@autobusal/order-process 1.3.6 → 1.3.7

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.3.7 - 2026-08-29
+
+- A refused funds/cash settlement lands on the booking's own payment-not-completed page instead of navigate(-1) (audit A9-39). Back returned to the checkout URL while the checkout's contents lived in wizard state the navigation had destroyed, so the seller arrived at a bare results page with their held reservation findable only through Browse Orders.
+
 ## 1.3.6
 
 ### Fixed

package/Standard/Standard.tsx

@@ -27,15 +27,37 @@ const Standard = ({ type, hash, t }: Props): JSX.Element => {
 
   const navigate = useNavigate();
 
+  /*
+   * Claude - 2026-08-29 (audit A9-39, low)
+   *
+   * BACK IS NOT WHERE THE BUYER WAS. `navigate(-1)` returns to the checkout
+   * URL, but the checkout's CONTENTS - the chosen coach, the typed
+   * passengers, the picked seats - live in the wizard's React state, which
+   * navigating here destroyed. So an agent whose balance would not cover the
+   * sale landed on a bare results page with everything they had filled in
+   * gone, and the reservation they had just made discoverable only by
+   * hunting through Browse Orders.
+   *
+   * The order EXISTS at this point and its seats are still held; what failed
+   * is the settlement. So the honest destination is the booking's own
+   * payment-not-completed page - it says the reservation is still theirs,
+   * carries the reason, and offers both a retry and a way to release the
+   * seats. That page was written for exactly this outcome on the card path
+   * (BOOK-11-b); the funds path was the abrupt one. Going back promised a
+   * restoration it could not perform.
+   */
   useEffect(() => {
     if (isError) {
       const message = (error as { response?: { data?: { message?: string } } })?.response?.data?.message;
 
-      notifyError(message ?? t('order_process.error', { ns: 'common', defaultValue: 'We could not complete your order. Please try again.' }));
+      const reason = message ?? t('order_process.error', { ns: 'common', defaultValue: 'We could not complete your order. Please try again.' });
+
+      notifyError(reason);
 
-      navigate(-1);
+      // replace: a failed attempt is not a step anybody should press Back into
+      navigate(hash ? `/orders/cancelled/${ hash }?msg=${ encodeURIComponent(reason) }` : '/', { replace: true });
     }
-  }, [isError, error, navigate, t]);
+  }, [isError, error, hash, navigate, t]);
 
   /*
    * Claude - 2026-08-22 (audit finding BOOK-04-b): a 200 whose body is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/order-process",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"