Validation runs before database writes

Calling OrderSchema.parse(body) after prisma.order.create({ data: body }) already ran is not validation — it's an audit log that arrives after the crime. The bad data is committed to the database whether the parse throws or not. CWE-696 (Incorrect Behavior Order) captures this: the side effect precedes the safety check. An attacker who sends a malformed payload wins regardless of the parse result, because the DB write already succeeded.

Move the parse call to the first statement after req.json(). Validation must throw before any prisma.* call is reachable.

// Bad: write happens before validation
export async function POST(req: Request) {
  const body = await req.json()
  const order = await prisma.order.create({ data: body })  // unvalidated write
  OrderSchema.parse(body)  // too late — commit already happened
  return Response.json(order)
}

// Good: validate first, then write
export async function POST(req: Request) {
  const body = await req.json()
  const data = OrderSchema.parse(body)  // throws before any DB interaction
  const order = await prisma.order.create({ data })
  return Response.json(order)
}