@autobusal/common 1.36.1 → 1.36.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.36.2 - 2026-08-29
+
+- Seat map: a taken seat is DISABLED, struck through and labelled "Seat N - taken", instead of relying on colour alone with a click that was silently swallowed (audit A3-08c).
+
+- Drive map: the road line is asked through obtapi's /routes/directions instead of calling OpenRouteService from the browser, which CORS blocked every time - and which shipped a metered third-party key in the bundle to pay for requests that could not succeed (audit A7-26). The hook now answers one feature or null, not a GeoJSON envelope.
+
 ## 1.36.0 (2026-08-29)
 
 - Editors offer Save & Close alongside Save & Stay, so correcting a record no longer bounces you back to its list every time (opt-in per page, editing only). The pair is driven from here (Viewer + Actions).

package/Drive/Drive.tsx

@@ -26,7 +26,10 @@ const Drive = ({ locations, t }: Props): JSX.Element => {
   }
 
   // we get the coordinates for the roads to paint
-  const geometryData = MapData?.features[0].geometry.coordinates;
+  // Claude - 2026-08-29 (audit A7-26): ONE feature now, not a GeoJSON
+  // envelope - and optional the whole way down, because "no line to draw" is
+  // an ordinary answer here rather than only a failed request
+  const geometryData = MapData?.geometry?.coordinates;
 
   // we paint the drive lines
   const lines = geometryData?.map((item, index) => {

package/Drive/services.ts

@@ -1,32 +1,41 @@
 import { useQuery, UseQueryResult } from '@tanstack/react-query';
 import { apiClient } from '@autobusal/providers';
-import { GeoJsonData } from './types';
+import { DriveLine } from './types';
 
-export const useGetDriveData = (coordinates: number[][]): UseQueryResult<GeoJsonData> => (
+export const useGetDriveData = (coordinates: number[][]): UseQueryResult<DriveLine | null> => (
   useQuery({
     // Edited: Ferjolt Ozuni - Date: 2026-08-01
     // The key was a bare ['drive-data'] with the coordinates absent, so
     // every route on the site shared one cached itinerary: open one route
     // page and then another, and the second drew the first one's road line.
     queryKey: ['drive-data', { coordinates }],
-    // With no key configured (or a route with fewer than two placed stops)
-    // this only buys a 401 and a console error on every route page view.
-    // Skipping it leaves the map showing stops and no road, which is what
-    // it already did - just quietly.
-    enabled: Boolean(import.meta.env.VITE_OPEN_ROUTE_SERVICE_KEY) && coordinates.length > 1,
+    /*
+     * Claude - 2026-08-29 (audit A7-26, low)
+     *
+     * ASKED THROUGH OUR OWN API, not from the browser. OpenRouteService
+     * answers a browser with no Access-Control-Allow-Origin, so this request
+     * never actually left - every route page logged a CORS failure and drew
+     * its stops with no road between them. And it carried a metered
+     * third-party API key, in the bundle, on a public page.
+     *
+     * obtapi has asked ORS from the server since August for the DISTANCE on
+     * this very geometry (Libraries\Routes\Distance, whose own header
+     * explains why); this is the same call with the line kept. Cached
+     * server-side per geometry, so one answer serves every visitor to a pair
+     * instead of each of them paying for their own.
+     *
+     * The coordinates go over as [lat, lng] pairs - the order this codebase
+     * writes a coordinate in everywhere except the ORS request itself, which
+     * the server now flips.
+     */
+    enabled: coordinates.length > 1,
     queryFn: async () => (
       await apiClient
-        .post('https://api.openrouteservice.org/v2/directions/driving-car/geojson', {
-          coordinates
-        }, {
-          headers: {
-            Authorization: import.meta.env.VITE_OPEN_ROUTE_SERVICE_KEY
-          },
-          withCredentials: false,
-          withXSRFToken: false
+        .post('/api/routes/directions', {
+          points: coordinates.map(point => [point[1], point[0]])
         })
         .then(response => (
-          response.data
+          response.data?.line ?? null
         ))
     )
   })

package/Drive/types.ts

@@ -1,11 +1,15 @@
-export interface GeoJsonData {
-  features: FeaturesData[]
-}
-
-interface FeaturesData {
+/**
+ * Claude - 2026-08-29 (audit A7-26): the drive line is now ONE feature, not
+ * a GeoJSON envelope - obtapi's /routes/directions returns the LineString it
+ * picked out of the provider's answer, or null when there is no line to draw
+ * (no provider configured, fewer than two placed stops, or the provider
+ * unreachable). That also removes the `features[0]` the consumer subscripted,
+ * which was one empty collection away from throwing.
+ */
+export interface DriveLine {
   geometry: GeometryData
 }
 
 interface GeometryData {
   coordinates: string[][]
-}
+}

package/Seats/Preview.tsx

@@ -18,6 +18,21 @@ const Preview = ({ bus, occupied, picked, selected, t, onSelect, onClose }: Prop
   const items = bus.seats.map((item, index) => {
     const isOccupied = occupied.includes(item.no) || picked.includes(item.no);
 
+    /*
+     * Claude - 2026-08-29 (audit A3-08c, low)
+     *
+     * A TAKEN SEAT SAYS SO, rather than only being red. It stayed an enabled
+     * button whose click was silently swallowed, and colour was the single
+     * thing distinguishing it - so a colour-blind buyer, a screen-reader
+     * user, or anybody on a washed-out phone screen in daylight could only
+     * tell a sold seat from a free one by clicking it and getting nothing.
+     *
+     * `disabled` rather than a quiet no-op, because that is what stops a
+     * pointer, a keyboard and assistive technology at once; onSelect keeps
+     * its own guard regardless. The title carries the reason for a mouse and
+     * aria-label carries it for a reader, since the visible content is a bare
+     * seat number either way.
+     */
     return (
       <ButtonOccupy
         key={ index }
@@ -28,6 +43,12 @@ const Preview = ({ bus, occupied, picked, selected, t, onSelect, onClose }: Prop
         $height={ item.height }
         $selected={ selected === item.no }
         $occupied={ isOccupied }
+        disabled={ isOccupied }
+        aria-pressed={ selected === item.no }
+        title={ isOccupied ? t('seats.taken', { ns: 'common', number: item.no }) : undefined }
+        aria-label={ isOccupied
+          ? t('seats.taken', { ns: 'common', number: item.no })
+          : t('seats.free', { ns: 'common', number: item.no }) }
         onClick={ () => onSelect(item.no, isOccupied) }
       >
         <MdEventSeat /> { item.no }

package/Seats/styles.ts

@@ -89,12 +89,25 @@ export const ButtonOccupy = styled.button<{
     background: ${ props => props.theme.primary.normal };
   ` }
 
+  /*
+   * Claude - 2026-08-29 (audit A3-08c, low): a taken seat is disabled as well
+   * as red, so it reads as unavailable to somebody who cannot see the colour.
+   * The strike-through and the cursor are the non-colour half of that signal;
+   * losing the hover response is the other half - a control that answers
+   * nothing should not look like it is about to.
+   */
   ${ props => props.$occupied && css`
     color: #FFFFFF;
     background: ${ props => props.theme.font.error };
+    text-decoration: line-through;
   ` }
 
-  &:hover {
+  &:disabled {
+    cursor: not-allowed;
+    opacity: .75;
+  }
+
+  &:hover:not(:disabled) {
     opacity: .8;
   }
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/common",
-  "version": "1.36.1",
+  "version": "1.36.2",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"