Generate candidate slots by intersecting business hours, staff eligibility, service duration, time off, existing reservations, time zone rules, and any before/after buffers. On confirmation, let the database arbitrate concurrent writes. For variable-length appointments, a PostgreSQL GiST exclusion constraint can reject overlapping effective ranges for the same staff member:

CREATE EXTENSION IF NOT EXISTS btree_gist;

ALTER TABLE appointments
  ADD CONSTRAINT no_overlapping_active_staff_appointments
  EXCLUDE USING gist (
    staff_id WITH =,
    tstzrange(effective_starts_at, effective_ends_at, '[)') WITH &&
  )
  WHERE (status NOT IN (
    'CANCELLED_BY_CLIENT',
    'CANCELLED_BY_ADMIN',
    'RESCHEDULED'
  ));

This is an illustrative single-staff pattern, not a drop-in migration. The range uses [) so a booking ending at 10:00 can be followed by one starting at 10:00. Store buffer-adjusted effective times when setup or cleanup also consumes capacity. Adjust the status predicate to your actual lifecycle; temporary holds need an expiry policy.

When the constraint rejects a collision, PostgreSQL reports SQLSTATE 23P01. Catch that at the server boundary, respond with a conflict such as HTTP 409, and refresh the available slots. The earlier calendar query cannot prevent two requests from racing.

Idempotency is a separate guarantee. Use a scoped request key and enforce its uniqueness in the database if simultaneous retries must resolve to one booking. A read-before-insert check backed only by a non-unique index speeds lookup but does not prevent duplicates.

Test the real database boundary: submit the same slot concurrently and assert that exactly one reservation succeeds; verify adjacent intervals are accepted; verify buffers and consuming statuses block overlaps; verify cancelled states release capacity; then retry the same idempotency key concurrently. An in-memory simulation can check interval arithmetic, but it cannot prove PostgreSQL constraint behavior.

The BDS v1.0.3 source package includes a PostgreSQL overlap constraint, an atomic booking RPC, and a database uniqueness constraint for its idempotency key. Its included test coverage also uses in-memory simulations; those do not replace executing the migrations and concurrency checks against PostgreSQL. Buyers configure and deploy their own copy; the ZENO demo is fictional and is not included. Review the delivered schema, test coverage, requirements, and chosen marketplace license before using any source package in a project.

Product scope and marketplace offers: https://beyond-ds.net/en/software/appointment-booking
ZENO demo: https://zeno.beyond-ds.net

Disclosure: I am part of Beyond Digital Solutions, which makes the source package mentioned above. No affiliate link is included. Store prices and license options vary by marketplace; verify the selected listing.