@ticketboothapp/booking 1.2.149 → 1.2.151

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ticketboothapp/booking",
-  "version": "1.2.149",
+  "version": "1.2.151",
   "private": false,
   "sideEffects": [
     "**/*.css",

package/src/components/booking/PrivateShuttleBookingFlow.tsx

@@ -33,6 +33,7 @@ import {
   getPrivateShuttleAvailabilityOptionId,
   privateShuttleBookingCutoffMessage,
   privateShuttleStartTimeAllowed,
+  resolveHydratedPrivateShuttleAvailability,
 } from './private-shuttle-availability';
 import { usePrivateShuttleAvailability } from './use-private-shuttle-availability';
 import type {
@@ -263,6 +264,15 @@ export function PrivateShuttleBookingFlow({
   };
   const selectedOptionConfig = activeOptions.find((opt) => opt.optionId === selectedOption);
   const privateShuttleConfig = selectedOptionConfig?.privateShuttleConfig;
+  const effectiveSelectedAvailability = useMemo(
+    () =>
+      resolveHydratedPrivateShuttleAvailability(
+        selectedAvailability,
+        selectedDate ? (availabilitiesByDate[selectedDate] ?? []) : [],
+        selectedOption,
+      ),
+    [availabilitiesByDate, selectedAvailability, selectedDate, selectedOption],
+  );
   const selectedPickupLocation = useMemo(
     () =>
       pickupLocationId ? product.pickupLocations?.find((loc) => loc.id === pickupLocationId) : null,
@@ -290,7 +300,7 @@ export function PrivateShuttleBookingFlow({
   }, [draftItineraryDestinations]);
 
   const suggestedStartTimes = useMemo(() => {
-    const times = selectedAvailability?.suggestedStartTimes || privateShuttleConfig?.suggestedStartTimes || [];
+    const times = effectiveSelectedAvailability?.suggestedStartTimes || privateShuttleConfig?.suggestedStartTimes || [];
     if (isAdmin || !selectedDate) return times;
     return times.filter((time) =>
       privateShuttleStartTimeAllowed(
@@ -307,7 +317,7 @@ export function PrivateShuttleBookingFlow({
     companyTimezone,
     isAdmin,
     privateShuttleConfig?.suggestedStartTimes,
-    selectedAvailability?.suggestedStartTimes,
+    effectiveSelectedAvailability?.suggestedStartTimes,
     selectedDate,
   ]);
   const {
@@ -338,7 +348,7 @@ export function PrivateShuttleBookingFlow({
     selectedOption,
     selectedDate,
     selectedStartTime,
-    selectedAvailability,
+    selectedAvailability: effectiveSelectedAvailability,
     selectedOptionConfig,
     activeOptions,
     availabilitiesByDate,
@@ -469,8 +479,8 @@ export function PrivateShuttleBookingFlow({
   // When availability changes, clip passenger count to new vacancies (e.g. user switched date/option).
   // Don't run when passengerCount changes—allows special request for more than vacancies.
   useEffect(() => {
-    if (!selectedAvailability) return;
-    const vacancies = selectedAvailability.vacancies || 0;
+    if (!effectiveSelectedAvailability) return;
+    const vacancies = effectiveSelectedAvailability.vacancies || 0;
     const minP = 1;
     setIsSpecialRequestMode(false);
     setSpecialRequestInputValue('');
@@ -478,7 +488,7 @@ export function PrivateShuttleBookingFlow({
       if (prev <= vacancies) return Math.max(minP, prev);
       return Math.max(minP, vacancies);
     });
-  }, [selectedAvailability]);
+  }, [effectiveSelectedAvailability]);
 
   useEffect(() => {
     if (selectedOption) {
@@ -561,7 +571,7 @@ export function PrivateShuttleBookingFlow({
   };
 
   const handlePassengerCountChange = (count: number) => {
-    const max = selectedAvailability?.vacancies || 0;
+    const max = effectiveSelectedAvailability?.vacancies || 0;
     const min = 1;
     setPassengerCount(Math.max(min, max > 0 ? Math.min(max, count) : count));
     setError('');
@@ -642,7 +652,7 @@ export function PrivateShuttleBookingFlow({
     selectedOption,
     selectedDate,
     selectedStartTime,
-    selectedAvailability,
+    selectedAvailability: effectiveSelectedAvailability,
     companyTimezone,
     bookingCutoffNow,
     bookingCutoffMinutes,
@@ -793,12 +803,12 @@ export function PrivateShuttleBookingFlow({
             onOptionSelect={handleOptionSelect}
           />
 
