Diagnose Negative Withdrawals and a Shrinking Login Session

An ATM-style frontend allows an invalid negative withdrawal. Its login session also appears to become shorter over time, with timer-related code implicated. Explain how you would investigate and repair both issues. ### Constraints and Clarifications The original code is not supplied, so diagnose candidate causes rather than claiming a specific line is defective. Clarify the withdrawal API's numeric format and the session's idle-versus-absolute timeout policy. Treat interval setup, cleanup, and repeated effects as hypotheses to inspect, not confirmed root causes. ### Part 1 — Withdrawal Validation Prevent negative or otherwise invalid withdrawal amounts from changing an account balance. #### What This Part Should Cover Validate at both the user interface and authoritative backend, parse exact monetary values, and protect the balance update from concurrent requests. ### Part 2 — Session Timing Investigate why the apparent session duration shrinks and design a timer lifecycle consistent with the session policy. #### What This Part Should Cover Check duplicate timers, stale state, cleanup, and the difference between a displayed countdown and server-side session validity. ### What a Strong Answer Covers A reproducible diagnostic plan, concrete chosen fixes, and tests for repeated mounting, invalid inputs, and expiry boundaries. Do not infer a root cause solely from a misspelled timer function name in a report. ### Follow-up Questions - Why is disabling the Withdraw button insufficient protection? - What should happen when a browser tab is throttled or the client clock changes?