fix: harden booking and meeting flows

app/(payload)/api/booking/[id]/accept-alternative/route.ts

@@ -1,6 +1,8 @@
 import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
+import { combineDateAndTime } from "@/lib/meeting/status";
+import { withBookingTransaction } from "@/lib/booking/transaction";
 
 export const dynamic = "force-dynamic";
 
@@ -19,31 +21,40 @@ export async function POST(request: Request, { params }: Args) {
       return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
     }
 
-    const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
-    if (!booking || Number(booking.user) !== Number(user.id)) {
-      return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
-    }
-    const alternative = booking.proposedAlternative;
-    if (booking.status !== "pending" || !alternative?.date || !alternative.startTime || !alternative.endTime) {
-      return NextResponse.json({ error: "Für diese Buchung liegt kein alternativer Termin vor." }, { status: 409 });
-    }
+    return await withBookingTransaction(payload, `booking:${id}`, async (req) => {
+      const { docs } = await payload.find({ collection: "booking-requests", where: { id: { equals: id } }, depth: 0, limit: 1, req });
+      const booking = docs[0];
+      if (!booking || Number(booking.user) !== Number(user.id)) {
+        return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
+      }
+      const alternative = booking.proposedAlternative;
+      if (booking.status !== "pending" || !alternative?.date || !alternative.startTime || !alternative.endTime) {
+        return NextResponse.json({ error: "Für diese Buchung liegt kein alternativer Termin vor." }, { status: 409 });
+      }
 
-    // The beforeChange hook on booking-requests re-checks for conflicts
-    // (with an advisory lock) before allowing this to become "confirmed" —
-    // the alternative slot may have been taken by someone else since it was
-    // proposed.
-    await payload.update({
-      collection: "booking-requests",
-      id,
-      data: {
-        status: "confirmed",
-        date: alternative.date,
-        startTime: alternative.startTime,
-        endTime: alternative.endTime,
-      },
+      const alternativeStart = combineDateAndTime(alternative.date, alternative.startTime);
+      if (!Number.isFinite(alternativeStart.getTime()) || alternativeStart <= new Date()) {
+        return NextResponse.json({ error: "Dieser Terminvorschlag liegt bereits in der Vergangenheit." }, { status: 409 });
+      }
+
+      // The beforeChange hook on booking-requests re-checks for conflicts
+      // (with an advisory lock) before allowing this to become "confirmed" —
+      // the alternative slot may have been taken by someone else since it was
+      // proposed.
+      await payload.update({
+        collection: "booking-requests",
+        id,
+        req,
+        data: {
+          status: "confirmed",
+          date: alternative.date,
+          startTime: alternative.startTime,
+          endTime: alternative.endTime,
+        },
+      });
+
+      return NextResponse.json({ ok: true });
     });
-
-    return NextResponse.json({ ok: true });
   } catch (error) {
     if (error instanceof Error && "status" in error && (error as { status: number }).status === 409) {
       return NextResponse.json({ error: error.message }, { status: 409 });

app/(payload)/api/booking/[id]/cancel/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
+import { withBookingTransaction } from "@/lib/booking/transaction";
 
 export const dynamic = "force-dynamic";
 
@@ -18,16 +19,19 @@ export async function POST(request: Request, { params }: Args) {
     // Cancelling is deliberately allowed regardless of verification status —
     // only creating/confirming a booking is a gated "protected" action.
 
-    const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
-    if (!booking || Number(booking.user) !== Number(user.id)) {
-      return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
-    }
-    if (booking.status === "cancelled") {
-      return NextResponse.json({ ok: true });
-    }
+    return await withBookingTransaction(payload, `booking:${id}`, async (req) => {
+      const { docs } = await payload.find({ collection: "booking-requests", where: { id: { equals: id } }, depth: 0, limit: 1, req });
+      const booking = docs[0];
+      if (!booking || Number(booking.user) !== Number(user.id)) {
+        return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
+      }
+      if (booking.status === "cancelled") {
+        return NextResponse.json({ ok: true });
+      }
 
-    await payload.update({ collection: "booking-requests", id, data: { status: "cancelled" } });
-    return NextResponse.json({ ok: true });
+      await payload.update({ collection: "booking-requests", id, req, data: { status: "cancelled" } });
+      return NextResponse.json({ ok: true });
+    });
   } catch (error) {
     console.error("booking cancel failed", error);
     return NextResponse.json({ error: "Der Termin konnte nicht storniert werden." }, { status: 500 });