Reading Bookings: Scope Everything Through current_user

The golden rule: never Booking.all

current_user has been available in every controller since module 10's Authentication concern set @current_user from the JWT. Here's the rule that matters more than any single line of code in this module: a controller for a signed-in user's own data never queries the bare model class. Not Booking.all, not Booking.find(params[:id]). Every query starts from current_user.bookings — the association Rails built the moment you wrote belongs_to :user on Booking and has_many :bookings on User back in module 09.

Booking.all returns EVERY booking in the database, for every user who ever signed up. current_user.bookings returns only the rows where user_id == current_user.id — the exact same WHERE clause you'd type by hand, generated automatically by the association. Forget this once, in one action, and you've built an endpoint that leaks every stranger's booking history to whoever's logged in.