Availability is checked before creation

Without a server-side availability check before insertion, two users submitting the booking form within milliseconds of each other will both receive success responses for the same slot. Frontend availability guards are client-controlled and can be bypassed entirely with a direct API call. OWASP A04 (Insecure Design) classifies trusting client-side state for server decisions as a structural flaw. A double-booked appointment slot means one customer shows up to find their slot occupied — a support and refund incident that a single server-side query would have prevented entirely.

Add the availability query in your booking API handler or service layer (e.g., src/app/api/bookings/route.ts) before the insert, not in a React component.

// Server-side only — never trust the client's slot state
const conflict = await db.booking.findFirst({
  where: {
    slotId: requestedSlotId,
    status: { not: 'CANCELLED' }
  }
});
if (conflict) throw new ConflictError('Slot unavailable');

const booking = await db.booking.create({ data: { ...bookingData } });