Payment and booking coupling

Without bidirectional references between the booking record and the payment provider transaction, any webhook processing failure becomes an irrecoverable data loss: you cannot look up the booking from the payment event, and you cannot look up the payment from the booking record. CWE-706 (use of incorrectly-resolved name or reference) and CWE-841 both apply. This is the root cause of "customer was charged but has no booking" incidents that require manual database forensics: the payment provider has the charge, the application has the booking, but there is no programmatic link between them. Every refund, rebooking, and dispute resolution becomes a manual operation.

Add a paymentIntentId column to the Booking model and pass the booking ID in the payment provider's metadata. Add this in prisma/schema.prisma and your checkout handler.

// schema.prisma
model Booking {
  id              String  @id @default(cuid())
  paymentIntentId String? // Stripe PaymentIntent ID
}

// In checkout handler
const intent = await stripe.paymentIntents.create({
  amount,
  metadata: { bookingId: booking.id }, // payment -> booking
});
await db.booking.update({
  where: { id: booking.id },
  data: { paymentIntentId: intent.id }, // booking -> payment
});