Checkout That Cannot Double-Charge
Decide what you would build from the brief alone. Everything below it is available, but the exercise stops working if you open it first.
POST /checkout charges a card and creates an order. Clients retry on timeout. Make it safe.
Making the whole handler a single database transaction, on the reasoning that atomicity prevents duplicates. Under Read Committed, two concurrent requests with the same key can both find no existing record and both proceed; without a unique constraint the transaction serialises nothing relevant. Worse, keeping the transaction open across the provider call holds a pooled connection for the provider's response time, so the fix that was supposed to protect payments becomes the reason the service exhausts its connection pool under load (External Calls Inside a Transaction).