Same-day cutoff rules applied server-side at booking creation

Same-day cutoff rules that live only in the slot-filter query are display controls, not booking controls. A direct POST to the booking API bypasses the hidden slots entirely. OWASP A03 (Injection) and CWE-20 (Improper Input Validation) apply whenever a server accepts client-supplied timestamps without verifying them against business rules. Without server-side cutoff enforcement, a customer can schedule a same-day appointment that the host has no time to prepare for, or an automated client can flood the schedule with last-minute bookings.

Add a cutoff constant and validate it against the request timestamp at the booking API handler, not only when generating the list of available slots.

// src/app/api/book/route.ts
const ADVANCE_BOOKING_HOURS = 24

export async function POST(req: Request) {
  const { startTime } = await req.json()
  const requested = new Date(startTime)
  const earliest = new Date(Date.now() + ADVANCE_BOOKING_HOURS * 3_600_000)

  if (requested < earliest) {
    return Response.json(
      {
        error: 'Too soon',
        detail: `Bookings require at least ${ADVANCE_BOOKING_HOURS}h notice`,
      },
      { status: 400 }
    )
  }
  // ... create booking
}

Co-locate this check with duration and buffer validation so all server-side time boundaries are auditable in one place.