The Reopened Loan
An equipment request can appear approved after its borrower has cancelled it. Borrowers have also reported seeing or changing requests that belong to someone else, even though the account switcher shows their own identity.
The bug report
You get the whole project — a React front end, an Express API, and Mongoose models — opened in a browser editor. Reproduce the symptom by reading the code, change what’s wrong, and run the hidden tests to prove it.
What the fix must prove
- creates a borrower-owned request and reads back its saved fields
- cancels a pending owned request and persists cancellation
- approves a pending request using the reviewer identity
- rejects stale approval of a cancelled request without changing stored state
- rejects another borrower's reads and mutations
- rejects invalid creation input without inserting records
- rejects unauthenticated requests without changing records
- rejects borrower attempts to invoke reviewer-only actions
Related challenges
- The Missing Name — api contract bug, beginner
- The Ghost Update — async / race condition, intermediate
- The Silent Field — database / schema bug, beginner