fix(cards): prevent concurrent deletions from removing all user cards

[Ridanshi]

Summary

Fixes a transactional race condition in card deletion that could allow concurrent requests to remove all cards belonging to a user despite intended last-card protection.

Root Cause

The delete flow previously executed:

1. ownership lookup
2. card count validation
3. delete operation

as separate non-transactional database operations.

Under concurrent requests, multiple deletes could simultaneously observe the same card count and proceed, resulting in users ending up with zero cards.

Fix

Moved the deletion guard and delete flow into a single Prisma $transaction using Serializable isolation.

The transaction now atomically performs:

• card ownership validation
• last-card protection
• default-card promotion
• delete operation

This guarantees that concurrent delete requests cannot violate the invariant that a user must always retain at least one card.

Concurrency Behavior

Before:

• two concurrent deletes against 2 cards could both succeed
• final state could become 0 cards

After:

• only one delete can succeed
• competing transaction safely aborts
• user always retains at least one card

Tests Added

Added focused regression coverage for:

• successful delete flow
• default-card promotion
• last-card protection
• concurrent deletion scenarios
• transactional invariant preservation
• failure handling

Files Changed

• apps/backend/src/routes/cards.ts
• apps/backend/src/__tests__/cards.test.ts

Closes #356

[Harxhit]

@Ridanshi Fix merge conflicts and please add terminal screen short proof for unit tests.

[Ridanshi]

Conflicts resolved and branch updated.

Resolution summary:

• Kept upstream's cardService-based delete flow after the refactor.
• Applied the Serializable transaction isolation fix in cardService.deleteCard(), which is now the authoritative deletion path.
• Removed obsolete route-level transaction logic and unused imports.

Unit tests rerun successfully:

npx vitest run src/tests/cards.test.ts --reporter=verbose

Result:
✓ 25/25 tests passed

This includes the concurrency regression coverage added in this PR:

• runs the count check and deletion inside a single transaction
• blocks a concurrent request whose transaction-internal count reflects a prior committed delete
• allows exactly one of two racing deletes to succeed
• user always retains at least one card regardless of which concurrent request wins

Terminal proof attached.

[Ridanshi]

Hi, could someone please review this PR when convenient? I've completed the implementation and tested it locally. Happy to make any required changes. Thanks!

[Harxhit]

Please address lint errors.

[vercel]

@Ridanshi is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

CI — All Checks Passed

Backend — PASS

Check	Result
Lint	PASS
Test	PASS
Typecheck	PASS

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — SKIP

Check	Result
Check	-
Build	-

---

Last updated: Mon, 08 Jun 2026 15:53:43 GMT

[Ridanshi]

I've addressed the lint issues and pushed the fixes. All backend checks are now passing. Could you please re-review the PR?

[Harxhit]

It looks like this PR still uses the previous PNPM workspace configuration. The repository has been migrated to NPM workspaces, so the dependency configuration should be updated accordingly before this can be merged.