Cancel Booking

Cancel a Duffel order. Backend-only — apps/web checks ownership.

This used to depend on require_auth, which was wrong in both directions at once.

TOO WEAK: require_auth proves someone is signed in, not that the booking is theirs, and order_id goes straight to Duffel. Since InternalAuthMiddleware admits any verified Supabase JWT, any account holder with an order id could cancel that booking. Ownership cannot be checked here — bookings lives in the WEB database, which this service reaches only when WEB_DATABASE_URL is provisioned, so a check here would fail closed on every cancellation whenever it isn't.

TOO STRONG: the only real caller is apps/web, which proxies with X-Internal-Key and no Authorization header, so require_auth rejected the one caller meant to get through.

The ownership gate therefore lives at the web layer, which has the user's session and an RLS-scoped view of bookings; this route only has to establish that the request came from our own backend.