Bernard Ariku Oko

Problems solved

• Two-factor auth was decorative. Login checked password only — TOTP setup, backup codes, and the settings UI all existed, but the login handler never checked two_factor_enabled, so any account "with 2FA on" was still fully accessible with just a password. Fixed with a short-lived pending-2FA token: login withholds the real session until a valid code is verified, and middleware explicitly rejects the pending token on every protected route.
• A practice could end another practice's telehealth session. The end-telehealth-session endpoint trusted a client-supplied practice ID instead of the authenticated one, so any logged-in staff member could end another practice's live session by supplying that practice's ID. Fixed by always scoping the action to the authenticated practice.
• The calendar said "success" when it wasn't. Drag-and-drop reschedule, resize, and status changes on the appointment calendar fired a success toast before the API call resolved — so a rejected update (e.g. a double-booking conflict) still showed "success" while the appointment stayed visually stuck in the rejected slot. Fixed by letting the mutation's own result drive the toast and reverting the drag on failure.
• Bulk reschedule could silently double-book. Every appointment-time-change endpoint guarded against double-booking except bulk reschedule, which could shift up to 200 appointments with no overlap check. Added the same advisory-lock-plus-overlap-count guard used elsewhere, with a regression test that fails pre-fix by double-booking a practitioner on purpose.
• Two records could both be "the default". A recurring bug pattern across billing lists, intake templates, note templates, and form builders: creating a new default record didn't clear the previous one, so two rows could both report is_default. Standardized every affected endpoint on a clear-then-set pattern under an advisory lock, with a test per fix confirming exactly one default survives.