fix: harden booking and meeting flows

app/(payload)/api/meetings/[slug]/connect/route.ts

@@ -4,6 +4,7 @@ import config from "@payload-config";
 import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
 import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
 import { verifyMeetingToken } from "@/lib/meeting/token";
+import { authorizeMeeting } from "@/lib/meeting/access";
 
 export const dynamic = "force-dynamic";
 
@@ -23,11 +24,17 @@ export async function POST(request: Request, { params }: Args) {
   }
 
   try {
-    const isAdminTestRoom = meetingToken.role === "host" && slug.startsWith("test-");
+    let expiresAt = meetingToken.exp;
+    const isAdminTestRoom = meetingToken.role === "host" && meetingToken.testRoom === true && slug.startsWith("test-");
     if (!isAdminTestRoom) {
       const payload = await getPayload({ config });
       const { docs } = await payload.find({ collection: "events", where: { slug: { equals: slug } }, limit: 1 });
       if (!docs[0]?.isOnline) return NextResponse.json({ error: "Dieser Online-Termin wurde nicht gefunden." }, { status: 404 });
+      const access = await authorizeMeeting(payload, docs[0], meetingToken.role);
+      if (!access || access.accessVersion !== meetingToken.accessVersion) {
+        return NextResponse.json({ error: "Dieser Meeting-Zugang ist nicht mehr gültig. Bitte tritt erneut bei." }, { status: 403 });
+      }
+      expiresAt = Math.min(expiresAt, access.expiresAt);
     }
 
     const participantToken = await createLiveKitToken({
@@ -36,6 +43,8 @@ export async function POST(request: Request, { params }: Args) {
       name: meetingToken.name,
       role: meetingToken.role,
       clientId: meetingToken.clientId,
+      accessVersion: meetingToken.accessVersion,
+      expiresAt,
     });
     return NextResponse.json({ serverUrl: getLiveKitClientUrl(), participantToken });
   } catch (error) {