Variant selection prevents invalid combinations

Without server-side variant combination validation, a customer can construct a POST request to src/app/api/cart/route.ts with any arbitrary size and color values — including combinations that have no matching variant in the database. The cart then references a phantom record, checkout fails at payment time (or succeeds and fulfillment finds nothing to ship), and the error appears only after the customer has already paid. OWASP A03 (Injection) covers this class of untrusted input: the server must not act on client-supplied option values without confirming they map to a real record. Client-side filtering alone can be bypassed with curl in under ten seconds.

Add a database lookup in src/app/api/cart/route.ts that confirms the selected variant combination exists before the item is added to the cart — client-side filtering alone is not sufficient.

const variant = await prisma.productVariant.findFirst({
  where: { productId, size, color },
})
if (!variant) {
  return Response.json({ error: 'Invalid variant combination' }, { status: 400 })
}

Also validate in any server action that handles add-to-cart. Do not rely on <select> options being present in the client form — the request can be crafted independently of the UI.