@autobusal/order-process 1.3.5 → 1.3.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.3.6
+
+### Fixed
+
+- **A 200 with an empty body no longer navigates to the homepage** while the order sits reserved - the confirmation path is only followed when the API actually named one. (Audit BOOK-04-b.)
+
 ## 1.3.5
 
 ### Fixed

package/Standard/Standard.tsx

@@ -37,10 +37,26 @@ const Standard = ({ type, hash, t }: Props): JSX.Element => {
     }
   }, [isError, error, navigate, t]);
 
-  if (isSuccess) {
+  /*
+   * Claude - 2026-08-22 (audit finding BOOK-04-b): a 200 whose body is
+   * empty or not the expected path string used to make this
+   * <Navigate to=""> - which lands on the HOMEPAGE while the order sits
+   * reserved, silently. Measured once in the audit (an intermittent BFF
+   * hiccup); never navigate anywhere that isn't the confirmation the API
+   * actually named.
+   */
+  if (isSuccess && typeof data === 'string' && data.startsWith('/')) {
     return <Navigate to={ data } />;
   }
 
+  if (isSuccess) {
+    return (
+      <Container>
+        <Inline text={ t('order_process.error', { ns: 'common', defaultValue: 'We could not confirm your order. Please open your orders to check its state.' }) } />
+      </Container>
+    );
+  }
+
   return (
     <Container>
       <Inline text={ t('order_process.loading') } />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/order-process",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"