fix: Do not allow users to resume submitted or deleted sessions (#3828)

theopensystemslab · Oct 21, 2024 · f5cea21 · f5cea21
1 parent 6bee885
commit f5cea21
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/api.planx.uk/modules/saveAndReturn/service/validateSession.ts b/api.planx.uk/modules/saveAndReturn/service/validateSession.ts
@@ -197,7 +197,12 @@ export async function findSession({
     gql`
       query FindSession($sessionId: uuid!, $email: String!) {
         sessions: lowcal_sessions(
-          where: { id: { _eq: $sessionId }, email: { _eq: $email } }
+          where: {
+            id: { _eq: $sessionId }
+            email: { _eq: $email }
+            submitted_at: { _is_null: true }
+            deleted_at: { _is_null: true }
+          }
           limit: 1
         ) {
           flow_id