From bbc1b6c68a7b3b022b330917dd557dfacfb389ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Sat, 29 Aug 2026 09:37:23 +0200
Subject: [PATCH] feat: make booking init flow entry-point post only

---
 src/Controller/Booking/Create/IndexController.php | 7 +++++++
 templates/booking/create/index.html.twig          | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/Controller/Booking/Create/IndexController.php b/src/Controller/Booking/Create/IndexController.php
index de7bf81..3ce69ef 100644
--- a/src/Controller/Booking/Create/IndexController.php
+++ b/src/Controller/Booking/Create/IndexController.php
@@ -48,6 +48,7 @@ class IndexController extends AbstractController
     #[Route(
         path: '/bookings/create',
         name: 'app_booking_create',
+        methods: ['GET'],
     )]
     public function index(#[MapQueryString] ?BookingQueryParams $params): Response
     {
@@ -70,10 +71,16 @@ class IndexController extends AbstractController
      * Optionally accepts an agency code parameter. If provided and valid, the
      * corresponding agency ID is stored in the booking. If not provided or invalid,
      * defaults to agency code '0001'.
+     *
+     * POST-only on purpose: this endpoint is neither safe nor idempotent. It resets the
+     * caller's booking session and forces an uncached BusPro availability call plus a CMS
+     * roundtrip, so it must not be reachable by anything that speculatively fetches URLs
+     * (prefetchers, link unfurlers, mail scanners, crawlers). The loading page posts to it.
      */
     #[Route(
         path: '/bookings/create/init',
         name: 'app_booking_create_init',
+        methods: ['POST'],
     )]
     public function init(Request $request, #[MapQueryString] ?BookingQueryParams $params): Response
     {
diff --git a/templates/booking/create/index.html.twig b/templates/booking/create/index.html.twig
index 00f3569..8b205d4 100644
--- a/templates/booking/create/index.html.twig
+++ b/templates/booking/create/index.html.twig
@@ -2,7 +2,7 @@
 
 {% block content %}
     <div class="flex-1 flex items-center justify-center"
-         hx-get="{{ path('app_booking_create_init', {
+         hx-post="{{ path('app_booking_create_init', {
              date_id: params.dateId,
              hotel_id: params.hotelId,
              agency: params.agency,