@autobusal/order-confirm 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.2.2 - 2026-08-29
+
+- The purchase confirmation shows the real PNR rather than the internal hash from its own URL (audit A3-03h) - the email, the ticket and the invoice all name the PNR, and it is the code /viewtrip and a support desk accept. Falls back to the hash, so the page can always confirm.
+
 ## 1.2.1
 
 ### Fixed

package/OrderConfirm.tsx

@@ -9,7 +9,7 @@ import Reason from './Reason';
 import Telegram from './Telegram/Telegram';
 import { Title, Actions } from './styles';
 import { useUserStore } from '@autobusal/providers/stores/user';
-import { useReleaseOrder } from './services';
+import { useReleaseOrder, useGetOrderNumber } from './services';
 import { flush } from '@autobusal/providers/Setup/commerce';
 
 interface Props {
@@ -40,6 +40,10 @@ const OrderConfirm = ({ t }: Props): (JSX.Element | null) => {
 
   const { data: UserData } = useUserStore();
 
+  const { data: NumberData } = useGetOrderNumber(hash);
+
+  const orderNumber = NumberData?.order_number ?? String(hash ?? '');
+
   /*
    * Claude - 2026-08-22 (audit finding BOOK-11-b): this page is where the
    * gateway's cancelUrl AND failUrl land, and it used to say "your order
@@ -131,8 +135,16 @@ const OrderConfirm = ({ t }: Props): (JSX.Element | null) => {
         { t(`order_confirm.title.${ type }`) }
       </Title>
 
+      { /* Claude - 2026-08-29 (audit A3-03h, low): the booking's REAL order
+           number, not the URL hash. This page announced the 15-character
+           Hashids token as "your order with number ..." while the email, the
+           ticket and the invoice all named the six-character PNR - and the
+           PNR is what /viewtrip's own Order Number field accepts and what a
+           support desk can look up. Falls back to the hash while the lookup
+           is in flight or if it fails, which is exactly what was shown
+           before, so a confirmation page can still always confirm. */ }
       <div className="box" dangerouslySetInnerHTML={{
-        __html: t(`order_confirm.content.${ type === 'cancelled' && released ? 'released' : type }`, { order: `<strong>${ escapeHtml(String(hash ?? '')) }</strong>` })
+        __html: t(`order_confirm.content.${ type === 'cancelled' && released ? 'released' : type }`, { order: `<strong>${ escapeHtml(orderNumber) }</strong>` })
       }} />
 
       <>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/order-confirm",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"

package/services.ts

@@ -36,6 +36,31 @@ export const useGetOrderTelegramStatus = (hash: string): UseQueryResult<OrderTel
   })
 );
 
+/**
+ * The booking's real Order Number, from the hash this page was given.
+ *
+ * Claude - 2026-08-29 (audit A3-03h, low). The confirmation had only the URL
+ * hash and printed it as "your order with number gnl3d5kolxpw78q", while the
+ * email, the ticket and the invoice for the same booking all said ZRQGV2 -
+ * and ZRQGV2 is the code the /viewtrip lookup and a support desk actually
+ * accept. Not retried and allowed to fail: a confirmation page must never
+ * fail to confirm, so the caller falls back to the hash.
+ */
+export const useGetOrderNumber = (hash?: string): UseQueryResult<{ order_number: string }> => (
+  useQuery({
+    queryKey: ['order-number', hash],
+    enabled: hash !== undefined && hash !== '',
+    retry: false,
+    queryFn: async () => (
+      await apiClient
+        .get('/api/orders/number', { params: { hash } })
+        .then(response => (
+          response.data
+        ))
+    )
+  })
+);
+
 /*
  * Claude - 2026-08-22 (audit finding BOOK-11-b): the "cancelled" return
  * page used to claim the order was cancelled while the reservation kept