A few months ago, I fixed a bug on a Friday afternoon. Status filter on a dashboard widget was returning empty results for some users. Found the problem, added one line, tests passed, shipped it. Felt good about it.
The following Tuesday, someone filed another ticket. Different widget, same symptom. I looked at the code and felt that specific kind of embarrassment you get when you realize the answer was right in front of you the whole time.
I hadn't fixed the bug. I fixed one place where the bug lived. The same broken pattern was sitting in three other handlers, and I hadn't thought to check.
What actually happened
The app was a multi-tenant SaaS where users have permissions scoped to specific warehouses. Dashboard widgets query orders, but only the ones the user is allowed to see. Simple enough.
