Advance booking limits enforced server-side with a structured error response

Advance booking limits that exist only as a UI filter are not limits at all. A direct POST to the booking API skips the date picker entirely. OWASP A03 (Injection) and CWE-20 (Improper Input Validation) apply to any business rule that can be bypassed by sending a raw HTTP request. Without a server-side ceiling, a misbehaving client can book a slot 5 years in the future, creating junk data in the schedule, blocking the resource for phantom appointments, and polluting analytics.

Define MAX_ADVANCE_DAYS as a server-side constant and validate it in the booking API handler. The check belongs next to duration and cutoff validation so all time-boundary rules are visible in one file.

// src/app/api/book/route.ts
const MAX_ADVANCE_DAYS = 90

export async function POST(req: Request) {
  const { startTime } = await req.json()
  const requested = new Date(startTime)
  const ceiling = new Date(Date.now() + MAX_ADVANCE_DAYS * 86_400_000)

  if (requested > ceiling) {
    return Response.json(
      {
        error: 'Booking too far in advance',
        detail: `Bookings cannot exceed ${MAX_ADVANCE_DAYS} days from today`,
      },
      { status: 400 }
    )
  }
  // ... create booking
}