Gutschriften: Entscheidung und Verrechnung je Antrag gesperrt (gleichzeitige Klicks zweier Mitarbeiter)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/takeoverCredits.js

@@ -3,6 +3,7 @@ import { config } from '../config.js'
 import { getSessionCustomerId, requireSession } from '../middleware/session.js'
 import { getDocument, listDocuments, Query } from '../services/appwriteAdmin.js'
 import { signFileLink } from '../services/signedLinks.js'
+import { withLocks } from '../services/keyedLock.js'
 import {
   answerQuestion,
   applyTakeoverCredit,
@@ -214,7 +215,8 @@ takeoverAdminRouter.get('/:id/files/:fileId', async (req, res) => {
 takeoverAdminRouter.post('/:id/decision', async (req, res) => {
   try {
     const admin = { name: req.session.adminName || req.session.name, email: req.session.adminEmail || req.session.email }
-    const result = await decideTakeoverRequest(req.params.id, req.body || {}, admin)
+    // Je Antrag nur eine Entscheidung gleichzeitig: wer zweitens kommt, sieht den neuen Status (409 "bereits entschieden")
+    const result = await withLocks([`takeover:${req.params.id}`], () => decideTakeoverRequest(req.params.id, req.body || {}, admin))
     return res.json({
       success: true,
       status: result.doc.status,
@@ -231,8 +233,7 @@ takeoverAdminRouter.post('/:id/decision', async (req, res) => {
 /** Genehmigte, aber noch nicht verrechnete Gutschrift erneut an Stripe senden. */
 takeoverAdminRouter.post('/:id/apply', async (req, res) => {
   try {
-    const doc = await getTakeoverRequest(req.params.id)
-    const result = await applyTakeoverCredit(doc)
+    const result = await withLocks([`takeover:${req.params.id}`], async () => applyTakeoverCredit(await getTakeoverRequest(req.params.id)))
     return res.json({ success: result.applied, applied: result.applied, reason: result.reason || '' })
   } catch (err) {
     return sendError(res, err, 'Verrechnung fehlgeschlagen')