-          {selectedOption && selectedAvailability && (
+          {selectedOption && effectiveSelectedAvailability && (
             <PrivateShuttlePassengerSection
               passengerCount={passengerCount}
               resourceCount={resourceCount}
               billableResourceCount={billableResourceCount}
-              maxVacancies={selectedAvailability.vacancies || 0}
+              maxVacancies={effectiveSelectedAvailability.vacancies || 0}
               isSpecialRequestMode={isSpecialRequestMode}
               specialRequestInputValue={specialRequestInputValue}
               onPassengerCountChange={handlePassengerCountChange}
@@ -808,7 +818,7 @@ export function PrivateShuttleBookingFlow({
             />
           )}
 
-          {selectedOption && selectedAvailability && passengerCount > 0 && (
+          {selectedOption && effectiveSelectedAvailability && passengerCount > 0 && (
             <PrivateShuttleStartTimeSection
               suggestedStartTimes={suggestedStartTimes}
               selectedStartTime={selectedStartTime}

package/src/components/booking/private-shuttle-availability.ts

@@ -87,6 +87,41 @@ export function getPrivateShuttleAvailabilityCacheKey(availability: Availability
   return `${availability.dateTime}-${getPrivateShuttleAvailabilityOptionId(availability)}`;
 }
 
+/**
+ * Calendar results are summary-only. Once the selected day is hydrated, prefer the
+ * matching detailed availability so pricing uses its authoritative dynamic adjustments.
+ */
+export function resolveHydratedPrivateShuttleAvailability(
+  selected: Availability | null,
+  availabilitiesForSelectedDate: Availability[],
+  selectedOptionId: string,
+): Availability | null {
+  if (!selected) return null;
+  const selectedAvailabilityId = selected.availabilityId?.trim();
+  const selectedOption = selectedOptionId.trim();
+  const hydrated = availabilitiesForSelectedDate.find((candidate) => {
+    if (
+      selectedAvailabilityId &&
+      candidate.availabilityId?.trim() !== selectedAvailabilityId
+    ) {
+      return false;
+    }
+    return (
+      !selectedOption ||
+      getPrivateShuttleAvailabilityOptionId(candidate) === selectedOption
+    );
+  });
+  return hydrated ?? selected;
+}
+
+export function privateShuttlePriceChanged(
+  displayedTotal: number,
+  authoritativeTotal: number,
+): boolean {
+  if (!Number.isFinite(displayedTotal) || !Number.isFinite(authoritativeTotal)) return true;
+  return Math.round(displayedTotal * 100) !== Math.round(authoritativeTotal * 100);
+}
+
 export function getResourceRate(availability: Availability | undefined | null) {
   return availability?.rates?.find((r) => r.rateId === 'RESOURCE' || r.category === 'RESOURCE');
 }

package/src/components/booking/private-shuttle-reservation-runner.ts

@@ -16,7 +16,10 @@ import {
 } from '../../lib/booking/source-metadata';
 import { quotePublicNewBookingV2ForCheckout } from '../../lib/pricing-v2-shadow';
 import type { Currency } from './CurrencySwitcher';
-import { findMergedPrivateShuttleAvailability } from './private-shuttle-availability';
+import {
+  findMergedPrivateShuttleAvailability,
+  privateShuttlePriceChanged,
+} from './private-shuttle-availability';
 
 type PrivateShuttleBookingItem = { category: 'RESOURCE'; count: number };
 export type PrivateShuttleAddOnSelection = { addOnId: string; variantId?: string; quantity?: number };
@@ -213,6 +216,21 @@ export async function reservePrivateShuttleForCheckout({
     },
   });
 
+  const authoritativeTotal =
+    pricingV2Quote?.quote?.amountToCharge ??
+    pricingV2Quote?.quote?.payableTotal ??
+    pricingV2Quote?.quote?.totalAmount;
+  if (
+    typeof authoritativeTotal === 'number' &&
+    privateShuttlePriceChanged(totalPrice, authoritativeTotal)
+  ) {
+    return {
+      kind: 'blocked',
+      message:
+        'Pricing was refreshed. Please review the updated total and continue to payment again.',
+    };
+  }
+
   const reservation = await createReservation({
     productId: selectedOption,
     dateTime: selectedDate,

package/src/hooks/useBookingSourceMetadataFromLocation.ts

@@ -1,21 +1,23 @@
 'use client';
 
 import { useMemo } from 'react';
-import { usePathname } from 'next/navigation';
+import { usePathname, useSearchParams } from 'next/navigation';
 import {
   buildBookingSourceMetadataFromLocation,
   type BookingSourceMetadata,
 } from '../lib/booking/source-metadata';
 
