Modification validation matches creation

Rescheduling endpoints often receive less scrutiny than creation endpoints, creating an asymmetry where PATCH handlers skip the availability and capacity checks that the POST handler enforces. OWASP A03 (Injection) and CWE-20 both apply when untrusted input reaches a database write without validation. A user who reschedules to a fully-booked or already-taken slot bypasses every guard that protected the original booking — producing a double-booking through the update path instead of the creation path. The fix is a shared validation function, not duplicated logic, so both paths stay in sync as the system evolves.

Extract availability and capacity checks into a reusable function in src/lib/booking-service.ts and call it from both the create and update handlers.

// shared — called by both POST and PATCH handlers
async function assertSlotAvailable(slotId: string, excludeBookingId?: string) {
  const conflict = await db.booking.findFirst({
    where: {
      slotId,
      status: { not: 'CANCELLED' },
      ...(excludeBookingId ? { NOT: { id: excludeBookingId } } : {}),
    }
  });
  if (conflict) throw new ConflictError('Slot unavailable');
}

// In PATCH /api/bookings/:id
await assertSlotAvailable(newSlotId, bookingId);
await db.booking.update({ where: { id: bookingId }, data: { slotId: newSlotId } });