Deadline enforcement for changes

Allowing cancellation or rescheduling up to the moment an event starts undermines the service provider's ability to prepare: a massage therapist who learns of a cancellation 5 minutes before the appointment has no time to fill the slot, collects no revenue, and bears the full cost of the blocked time. CWE-20 applies because the handler accepts a time-based parameter (booking start time) without validating it against a business constraint. CWE-841 applies because the behavioral workflow — "changes require N hours notice" — is defined in business policy but absent from the code. Client-provided timestamps must never be used for the deadline calculation; only server-side Date.now() is trustworthy.

Compute the deadline server-side using the booking's stored startTime in your cancel and reschedule handlers (e.g., src/app/api/bookings/[id]/cancel/route.ts). Do not accept a client-provided timestamp for this comparison.

import { differenceInHours } from 'date-fns';

const hoursUntilEvent = differenceInHours(booking.startTime, new Date());
if (hoursUntilEvent < 24) {
  return res.status(422).json({
    code: 'CANCELLATION_WINDOW_CLOSED',
    message: 'Cancellations require at least 24 hours notice.',
  });
}

Apply the same check in the reschedule handler.