Review submission prevents duplicate submissions from same user per product

Without a unique constraint on (user_id, product_id), a single user can flood your product with five-star reviews — or a malicious competitor can script hundreds of one-star submissions. CWE-799 (Improper Control of Interaction Frequency) names this exact failure. Beyond rating manipulation, duplicate reviews distort your aggregate score fed to schema.org AggregateRating, poisoning the star display that Google indexes. The fix is two-layer: a database constraint that survives any future code path, plus an application-level check that returns a user-facing error immediately.

Add a unique constraint in prisma/schema.prisma (or a raw SQL migration) and guard the insert in api/reviews/submit.

-- Migration: enforce one review per user per product
ALTER TABLE reviews
  ADD CONSTRAINT unique_user_product UNIQUE (user_id, product_id);

// api/reviews/submit
const existing = await db.reviews.findFirst({
  where: { user_id: userId, product_id: productId }
})
if (existing) {
  return Response.json({ error: 'You have already reviewed this product' }, { status: 409 })
}

The database constraint is the hard stop; the application check is the early exit that returns a readable error instead of a constraint violation.