Capstone: a bookings API

This capstone puts the course together in one small API: meeting-room bookings. It's deliberately ordinary. Nearly every real backend is a set of resources with owners, rules about what's valid, and conflicts when two people want the same thing. The work is in getting every status code right, because each one is a promise to the client about what went wrong and whether retrying could help.

GET    /bookings?room=atlas   200  that room's bookings, earliest first
POST   /bookings              201  { booking }       signed in, valid, no clash
                              400  invalid input
                              401  not signed in
                              409  overlaps an existing booking in that room
DELETE /bookings/:id          204  no body           owner or admin
                              401  not signed in
                              403  someone else's booking
                              404  no such booking

Overlap is the rule people get wrong. Two bookings in the same room clash when each one starts before the other ends: a.start < b.end && b.start < a.end. That single condition covers every case, including one booking inside another. And it lets back-to-back bookings through: a meeting ending at 10:00 doesn't clash with one starting at 10:00.

Check in the order a client can act on: authentication first (401: who are you?), then input (400: what you sent is wrong), then existence (404), permission (403) and conflicts (409: valid, but not possible right now). A 400 for an overlap would tell the client its request was malformed, when it's fine and the room is just taken.

Loading your workspace…