mohd
ef60218c4c
Wrap the overlap query and Booking.objects.create() in a single transaction.atomic() block inside BookingCreateSerializer.create(). Lock the StaffProfile row with select_for_update() so concurrent requests for the same staff slot are serialized at the DB level; only one writer can hold the lock at a time, eliminating the race window between validate() and save(). The early check in validate() is kept for fast user feedback in the common non-concurrent case. The locked re-check in create() is the correctness guarantee. On SQLite (dev/tests) FOR UPDATE is silently ignored but writes are still serialized. PostgreSQL (production) gets row-level locking. Update docs/risks.md to mark the race condition as fixed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend Notes (MVP Readiness)
High-Level Takeaways
- Authentica OTP integration is implemented; Moyasar capture/refund are TODOs.
- External calls (OTP, notifications, payment gateway) run synchronously in request/response paths, increasing latency risk.
- Cross-app coupling (bookings ↔ notifications ↔ accounts/payments) will get harder to evolve without clearer service boundaries.
- Phone-first auth works, but
USERNAME_FIELDis email; align identifier strategy to avoid future auth confusion.
Near-Term Focus
- Hardening Authentica integration (timeouts, retries, async delivery) and aligning notification provider choices.
Authentica E2E Run the real Authentica OTP flow only when explicitly enabled.
Env vars (in backend/.env or shell):
AUTHENTICA_E2E=1AUTHENTICA_API_KEY=...AUTHENTICA_E2E_PHONE=...(must receive OTP)AUTHENTICA_E2E_CODE=...(required; no interactive prompt)
Command:
cd backend
PYTEST_ADDOPTS='' python3 -m pytest apps/accounts/tests -m external
Suggested flow:
- Trigger the E2E test to send the OTP, then set
AUTHENTICA_E2E_CODEand re-run if needed.
- Decide and document payment lifecycle scope (capture/refund supported vs explicitly out of scope).
- Add timeouts/logging for external calls or introduce minimal async jobs for OTP/notifications.
- Keep booking, payment, and notification orchestration in service layers, not views.