Summary of What Needs to be Done
POST /api/interview-experiences deduplicates submissions by idempotencyKey alone, with no scope to the submitting user or client key. Anyone who re-uses a key gets the first submitter's entire submission back.
Changes that Need to be Made
- In
backend/controllers/interviewExperienceController.js, change the dedup lookup (line 73) to scope on (idempotencyKey, userId) for authenticated users and (idempotencyKey, clientKey) for anonymous users.
- Update the partial unique index in
backend/models/InterviewExperience.js to be a compound index: { idempotencyKey: 1, userId: 1 } with a second partial index { idempotencyKey: 1, clientKey: 1 }.
Impact that it would Provide
Prevents one user from accidentally (or intentionally) retrieving another user's full interview submission by re-using the same idempotency key. Ensures proper per-user dedup isolation.
Note: Please assign this issue to the tmdeveloper007 account.
Summary of What Needs to be Done
POST /api/interview-experiencesdeduplicates submissions byidempotencyKeyalone, with no scope to the submitting user or client key. Anyone who re-uses a key gets the first submitter's entire submission back.Changes that Need to be Made
backend/controllers/interviewExperienceController.js, change the dedup lookup (line 73) to scope on(idempotencyKey, userId)for authenticated users and(idempotencyKey, clientKey)for anonymous users.backend/models/InterviewExperience.jsto be a compound index:{ idempotencyKey: 1, userId: 1 }with a second partial index{ idempotencyKey: 1, clientKey: 1 }.Impact that it would Provide
Prevents one user from accidentally (or intentionally) retrieving another user's full interview submission by re-using the same idempotency key. Ensures proper per-user dedup isolation.
Note: Please assign this issue to the
tmdeveloper007account.