Reminder includes one-click link to reschedule or cancel without requiring login

A reminder that tells a customer their appointment is in 24 hours but requires them to log in to reschedule or cancel is functionally friction. Customers who cannot easily cancel end up as no-shows; hosts who cannot fill that slot lose revenue on both ends. OWASP A07 (Identification & Authentication Failures) applies in reverse: requiring authentication for a low-risk action (cancellation by the verified customer) increases abandonment and no-show rates rather than providing meaningful security. CWE-287 flags the correct design: a time-limited, scoped token grants the specific action to the specific customer without exposing the full account. Tokens that expire at or before appointment time are self-limiting.

Generate two time-limited tokens (expiring at appointment time) in src/lib/reminders.ts and embed them in the reminder body. The token handler at the target URL must not require a session cookie:

async function sendReminderMessage(booking: Booking) {
  const rescheduleToken = generateToken(booking.id, 'reschedule', booking.start_time)
  const cancelToken = generateToken(booking.id, 'cancel', booking.start_time)

  const body = [
    `Your ${booking.service_name} appointment is coming up at ${formatDateTimeWithTimezone(booking.start_time, booking.timezone)}.`,
    `Reschedule: https://yoursite.com/bookings/${booking.id}/reschedule?token=${rescheduleToken}`,
    `Cancel: https://yoursite.com/bookings/${booking.id}/cancel?token=${cancelToken}`,
  ].join('\n\n')

  await sendReminderViaEmail(booking.customer_email, body)
}

Verify src/app/api/bookings/[id]/cancel/route.ts validates the token and does not redirect to /login when no session is present.