bug: profile/generate idempotency guard is check-then-act → duplicate planners on concurrent submit

Description

src/app/api/profile/generate/route.ts guards against re-generation by reading user.onboardingDone (line 36-42), then later creating N templates and finally setting onboardingDone: true (line 108-118). The read and the write are not atomic and there is no per-user lock.

Failure scenario

The client double-submits (or a slow first request is retried while still in flight) so two POSTs overlap. Both read onboardingDone === false, both call the AI, and both create a full set of sections and push them to customSections. The user ends up with two complete, duplicated planners. (Sequential retries after success are correctly guarded; only the concurrent/overlapping case slips through.)

Fix

Gate with an atomic conditional update — User.updateOne({ _id, onboardingDone: { $ne: true } }, { $set: { onboardingDone: true } }) — and only proceed when modifiedCount === 1; or hold a per-user generation lock.

Severity

Medium.

Start in src/app/api/profile/generate/route.ts, especially the guard at lines 36-42 and the onboardingDone write at lines 108-118. Trace the User model update and exercise overlapping POST requests; done means only one request can create templates and set onboardingDone, while the other exits without calling the AI or creating duplicates.