fix: scope visitor lookup by teamId to prevent cross-team mismatches

[tataihono]

Summary

• validateBlockEvent and getByUserIdAndJourneyId in api-journeys-modern were querying visitors by userId alone (findFirst({ where: { userId } })), without filtering by teamId
• When a user had visitor records across multiple teams, this could return a visitor from the wrong team (e.g. jfp-team instead of the journey's actual team)
• This caused duplicate JourneyVisitor records linking the wrong visitor to a journey, and incorrect event attribution
• Fix: add teamId: journey.teamId to both findFirst queries so visitors are always scoped to the correct team

Context

Riah reported duplicate visitor records appearing mid-session. Investigation showed the same journey (e3cffd88-...) had two JourneyVisitor records pointing to visitors on different teams — one on the correct team (d0a8d4bb-...) and one on jfp-team. The root cause was the unscoped findFirst returning whichever visitor Postgres found first, regardless of team.

Test plan

• Updated validateBlockEvent tests to assert teamId is included in visitor query
• Updated getByUserIdAndJourneyId tests to mock journey lookup and assert team-scoped query
• Added test for getByUserIdAndJourneyId returning null when journey doesn't exist
• Verify on stage: visiting a journey creates visitor on the correct team only
• Verify on stage: mid-session actions don't create duplicate visitors across teams

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Enhanced visitor data access control to ensure lookups are properly scoped to the appropriate team, preventing unintended cross-team data visibility and improving overall system security.

• Tests

  • Expanded test coverage for visitor lookup and journey validation to include additional edge cases and ensure consistent query behavior across different scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3cb8af44-649d-4518-93d4-3e99bbc69e68

📥 Commits

Reviewing files that changed from the base of the PR and between 2c89df8 and 36ec134.

📒 Files selected for processing (2)

• apis/api-journeys-modern/src/schema/event/utils.spec.ts
• apis/api-journeys-modern/src/schema/event/utils.ts

---

Walkthrough

Visitor lookup logic has been updated to scope queries by team ID. The validateBlockEvent and getByUserIdAndJourneyId functions now query visitors with both userId and teamId parameters. Tests are updated to verify the new query parameters and cover the case where the journey does not exist.

Changes

Cohort / File(s)	Summary
Implementation apis/api-journeys-modern/src/schema/event/utils.ts	Updated visitor lookup to fetch journey's teamId and scope prisma.visitor.findFirst queries to include teamId alongside userId. Added journey existence check returning null if not found.
Test Coverage apis/api-journeys-modern/src/schema/event/utils.spec.ts	Expanded test assertions to verify prismaMock.visitor.findFirst is called with both userId and teamId parameters. Updated mocks to include journey.teamId and added test case for non-existent journey scenario.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly summarizes the main change: scoping visitor lookup by teamId to prevent cross-team mismatches, which matches the core fix described in the PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 25-03-TN-fix-visitor-lookup-team-scope

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 36ec134

Command	Status	Duration	Result
nx affected --target=subgraph-check --base=2c89...	✅ Succeeded	1s	View ↗
nx affected --target=extract-translations --bas...	✅ Succeeded	<1s	View ↗
nx affected --target=lint --base=2c89df8a492c7f...	✅ Succeeded	20s	View ↗
nx affected --target=type-check --base=2c89df8a...	✅ Succeeded	17s	View ↗
nx run-many --target=codegen --all --parallel=3	✅ Succeeded	2s	View ↗
nx run-many --target=prisma-generate --all --pa...	✅ Succeeded	3s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-03-24 03:14:33 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 36ec134

---

☁️ Nx Cloud last updated this comment at 2026-03-24 03:12:16 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 36ec134

Command	Status	Duration	Result
nx run-many --target=codegen --all --parallel=3	✅ Succeeded	2s	View ↗
nx run-many --target=prisma-generate --all --pa...	✅ Succeeded	3s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-03-24 03:12:45 UTC

[stage-branch-merger]

I see you added the "on stage" label, I'll get this merged to the stage branch!

[stage-branch-merger]

Merge conflict attempting to merge this into stage. Please fix manually.