Overbooking prevention logic

Group-capacity slots — classes, workshops, shared resources — require a count-against-capacity check, not just a slot-existence check. Without it, 30 attendees can book a room with a capacity of 10, because the system only asked "is the slot taken?" rather than "is the slot full?". OWASP A04 (Insecure Design) applies: the domain model includes a capacity constraint that the server never enforces. Overbooking forces refunds, damages customer trust, and requires manual communication with every affected attendee when the overbooking is discovered.

Compare the live booking count against slot.maxCapacity in your server-side availability check (e.g., src/lib/booking-service.ts). This must run server-side on every booking creation path.

const currentCount = await db.booking.count({
  where: { slotId: requestedSlotId, status: { not: 'CANCELLED' } }
});

const slot = await db.slot.findUniqueOrThrow({ where: { id: requestedSlotId } });
if (currentCount >= slot.maxCapacity) {
  throw new CapacityError('Slot is at capacity');
}