Max and min booking durations validated server-side

Duration validation that exists only in the UI is bypassed by any direct API call. OWASP A03 (Injection) and CWE-20 (Improper Input Validation) both flag trust in client-supplied numeric fields. Without server-side bounds, an attacker or misbehaving client can create a 1-minute booking (flooding the schedule with noise) or a 48-hour booking (occupying a resource for two days). Both have direct revenue impact. Explicit named constants for min and max durations are required so the bounds are testable, auditable, and not silently scattered across the codebase.

Define MIN_DURATION_MINUTES and MAX_DURATION_MINUTES as named server-side constants and validate them at the top of the booking API handler before touching the database.

// src/app/api/book/route.ts
const MIN_DURATION_MINUTES = 30
const MAX_DURATION_MINUTES = 480

export async function POST(req: Request) {
  const { startTime, endTime } = await req.json()
  const duration = (new Date(endTime).getTime() - new Date(startTime).getTime()) / 60_000

  if (duration < MIN_DURATION_MINUTES) {
    return Response.json(
      { error: 'Booking too short', detail: `Minimum is ${MIN_DURATION_MINUTES} min` },
      { status: 400 }
    )
  }
  if (duration > MAX_DURATION_MINUTES) {
    return Response.json(
      { error: 'Booking too long', detail: `Maximum is ${MAX_DURATION_MINUTES} min` },
      { status: 400 }
    )
  }
  // ... create booking
}