Skip to content

fix(events): prevent duplicate participation in participateEvent#285

Merged
omkarhole merged 1 commit into
omkarhole:mainfrom
anshul23102:fix/issue-278-duplicate-participation
Jun 3, 2026
Merged

fix(events): prevent duplicate participation in participateEvent#285
omkarhole merged 1 commit into
omkarhole:mainfrom
anshul23102:fix/issue-278-duplicate-participation

Conversation

@anshul23102

Copy link
Copy Markdown
Contributor

Related Issue

Closes #278

Problem

participateEvent in eventService.js pushed a commit entry unconditionally:

event.commits.push({ user: userId });
await event.save();

Calling the endpoint multiple times with the same userId and eventId created duplicate entries in event.commits, inflating the displayed participant count for organisers.

Fix

Added an idempotency guard before the push:

const alreadyParticipated = event.commits.some(
  (commit) => commit.user.toString() === userId.toString()
);

if (alreadyParticipated) {
  const error = new Error('User has already participated in this event');
  error.statusCode = 409;
  throw error;
}

The thrown error carries statusCode = 409. The global error handler in error.middleware.js reads err.statusCode (line 22) and forwards it as the HTTP status, so the endpoint returns 409 Conflict on duplicate attempts without any changes to the middleware.

Files Changed

File Change
backend/services/eventService.js Add participation duplicate check before event.commits.push

Testing

  • First RSVP for a given user and event: HTTP 200.
  • Second RSVP with the same user and event: HTTP 409 Conflict.
  • Different user RSVPing for the same event: HTTP 200.

Could you please add appropriate labels to this PR? It would help with tracking. Thank you!

Fixes omkarhole#278

participateEvent pushed a new commit entry unconditionally without
checking whether the user had already participated. Calling the endpoint
multiple times with the same userId and eventId created duplicate entries
in event.commits, inflating the participant count shown to organisers.

Added a check using Array.prototype.some before the push. If the user's
ID is already in event.commits the function throws an error with
statusCode 409, which the global error middleware in
error.middleware.js picks up and returns as HTTP 409 Conflict.
The checkParticipation function was already present in the service for
read-only queries, so no new database round-trip pattern is introduced.
@vercel

vercel Bot commented Jun 2, 2026

Copy link
Copy Markdown

@anshul23102 is attempting to deploy a commit to the omkarhole's projects Team on Vercel.

A member of the Team first needs to authorize it.

@omkarhole omkarhole merged commit ea41848 into omkarhole:main Jun 3, 2026
0 of 2 checks passed
@omkarhole omkarhole added NSOC'26 Issues for the NSOC 2026 program level2 5 points labels Jun 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

level2 5 points NSOC'26 Issues for the NSOC 2026 program

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: participateEvent does not check for duplicate participation, allowing a user to RSVP to the same event multiple times

2 participants