Product IDs are unique and consistent

Without a database-level primary key uniqueness constraint, two concurrent product creation requests can produce duplicate IDs — a race condition that corrupts order references, inventory lookups, and analytics joins. Application-level uniqueness checks (checking whether a record exists before inserting) cannot close this window: two simultaneous requests both read zero rows, both proceed to insert, and both succeed. CWE-694 (Use of Multiple Resources with Duplicate Identifier) and ISO 25010:2011 functional-correctness both flag this: duplicate product IDs cause order-to-product joins to return wrong results, cascade deletes to hit unintended rows, and audit logs to become unreliable.

Add a primary key with a database-enforced uniqueness constraint in prisma/schema.prisma. Use @id @default(cuid()) so the ID is generated server-side with collision resistance, not assembled from user input.

model Product {
  id String @id @default(cuid())
  // other fields
}

For SQL migrations, enforce at the DDL level:

CREATE TABLE products (
  id VARCHAR(36) PRIMARY KEY,
  name VARCHAR(255) NOT NULL
);

Remove any application-level if (!existingProduct) guards that attempt to substitute for a real constraint — they don't work under concurrent load.