fix: harden booking and meeting flows

app/(payload)/api/meetings/[slug]/connect/route.ts

@@ -4,6 +4,7 @@ import config from "@payload-config";
 import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
 import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
 import { verifyMeetingToken } from "@/lib/meeting/token";
+import { authorizeMeeting } from "@/lib/meeting/access";
 
 export const dynamic = "force-dynamic";
 
@@ -23,11 +24,17 @@ export async function POST(request: Request, { params }: Args) {
   }
 
   try {
-    const isAdminTestRoom = meetingToken.role === "host" && slug.startsWith("test-");
+    let expiresAt = meetingToken.exp;
+    const isAdminTestRoom = meetingToken.role === "host" && meetingToken.testRoom === true && slug.startsWith("test-");
     if (!isAdminTestRoom) {
       const payload = await getPayload({ config });
       const { docs } = await payload.find({ collection: "events", where: { slug: { equals: slug } }, limit: 1 });
       if (!docs[0]?.isOnline) return NextResponse.json({ error: "Dieser Online-Termin wurde nicht gefunden." }, { status: 404 });
+      const access = await authorizeMeeting(payload, docs[0], meetingToken.role);
+      if (!access || access.accessVersion !== meetingToken.accessVersion) {
+        return NextResponse.json({ error: "Dieser Meeting-Zugang ist nicht mehr gültig. Bitte tritt erneut bei." }, { status: 403 });
+      }
+      expiresAt = Math.min(expiresAt, access.expiresAt);
     }
 
     const participantToken = await createLiveKitToken({
@@ -36,6 +43,8 @@ export async function POST(request: Request, { params }: Args) {
       name: meetingToken.name,
       role: meetingToken.role,
       clientId: meetingToken.clientId,
+      accessVersion: meetingToken.accessVersion,
+      expiresAt,
     });
     return NextResponse.json({ serverUrl: getLiveKitClientUrl(), participantToken });
   } catch (error) {

app/(payload)/api/meetings/[slug]/join/route.ts

@@ -3,7 +3,8 @@ import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
 import { createMeetingToken } from "@/lib/meeting/token";
-import { canJoinMeeting, combineDateAndTime, getMeetingStatus } from "@/lib/meeting/status";
+import { authorizeMeeting } from "@/lib/meeting/access";
+import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
 import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
 import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
 
@@ -20,10 +21,14 @@ type Args = { params: Promise<{ slug: string }> };
 
 export async function POST(request: Request, { params }: Args) {
   const { slug } = await params;
+  if (!checkRateLimit(`meeting-join:${getClientIp(request)}`, { max: 30, windowMs: 60000 })) {
+    return NextResponse.json({ error: "Zu viele Beitrittsversuche." }, { status: 429 });
+  }
 
   let body: { name?: unknown; password?: unknown; clientId?: unknown };
   try {
     body = await request.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
   } catch {
     return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
   }
@@ -65,31 +70,17 @@ export async function POST(request: Request, { params }: Args) {
       }
     }
 
-    const settings = await payload.findGlobal({ slug: "meeting-settings" });
-    const start = combineDateAndTime(event.date, event.startTime);
-    const end = event.endTime
-      ? combineDateAndTime(event.date, event.endTime)
-      : new Date(start.getTime() + 60 * 60_000);
-
-    const status = getMeetingStatus({
-      start,
-      end,
-      joinWindowMinutes: isHost ? settings.hostJoinWindowMinutes : settings.participantJoinWindowMinutes,
-      closeAfterMinutes: settings.meetingCloseAfterMinutes,
-    });
-
-    if (!canJoinMeeting(status)) {
-      const message =
-        status === "scheduled"
-          ? "Dieser Termin ist noch nicht offen. Bitte versuche es näher am Beginn erneut."
-          : "Dieser Termin ist bereits beendet.";
-      return NextResponse.json({ error: message }, { status: 403 });
+    const access = await authorizeMeeting(payload, event, isHost ? "host" : "participant");
+    if (!access) {
+      return NextResponse.json({ error: "Dieser Termin ist nicht offen oder wurde storniert." }, { status: 403 });
     }
 
     const { token, participantId } = createMeetingToken({
       eventSlug: slug,
       name,
       role: isHost ? "host" : "participant",
+      accessVersion: access.accessVersion,
+      ttlMs: Math.min(6 * 3600000, access.expiresAt - Date.now()),
       // Only meaningful for participants — a host authenticates via a real
       // session already, so there's no need to anchor a kick to it (and
       // hosts can't be kicked in the first place.
@@ -101,6 +92,8 @@ export async function POST(request: Request, { params }: Args) {
     }
     const participantToken = await createLiveKitToken({
       eventSlug: slug,
+      accessVersion: access.accessVersion,
+      expiresAt: access.expiresAt,
       participantId,
       name,
       role: isHost ? "host" : "participant",

app/(payload)/api/meetings/[slug]/kick/route.ts

@@ -19,6 +19,7 @@ export async function POST(request: Request, { params }: Args) {
   let body: { participantId?: unknown };
   try {
     body = await request.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
   } catch {
     return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
   }
@@ -29,7 +30,7 @@ export async function POST(request: Request, { params }: Args) {
 
   try {
     const roomService = getLiveKitRoomService();
-    const room = getLiveKitRoomName(slug);
+    const room = getLiveKitRoomName(slug, host.accessVersion);
     const participant = (await roomService.listParticipants(room)).find((item) => item.identity === participantId);
     if (!participant) return NextResponse.json({ error: "Teilnehmer nicht gefunden." }, { status: 404 });
 

app/(payload)/api/meetings/[slug]/register/route.ts

@@ -38,6 +38,7 @@ export async function POST(request: Request, { params }: Args) {
   let body: { name?: unknown; email?: unknown };
   try {
     body = await request.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
   } catch {
     return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
   }