- Add environment-aware CORS and secure cookie support:
* Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
* Integrate @elysiajs/cors with credentials and origin configuration
* Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
* Ensures diagnosis status update and review insert succeed together
* Rolls back both operations if either fails
* Preserves behavior: only update if status is needs_review, return badRequest if no row updated
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
In POST /reviews/:diagnosisId, perform the conditional diagnoses update
first with .returning() to determine whether a row was updated. The update
WHERE includes both id and status 'needs_review'. If no row is returned,
return badRequest and do not insert an expert review. Only after a
successful update insert expertReviews. This prevents concurrent reviewers
from both inserting review rows when only one update should win.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Reject diagnoses not in needs_review status with badRequest
- Make update conditional on both id and status needs_review using and()
- Simplify isDiagnosisRecordOrNull type guard with type alias
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
