Availability re-checked before commit

In flows where availability is checked when the user loads the booking form and the final insert happens minutes later at payment time, the check and the commit are separated by an unbounded time window. CWE-367 (TOCTOU race condition) names this exact pattern: the condition checked and the action taken are not atomic. A second user who books the same slot during the payment flow will not be detected until the UNIQUE constraint fires — and by then the first user has already been charged or committed their card details. Re-checking inside the transaction collapses the window to zero.

Move the availability query inside the same transaction block as the insert, in your booking creation handler (e.g., src/app/api/bookings/route.ts or src/lib/booking-service.ts).

await db.$transaction(async (tx) => {
  // recheck — inside the transaction, atomic with the insert
  const conflict = await tx.booking.findFirst({
    where: { slotId, startTime, status: { not: 'CANCELLED' } }
  });
  if (conflict) throw new ConflictError('Slot taken');

  await tx.booking.create({ data: { slotId, startTime, ...rest } });
});