From c0d105e7b395f91745fb4301f6575e85dc1e7d52 Mon Sep 17 00:00:00 2001
From: Pedro Castro <pedro@cal.com>
Date: Tue, 14 Apr 2026 09:12:54 -0300
Subject: [PATCH] fix: require uid for booking cancellation on web cancel route
 (#28868)

---
 apps/web/app/api/cancel/route.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/web/app/api/cancel/route.ts b/apps/web/app/api/cancel/route.ts
index 7a2dcfebfa..b1e6b211ad 100644
--- a/apps/web/app/api/cancel/route.ts
+++ b/apps/web/app/api/cancel/route.ts
@@ -22,6 +22,14 @@ async function handler(req: NextRequest) {
   }
   const bookingData = bookingCancelWithCsrfSchema.parse(appDirRequestBody);
 
+  // Integer IDs are sequential/guessable — only accept high-entropy UIDs on this route
+  if (!bookingData.uid) {
+    return NextResponse.json(
+      { success: false, message: "uid is required for booking cancellation" },
+      { status: 400 }
+    );
+  }
+
   const csrfError = await validateCsrfToken(bookingData.csrfToken);
   if (csrfError) {
     return csrfError;
@@ -38,8 +46,11 @@ async function handler(req: NextRequest) {
     identifier,
   });
 
+  // Strip integer id to ensure lookup is always by uid
+  const { id: _id, ...safeBookingData } = bookingData;
+
   const result = await handleCancelBooking({
-    bookingData,
+    bookingData: safeBookingData,
     userId: session?.user?.id || -1,
     userUuid: session?.user?.uuid,
     actionSource: "WEBAPP",