Cancellation state machine

Cancellation that only updates a status string without releasing slot capacity leaves the system in a permanently inconsistent state: the booking is logically gone, but the slot's capacity counter still reflects it as active. Every subsequent availability query will report the slot as booked when it is not, blocking new reservations for capacity that has been freed. CWE-841 (improper enforcement of behavioral workflow) applies — the cancellation workflow must atomically reverse all side-effects of booking creation: status change, capacity release, and refund trigger if paid. A double-cancellation guard is equally necessary to prevent a second cancel from decrementing capacity below zero.

Implement cancellation as an atomic transaction that updates both the booking status and the slot's capacity counter. Add this in your cancel handler (e.g., src/app/api/bookings/[id]/cancel/route.ts or src/lib/booking-service.ts).

export async function cancelBooking(bookingId: string) {
  const booking = await db.booking.findUniqueOrThrow({ where: { id: bookingId } });
  if (booking.status === 'CANCELLED') throw new Error('Already cancelled');

  await db.$transaction([
    db.booking.update({
      where: { id: bookingId },
      data: { status: 'CANCELLED', cancelledAt: new Date() }
    }),
    db.slot.update({
      where: { id: booking.slotId },
      data: { bookedCount: { decrement: 1 } }
    }),
  ]);
}