Transaction atomicity enforced

Booking creation typically writes to multiple tables: the booking record, the slot's capacity counter, a payment reference, and possibly an audit log. Sequential await db.*.create/update calls outside a transaction are not atomic — if any step fails, all previous writes remain committed. CWE-362 and CWE-841 both apply: partial writes leave orphaned booking records with no slot decrement, or a slot marked unavailable with no corresponding booking. These orphaned records accumulate silently and are only discovered when a customer reports a missing booking or a slot appears permanently blocked.

Wrap every multi-table mutation in a single transaction in your booking service (e.g., src/lib/booking-service.ts). All writes succeed together or none does.

await db.$transaction([
  db.booking.create({ data: { ...bookingData, status: 'CONFIRMED' } }),
  db.slot.update({
    where: { id: slotId },
    data: { bookedCount: { increment: 1 } }
  }),
]);