Phase 7

src/features/booking/actions/customer-appointments.ts

@@ -31,7 +31,10 @@ export async function cancelCustomerAppointmentAction(input: unknown): Promise<C
 
   const session = await auth();
   try {
-    assertCanAccessAppointment(appointment, session?.user?.id);
+    await assertCanAccessAppointment(prisma, appointment, {
+      sessionUserId: session?.user?.id,
+      guestToken: parsed.data.guestToken,
+    });
   } catch (error) {
     if (error instanceof PermissionDeniedError) return { success: false, error: error.message };
     throw error;
@@ -65,7 +68,10 @@ export async function rescheduleCustomerAppointmentAction(input: unknown): Promi
 
   const session = await auth();
   try {
-    assertCanAccessAppointment(appointment, session?.user?.id);
+    await assertCanAccessAppointment(prisma, appointment, {
+      sessionUserId: session?.user?.id,
+      guestToken: parsed.data.guestToken,
+    });
   } catch (error) {
     if (error instanceof PermissionDeniedError) return { success: false, error: error.message };
     throw error;