# Booking App Database Checklist

Generic review aid. Adapt it to the domain; it is not a security audit or certification.

## Integrity and ownership
- [ ] Foreign keys exist for tenant, location, service, staff/resource, customer, and appointment relationships.
- [ ] Child rows cannot reference parents in another tenant.
- [ ] Unique constraints match real business keys and include tenant scope where needed.
- [ ] Check constraints reject invalid durations and start/end ordering.
- [ ] Delete behavior is explicit: restrict, cascade, anonymize, or retain.

## Scheduling and lifecycle
- [ ] Appointment instants use a consistent representation; recurring schedules retain an IANA time-zone identifier.
- [ ] Daylight-saving gaps and repeated local times have defined behavior.
- [ ] Capacity-consuming statuses and legal transitions are documented.
- [ ] Variable-length overlap conflicts are protected at the database/write boundary.
- [ ] Rescheduling and concurrent confirmations are atomic or conflict-safe.

## Security and operations
- [ ] Tenant separation is enforced in trusted server code and database policies/RLS.
- [ ] Privileged credentials never reach browser bundles or logs.
- [ ] Soft deletion, restoration, retention, and audit fields are defined.
- [ ] Audit events record only necessary actor/time/reason information.
- [ ] Indexes match actual tenant, resource, status, and time-window query patterns.
- [ ] Query plans and representative data volumes are reviewed.
- [ ] Migrations, rollback, backups, restore, and data export are tested.

## Test cases
- [ ] Cross-tenant reads/writes are rejected.
- [ ] Adjacent appointments and configured buffers behave as intended.
- [ ] Two simultaneous requests cannot reserve the same constrained capacity.
- [ ] Cancelled/expired holds release capacity according to policy.
- [ ] Duplicate retries do not create duplicate reservations or notifications.