fix: harden booking and meeting flows

app/(payload)/api/admin/meetings/start/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
 import { createMeetingToken } from "@/lib/meeting/token";
+import { authorizeMeeting } from "@/lib/meeting/access";
 
 export const dynamic = "force-dynamic";
 
@@ -12,6 +13,7 @@ export async function POST(request: Request) {
   let body: Body;
   try {
     body = await request.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
   } catch {
     return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
   }
@@ -36,10 +38,14 @@ export async function POST(request: Request) {
       return NextResponse.json({ error: "Dieser Termin ist kein Online-Termin." }, { status: 404 });
     }
 
+    const access = await authorizeMeeting(payload, event, "host");
+    if (!access) return NextResponse.json({ error: "Dieser Termin ist nicht offen oder wurde storniert." }, { status: 403 });
     const { token } = createMeetingToken({
       eventSlug,
       name: typeof user.name === "string" && user.name.trim() ? user.name.trim() : "Host",
       role: "host",
+      accessVersion: access.accessVersion,
+      ttlMs: Math.min(6 * 3600000, access.expiresAt - Date.now()),
     });
 
     // Keep the token in the URL fragment: browsers do not send fragments to

app/(payload)/api/admin/meetings/test/route.ts

@@ -20,6 +20,7 @@ export async function POST(request: Request) {
       eventSlug,
       name: typeof user.name === "string" && user.name.trim() ? user.name.trim() : "Host",
       role: "host",
+      testRoom: true,
       ttlMs: 60 * 60 * 1000,
     });
     const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || new URL(request.url).origin;