# Confirmation email contains reference ID, service, date, time, timezone, host, and cancel link

- **Pattern:** `ab-000560` (`booking-notifications-reminders.confirmation-email.confirmation-email-content`)
- **Severity:** high
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000560
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000560)

## Why it matters

Incomplete confirmation emails drive no-shows, double-bookings, and support tickets. When a customer gets an email missing the timezone, they join a 3:00 PM call at the wrong hour because they assumed their own timezone. Missing cancel links force them into account-login flows just to cancel, so they ghost instead — and the host loses the slot with no warning. A missing reference ID makes every support exchange a detective hunt. Content-integrity failures here feed directly into the no-show rate, the metric that kills booking-based businesses.

## Severity rationale

High because missing fields cause wrong-hour arrivals, abandoned cancellations, and revenue-destroying no-shows at scale.

## Remediation

Update your confirmation email template to render all 7 fields and pair every time with an explicit timezone string. The cancel link must be a signed, tokenized URL that works without login — not a redirect to a generic account page. Edit `src/emails/confirmation-template.ts`:

```ts
export function confirmationEmailTemplate(booking: Booking, host: User) {
  return `
    <p>Ref: ${booking.reference_id}</p>
    <p>Service: ${booking.service_name}</p>
    <p>When: ${formatDateTimeWithTimezone(booking.start_time, booking.timezone)}</p>
    <p>Host: ${host.name}</p>
    <p><a href="https://yoursite.com/bookings/${booking.id}/cancel?token=${booking.cancel_token}">Cancel</a></p>
  `
}
```

## Detection

- **ID:** `confirmation-email-content`
- **Severity:** `high`
- **What to look for:** Find the email template or template generator for confirmation emails. Enumerate all 7 required fields by searching the template variables, string interpolation, or React component props: (1) unique reference ID / booking number, (2) service name, (3) appointment date, (4) appointment time, (5) timezone indicator (explicit timezone string like "PST" or timezone-aware formatting like "3:00 PM ET"), (6) host/provider name, (7) cancel link. For the cancel link, verify it is a unique URL containing a token or booking ID that does not require login — trace the link to confirm it resolves to a cancel handler.
- **Pass criteria:** Enumerate all 7 elements and list each one found with the template variable or interpolation that renders it. At least 7 of 7 must be present. Cancel link must use a token-based URL (e.g., `/cancel?token=...`) that works without authentication. A link to a generic login page does NOT count as a cancel link. Report the count: "7 of 7 fields present" even on pass.
- **Fail criteria:** Any of the 7 elements is missing or incorrectly rendered. Cancel link broken, absent, or requires login. Time displayed without timezone context (e.g., bare "3:00 PM" with no timezone indicator). Reference ID is a database internal ID rather than a human-readable booking number.
- **Skip (N/A) when:** No email service dependency found (same criteria as confirmation-sent-60s skip).
- **Detail on fail:** Enumerate all 7 fields. For each, state "FOUND: [variable or text]" or "MISSING". Example: `"FOUND: reference_id (booking.ref), service (booking.service_name), date (formatDate), time (formatTime). MISSING: timezone (time displayed as '3:00 PM' with no timezone), host name, cancel link."`.
- **Remediation:** Update your confirmation email template to include all 7 required fields. Pay special attention to timezone — always pair time with an explicit timezone:

  ```ts
  // src/emails/confirmation-template.ts
  export function confirmationEmailTemplate(booking: Booking, host: User) {
    return `
      <h2>Booking Confirmed</h2>
      <p><strong>Reference ID:</strong> ${booking.reference_id}</p>
      <p><strong>Service:</strong> ${booking.service_name}</p>
      <p><strong>Date & Time:</strong> ${formatDateTimeWithTimezone(booking.start_time, booking.timezone)}</p>
      <p><strong>Host:</strong> ${host.name}</p>
      <p><a href="https://yoursite.com/bookings/${booking.id}/cancel?token=${booking.cancel_token}">Cancel this booking</a></p>
    `
  }
  ```
- **Cross-reference:** Content Quality audit checks email template readability. Booking Flow & Lifecycle audit verifies the booking reference ID is generated at creation time. Accessibility Fundamentals audit checks email template for screen reader compatibility.

Taxons: content-integrity

HTML version: https://auditbuffet.com/patterns/ab-000560