@autobusal/providers 1.40.2 → 1.40.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.40.4
+
+### Fixed
+
+- **The Content-Language header survives a cold load** - requests firing before i18next.init resolved carried no language at all, which is the recurring English-menu-under-/sq leak (CMS-05/CMS-07). The interceptor now falls back to the URL's locale prefix, then the stored preference.
+
+## 1.40.3
+
+### Fixed
+
+- **An expired session interrupted on a private page carries that page through the logout hop** (`/account/logout?return=...`), so signing back in can resume there. (Audit ADM-08a.)
+
 ## 1.40.2
 
 ### Fixed

package/Queries/apiClient.ts

@@ -49,8 +49,25 @@ if (!isBffMode) {
 // upstream (see @autobusal/bff) - both sides had to change, only one of
 // them silently doing nothing would look identical to neither working.
 apiClient.interceptors.request.use(config => {
-  if (i18next.language) {
-    config.headers['Content-Language'] = i18next.language;
+  /*
+   * Claude - 2026-08-22 (audit findings CMS-05/CMS-07): on a COLD load,
+   * requests that fire before i18next.init resolves saw no language at
+   * all - so the first menu/settings fetch of a /sq visit carried no
+   * header and came back English, which is exactly the recurring
+   * English-menu-under-/sq leak the audit kept meeting. The fallback
+   * resolves the same way Setup/languages does: the URL's locale prefix
+   * first, then the stored preference. An unknown two-letter first
+   * segment is harmless - the API ignores languages it doesn't serve.
+   */
+  const fromUrl = window.location.pathname.split('/')[1];
+
+  const language = i18next.language
+    || (/^[a-z]{2}$/.test(fromUrl) ? fromUrl : '')
+    || localStorage.getItem('language')
+    || '';
+
+  if (language) {
+    config.headers['Content-Language'] = language;
   }
 
   return config;
@@ -112,7 +129,20 @@ apiClient.interceptors.response.use(response => (
         }
       }
 
-      window.location.href = '/account/logout';
+      /*
+       * Claude - 2026-08-22 (audit finding ADM-08a): when the dead session
+       * was interrupted on a private page, carry that page through the
+       * logout hop - Logout hands it to the login screen, and a successful
+       * sign-in lands back where the bookmark pointed instead of on the
+       * storefront with no explanation.
+       */
+      const here = window.location.pathname;
+
+      const isPrivate = ['/admin', '/account', '/operator'].some(prefix => here.startsWith(prefix));
+
+      window.location.href = isPrivate
+        ? '/account/logout?return=' + encodeURIComponent(here + window.location.search)
+        : '/account/logout';
 
       return Promise.reject(error);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"

package/types/orders.ts

@@ -42,6 +42,10 @@ export interface OrderData {
   note_cancel: string
   actions: string[]
   created_at: string
+  // Claude - 2026-08-22 (audit TK-01): the PNR-style reference support and
+  // operators quote - both the listing and the single-order endpoint carry
+  // it; optional only because older cached rows may predate the column.
+  order_number?: string
   /*
    * Edited: Ferjolt Ozuni - Date: 2026-08-11
    * Who owns this order, collapsed to what a viewer outside the account