Race condition in coupon application yields $0 checkout totals

description

The checkout completion handler reads the cart total, applies the coupon, deducts inventory, and charges payment as separate non-atomic operations. Issuing multiple concurrent POSTs to /api/checkout/complete with the same cart and coupon causes coupon application to fire more than once per cart. With a 50% off coupon and three concurrent requests, the running total is reduced to a negative value, which is clamped to $0. The order is created, inventory is deducted, and the user is charged nothing.

evidence

POST /api/checkout/complete HTTP/1.1
Host: acme.dev
Authorization: Bearer <session-token>
Content-Type: application/json

{"cart_id":"cart_88a2","coupon":"SAVE50"}

(repeated 5x concurrently)

HTTP/1.1 200 OK
Content-Type: application/json

{
  "order_id": "ord_8821",
  "total": "$0.00",
  "items": [{"sku":"plan_pro","qty":1}],
  "charged": "$0.00"
}

reproduction steps

1. Add items to the cart totaling more than $50.
2. Apply coupon SAVE50 (50% off, single-use intended).
3. Issue 5 concurrent POSTs to /api/checkout/complete with the same cart_id.
4. Observe that one or more orders are created with $0 totals.

remediation

BEGIN;
SELECT * FROM carts WHERE id = $1 FOR UPDATE;
INSERT INTO coupon_uses (cart_id, code) VALUES ($1, $2)
  ON CONFLICT (cart_id, code) DO NOTHING;  -- a second concurrent apply is a no-op
-- recompute total, charge the processor, then:
COMMIT;