wip: group inquiries and booking

src/Controller/Admin/BookingEditDraft/DeleteController.php

@@ -28,6 +28,10 @@ class DeleteController extends AbstractController
     public function index(BookingEditDraft $draft, Request $request): Response
     {
         if (true === $request->isMethod(Request::METHOD_POST)) {
+            if (!$this->isCsrfTokenValid('delete_booking_edit_draft_'.$draft->getId(), $request->request->getString('_token'))) {
+                throw $this->createAccessDeniedException('Invalid CSRF token.');
+            }
+
             $this->entityManager->remove($draft);
             $this->entityManager->flush();
 
@@ -43,6 +47,7 @@ class DeleteController extends AbstractController
 
         return $this->render('admin/booking_edit_draft/modal_delete.html.twig', [
             'draft' => $draft,
+            'csrf_token_id' => 'delete_booking_edit_draft_'.$draft->getId(),
         ]);
     }
 }