Phase 4

Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres.
14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing.
Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically.
Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds):
A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own).
A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice.
A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3.
Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled.
Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.

src/features/booking/actions/confirm.ts

@@ -0,0 +1,68 @@
+"use server";
+
+import { redirect } from "next/navigation";
+import { auth } from "@/auth";
+import { clearDraft, readDraft, writeLastBookingReference } from "@/lib/booking-draft/cookie";
+import { prisma } from "@/lib/db/prisma";
+import { resolveCustomerForBooking } from "@/services/customer/customer.service";
+import { createBooking } from "@/services/scheduling/booking.service";
+import { getFirstFriendlyMessage } from "../error-messages";
+
+export interface ConfirmBookingResult {
+  success: boolean;
+  error?: string;
+}
+
+/**
+ * The only action that actually creates an appointment. Resolves *which*
+ * customer this is via CustomerService (never trusts a client-supplied
+ * customerId — see docs/phase-4-summary.md, "Security"), then hands off
+ * entirely to BookingService.createBooking, which re-validates the slot
+ * inside a transaction before committing — this action does not decide
+ * whether the slot is actually available.
+ */
+export async function confirmBookingAction(businessId: string): Promise<ConfirmBookingResult> {
+  const draft = await readDraft(businessId);
+
+  if (draft.serviceIds.length === 0 || !draft.startAt) {
+    return { success: false, error: "Your booking details are incomplete — please start again." };
+  }
+  if (!draft.policyAcknowledged) {
+    return { success: false, error: "Please acknowledge the cancellation policy to continue." };
+  }
+
+  const session = await auth();
+
+  let customerId: string;
+  try {
+    if (session?.user?.id) {
+      const resolved = await resolveCustomerForBooking(prisma, { businessId, userId: session.user.id });
+      customerId = resolved.customerId;
+    } else {
+      if (!draft.guest) {
+        return { success: false, error: "Please provide your contact details first." };
+      }
+      const resolved = await resolveCustomerForBooking(prisma, { businessId, guest: draft.guest });
+      customerId = resolved.customerId;
+    }
+  } catch {
+    return { success: false, error: "We couldn't confirm your details. Please try again." };
+  }
+
+  const result = await createBooking(prisma, {
+    businessId,
+    customerId,
+    serviceIds: draft.serviceIds,
+    staffId: draft.staffId,
+    startAt: new Date(draft.startAt),
+    notes: draft.notes,
+  });
+
+  if (!result.success) {
+    return { success: false, error: getFirstFriendlyMessage(result.validation) };
+  }
+
+  await writeLastBookingReference(result.appointment.id);
+  await clearDraft();
+  redirect("/book/confirmation");
+}