fix: prevent duplicate expert reviews

In POST /reviews/:diagnosisId, perform the conditional diagnoses update
first with .returning() to determine whether a row was updated. The update
WHERE includes both id and status 'needs_review'. If no row is returned,
return badRequest and do not insert an expert review. Only after a
successful update insert expertReviews. This prevents concurrent reviewers
from both inserting review rows when only one update should win.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/routes/expert.ts

@@ -64,10 +64,25 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
 
       const diagnosis = existing[0];
       if (!diagnosis) return notFound('Diagnosis not found');
-      if (diagnosis.status !== 'needs_review') return badRequest('Diagnosis is not pending review');
 
       const correctedSlug = req.verdict === 'corrected' ? req.correctedDiseaseSlug : null;
 
+      // Perform conditional update first to determine if this review should proceed
+      const updated = await db
+        .update(diagnoses)
+        .set({
+          status: req.verdict === 'corrected' ? 'expert_corrected' : 'expert_verified',
+          predictedDiseaseSlug: req.verdict === 'corrected' ? correctedSlug : diagnosis.predictedDiseaseSlug,
+          updatedAt: new Date(),
+        })
+        .where(and(eq(diagnoses.id, diagnosis.id), eq(diagnoses.status, 'needs_review')))
+        .returning();
+
+      if (updated.length === 0) {
+        return badRequest('Diagnosis is not pending review');
+      }
+
+      // Only insert expert review after successful update
       await db.insert(expertReviews).values({
         diagnosisId: diagnosis.id,
         expertId: user.id,
@@ -76,15 +91,6 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
         notes,
       });
 
-      await db
-        .update(diagnoses)
-        .set({
-          status: req.verdict === 'corrected' ? 'expert_corrected' : 'expert_verified',
-          predictedDiseaseSlug: req.verdict === 'corrected' ? correctedSlug : diagnosis.predictedDiseaseSlug,
-          updatedAt: new Date(),
-        })
-        .where(and(eq(diagnoses.id, diagnosis.id), eq(diagnoses.status, 'needs_review')));
-
       return await loadDiagnosisRecord(diagnosis.id, null, true);
     } catch (error) {
       return serviceUnavailable('Database unavailable');