Retry mechanism is safe

Network timeouts during payment API calls are a normal operational event, and every retry without an idempotency key is a potential double charge. CWE-605 (multiple binds to the same port) and CWE-841 both describe re-entrancy hazards; in payment systems the re-entrancy produces a duplicate charge that Stripe will honor because each request without an idempotency key is treated as a new, independent charge. A customer who retries a failed payment page reload can be charged multiple times. Idempotency keys that are random UUIDs regenerated on each retry defeat the purpose — the key must be deterministically derived from the booking ID so retries produce the same result.

Pass a deterministic idempotency key tied to the booking ID in every payment API call. Implement this in src/lib/payment-service.ts or your checkout handler.

const paymentIntent = await stripe.paymentIntents.create(
  {
    amount,
    currency: 'usd',
    metadata: { bookingId: booking.id },
  },
  {
    idempotencyKey: `booking-${booking.id}`, // deterministic — same key on retry
  }
);

Also add a processed-event check in your webhook handler to guard against Stripe replaying events.