fix: wrap card delete in transaction with count guard and default promotion (#372)

Closes #328

- Enforce minimum-one-card invariant: reject DELETE with 400 when the
  user has only one card remaining
- Promote the next oldest card to default atomically if the deleted
  card was the default
- Wrap count check, optional default promotion, and delete in a single
  Prisma transaction so concurrent requests cannot race past the guard

Author: anshul23102

apps/backend/src/routes/cards.ts

@@ -230,40 +230,40 @@ export async function cardRoutes(app: FastifyInstance): Promise<void> {
     const { id } = request.params;
 
     try {
-      const existing = await app.prisma.card.findFirst({
-        where: { id, userId },
-      });
-
-      if (!existing) {
-        reply.status(404).send({ error: 'Card not found' });
-        return;
-      }
+      await app.prisma.$transaction(async (tx: Prisma.TransactionClient) => {
+        const existing = await tx.card.findFirst({ where: { id, userId } });
 
-      // Prevent deleting the last card — every user must retain at least one.
-      const userCardCount = await app.prisma.card.count({ where: { userId } });
-      if (userCardCount <= 1) {
-        reply.status(400).send({ error: 'Cannot delete the last remaining card. A user must have at least one card.' });
-        return;
-      }
+        if (!existing) {
+          reply.status(404).send({ error: 'Card not found' });
+          return;
+        }
 
-      // If the card being deleted is the default, promote the next-oldest card
-      // before deletion so the user always has an active default.
-      if (existing.isDefault) {
-        const oldestRemainingCard = await app.prisma.card.findFirst({
-          where: { userId, id: { not: id } },
-          orderBy: { createdAt: 'asc' },
-        });
+        // Prevent deleting the last card — every user must retain at least one.
+        const userCardCount = await tx.card.count({ where: { userId } });
+        if (userCardCount <= 1) {
+          reply.status(400).send({ error: 'Cannot delete the last remaining card. A user must have at least one card.' });
+          return;
+        }
 
-        if (oldestRemainingCard) {
-          await app.prisma.card.update({
-            where: { id: oldestRemainingCard.id },
-            data: { isDefault: true },
+        // If the card being deleted is the default, promote the next-oldest card
+        // before deletion so the user always has an active default.
+        if (existing.isDefault) {
+          const oldestRemainingCard = await tx.card.findFirst({
+            where: { userId, id: { not: id } },
+            orderBy: { createdAt: 'asc' },
           });
+
+          if (oldestRemainingCard) {
+            await tx.card.update({
+              where: { id: oldestRemainingCard.id },
+              data: { isDefault: true },
+            });
+          }
         }
-      }
 
-      await app.prisma.card.delete({ where: { id } });
-      reply.status(204).send();
+        await tx.card.delete({ where: { id } });
+        reply.status(204).send();
+      });
     } catch (error) {
       return handleDbError(error, request, reply);
     }