[BUG] Deadline conflict detection runs client-side only, allowing the server API to accept overlapping task deadlines without validation

[anshul23102]

Problem

The frontend JavaScript detects and warns about overlapping or conflicting task deadlines before the user submits a new task. However, the server-side API endpoint that creates tasks performs no equivalent validation. A user who bypasses the UI (by sending a direct POST request, using browser DevTools, or disabling JavaScript) can insert tasks with deadlines that conflict with existing ones. The conflict detection is therefore purely cosmetic and does not protect data integrity.

Steps to Reproduce

curl -X POST http://localhost:3000/api/tasks \
  -H 'Content-Type: application/json' \
  -d '{"title":"Math exam","deadline":"2026-07-15T09:00","duration":120}'
curl -X POST http://localhost:3000/api/tasks \
  -H 'Content-Type: application/json' \
  -d '{"title":"Physics exam","deadline":"2026-07-15T09:00","duration":120}'

Both tasks are created with identical deadlines, bypassing client-side conflict checks.

Proposed Fix

Add server-side overlap detection before inserting a new task:

const conflicting = await db.get(
  `SELECT id FROM tasks WHERE user_id = ? AND deadline BETWEEN ? AND ?`,
  [userId, windowStart, windowEnd]
);
if (conflicting) {
  return res.status(409).json({ error: "A task already exists in this time window." });
}

Complexity: Level 2 | Program: GSSOC '26

[anshul23102]

/assign

Claiming this issue for GSSoC '26. Please assign it to me, I'll start working on it right away.

[aaniya22]

pls assign this to me under gssoc

[anshul23102]

@Charushi06 This deadline conflict detection needs server-side validation. I can implement proper validation logic to prevent overlapping deadlines.

/assign @anshul23102
/claim

[anshul23102]

Hi @Charushi06, I'd like to work on this. Plan: move deadline conflict detection into the server API validation path (not just client-side) so overlapping task deadlines are rejected server-side too. Requesting assignment under GSSoC 2026.

/assign
/claim