.length, 1, 'genau eine Kunden-Mail')
+})