Buffer time between appointments enforced at the data layer

Buffer time enforced only in the UI is not enforced. Any client that posts directly to the booking API — a script, a browser extension, a race condition — bypasses the disabled slots entirely and books into the buffer window. This violates CWE-362 (race condition) and CWE-667 (improper locking), and the ISO 25010 functional-correctness attribute. The practical result: a host has back-to-back appointments with no travel or prep time, they run late, the second client has a bad experience, and a refund is likely. Server-side enforcement is the only enforcement that matters.

Re-validate buffer time inside the booking API route, not just when filtering available slots for display. Define BUFFER_MINUTES as a server-side constant and query for conflicts that include the buffer window before confirming.

// src/app/api/book/route.ts
const BUFFER_MINUTES = 15

export async function POST(req: Request) {
  const { startTime, duration, resourceId } = await req.json()
  const start = new Date(startTime)
  const end = new Date(start.getTime() + duration * 60_000)

  const conflict = await db.bookings.findFirst({
    where: {
      resourceId,
      status: 'confirmed',
      startTime: { lt: new Date(end.getTime() + BUFFER_MINUTES * 60_000) },
      endTime:   { gt: new Date(start.getTime() - BUFFER_MINUTES * 60_000) },
    },
  })

  if (conflict) {
    return Response.json({ error: 'Buffer conflict' }, { status: 409 })
  }
  // ... create booking
}