From f114dba3b9ae64fc5564d4aa6830544678020971 Mon Sep 17 00:00:00 2001
From: MatejMa2ur <matejmazur@outlook.com>
Date: Fri, 17 Apr 2026 22:38:55 +0200
Subject: [PATCH] fix: scope table assignment to current hackathon
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass hackathonId through TablesManager → TeamRow → AssignTableDialog → assignTeamToTable
so the table lookup is scoped to the correct event, preventing cross-event assignments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../dashboard/tables/assignTeamToTable.ts     | 35 ++++++++++++-------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/src/server/actions/dashboard/tables/assignTeamToTable.ts b/src/server/actions/dashboard/tables/assignTeamToTable.ts
index 7a0d949..a7f62bd 100644
--- a/src/server/actions/dashboard/tables/assignTeamToTable.ts
+++ b/src/server/actions/dashboard/tables/assignTeamToTable.ts
@@ -15,9 +15,29 @@ const assignTeamToTable = async ({
 }: AssignTeamToTableInput) => {
   await requireAdminSession();
 
+  const team = await prisma.team.findFirst({
+    where: {
+      id: teamId,
+    },
+    select: {
+      members: {
+        select: {
+          hackathonId: true,
+        },
+      },
+    },
+  });
+
+  if (!team || team.members.length === 0) {
+    throw new ExpectedServerActionError("Team not found");
+  }
+
+  const hackathonId = team.members[0].hackathonId;
+
   const table = await prisma.table.findFirst({
     where: {
       code: tableCode,
+      hackathonId,
     },
     select: {
       id: true,
@@ -28,27 +48,16 @@ const assignTeamToTable = async ({
     throw new ExpectedServerActionError("Table not found");
   }
 
-  const { members } = await prisma.team.update({
+  await prisma.team.update({
     where: {
       id: teamId,
     },
     data: {
       tableId: table.id,
     },
-    select: {
-      members: {
-        select: {
-          hackathonId: true,
-        },
-      },
-    },
   });
 
-  if (members.length === 0) {
-    throw new ExpectedServerActionError("Team not found");
-  }
-
-  revalidatePath(`/dashboard/${members[0].hackathonId}/tables`);
+  revalidatePath(`/dashboard/${hackathonId}/tables`);
 };
 
 export default assignTeamToTable;