@autobusal/order-process 1.3.4 → 1.3.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.3.6
+
+### Fixed
+
+- **A 200 with an empty body no longer navigates to the homepage** while the order sits reserved - the confirmation path is only followed when the API actually named one. (Audit BOOK-04-b.)
+
+## 1.3.5
+
+### Fixed
+
+- **A refused funds payment spun forever.** The standard (funds/reserve) processor had only a success branch, so an agent's "not enough funds" left the page on "Processing your order" with no message and the order stuck reserved. It now surfaces the API's own message and returns the buyer so they can try again. (Platform audit BOOK-05-c.)
+
 All notable changes to `@autobusal/order-process` are documented here. This
 project adheres to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

package/Standard/Standard.tsx

@@ -1,6 +1,8 @@
+import { useEffect } from 'react';
 import { TFunction } from 'i18next';
-import { Navigate } from 'react-router-dom';
+import { Navigate, useNavigate } from 'react-router-dom';
 import { Inline } from '@autobusal/common';
+import { error as notifyError } from '@autobusal/utilities';
 import { Container } from '../styles';
 import { useMakeStandard } from '../services';
 
@@ -10,13 +12,51 @@ interface Props {
   t: TFunction<'common'>
 }
 
+/*
+ * Edited: Claude - Date: 2026-08-22 (audit finding BOOK-05-c)
+ *
+ * This had only an isSuccess branch, so a refused payment - most visibly an
+ * agent's "not enough funds" - left the page spinning on "Processing your
+ * order" forever, with no message and no way out. The reserved order just
+ * sat there. Now a failure surfaces the API's own message (the funds gate
+ * returns exactly the text the agent needs) and returns them to where they
+ * were, so they can top up and try again - the reservation is still theirs.
+ */
 const Standard = ({ type, hash, t }: Props): JSX.Element => {
-  const { data, isSuccess } = useMakeStandard(String(type), String(hash));
+  const { data, isSuccess, isError, error } = useMakeStandard(String(type), String(hash));
 
-  if (isSuccess) {
+  const navigate = useNavigate();
+
+  useEffect(() => {
+    if (isError) {
+      const message = (error as { response?: { data?: { message?: string } } })?.response?.data?.message;
+
+      notifyError(message ?? t('order_process.error', { ns: 'common', defaultValue: 'We could not complete your order. Please try again.' }));
+
+      navigate(-1);
+    }
+  }, [isError, error, navigate, t]);
+
+  /*
+   * Claude - 2026-08-22 (audit finding BOOK-04-b): a 200 whose body is
+   * empty or not the expected path string used to make this
+   * <Navigate to=""> - which lands on the HOMEPAGE while the order sits
+   * reserved, silently. Measured once in the audit (an intermittent BFF
+   * hiccup); never navigate anywhere that isn't the confirmation the API
+   * actually named.
+   */
+  if (isSuccess && typeof data === 'string' && data.startsWith('/')) {
     return <Navigate to={ data } />;
   }
 
+  if (isSuccess) {
+    return (
+      <Container>
+        <Inline text={ t('order_process.error', { ns: 'common', defaultValue: 'We could not confirm your order. Please open your orders to check its state.' }) } />
+      </Container>
+    );
+  }
+
   return (
     <Container>
       <Inline text={ t('order_process.loading') } />
@@ -24,4 +64,4 @@ const Standard = ({ type, hash, t }: Props): JSX.Element => {
   );
 };
 
-export default Standard;
+export default Standard;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/order-process",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"