 /**
- * Re-reads URL-derived booking attribution when the **path** changes. Query-only updates on the
- * same path re-read on the next full navigation / remount (metadata reads live `window.location`).
+ * Re-reads URL-derived booking attribution when either the path or query changes. This is
+ * important after same-path checkout-return cleanup removes transient Stripe parameters.
  */
 export function useBookingSourceMetadataFromLocation(): Partial<BookingSourceMetadata> {
   const pathname = usePathname() ?? '';
+  const searchParams = useSearchParams();
+  const query = searchParams.toString();
 
   return useMemo(
     () => buildBookingSourceMetadataFromLocation(),
-    [pathname],
+    [pathname, query],
   );
 }

package/src/lib/booking/change-booking-server-preview.ts

@@ -199,7 +199,11 @@ export function mapQuoteLineItemsToPriceSummaryLines(
     ) {
       const category =
         type === 'TICKET'
-          ? (label.split(/\s+/)[0]?.replace(/[^a-zA-Z]/g, '') || 'TICKET').toUpperCase()
+          ? label.toUpperCase().startsWith('REFUND ·')
+            ? label
+            : isPricingV2Line(item) && item.metadata?.category
+              ? item.metadata.category.toUpperCase()
+              : (label.split(/\s+/)[0]?.replace(/[^a-zA-Z]/g, '') || 'TICKET').toUpperCase()
           : type;
       out.push({
         kind: 'ticket',

package/src/lib/booking/source-metadata.ts

@@ -49,6 +49,76 @@ export function isDedicatedPartnerBookingPortalHost(hostname: string): boolean {
   return h === 'booking.viaviamorainelake.com' || h === 'staging.booking.viaviamorainelake.com';
 }
 
+const STRIPE_REDIRECT_QUERY_KEYS = new Set([
+  'payment_intent',
+  'payment_intent_client_secret',
+  'setup_intent',
+  'setup_intent_client_secret',
+  'redirect_status',
+]);
+
+const CHECKOUT_RETURN_QUERY_KEYS = new Set([
+  'reservationref',
+  'reservation',
+  'bookingreference',
+  'ref',
+  'lastname',
+  'bookingdate',
+  'booking_complete',
+  'payment',
+  'dap_success',
+  'embed_manage',
+]);
+
+function normalizedQueryKey(key: string): string {
+  return key.trim().toLowerCase().replace(/-/g, '_');
+}
+
+function isSensitiveQueryKey(key: string): boolean {
+  const normalized = normalizedQueryKey(key);
+  const compact = normalized.replace(/_/g, '');
+  return (
+    STRIPE_REDIRECT_QUERY_KEYS.has(normalized) ||
+    ['secret', 'token', 'password', 'passwd', 'authorization'].some((term) =>
+      compact.includes(term),
+    )
+  );
+}
+
+/**
+ * Removes payment-return credentials and transient checkout identity from attribution URLs.
+ * Unknown non-sensitive query parameters remain available for configured partner attribution.
+ */
+export function sanitizeBookingSourceUrl(rawUrl: string | null | undefined): string | undefined {
+  const value = rawUrl?.trim();
+  if (!value) return undefined;
+
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return undefined;
+  }
+
+  const originalKeys = Array.from(url.searchParams.keys()).map(normalizedQueryKey);
+  const isCheckoutReturn =
+    originalKeys.some((key) => STRIPE_REDIRECT_QUERY_KEYS.has(key)) ||
+    url.searchParams.get('embed_manage') === '1' ||
+    url.searchParams.get('booking_complete') === '1';
+
+  for (const key of Array.from(url.searchParams.keys())) {
+    const normalized = normalizedQueryKey(key);
+    if (
+      isSensitiveQueryKey(normalized) ||
+      (isCheckoutReturn && CHECKOUT_RETURN_QUERY_KEYS.has(normalized))
+    ) {
+      url.searchParams.delete(key);
+    }
+  }
+
+  return url.href;
+}
+
 function parseCookieMap(cookieString: string): Map<string, string> {
   const decodeCookieValue = (value: string): string => {
     try {
@@ -119,7 +189,9 @@ export function buildBookingSourceMetadataFromLocation(): Partial<BookingSourceM
     return {};
   }
 
-  const currentUrl = new URL(window.location.href);
+  const sanitizedPageUrl = sanitizeBookingSourceUrl(window.location.href);
+  if (!sanitizedPageUrl) return {};
+  const currentUrl = new URL(sanitizedPageUrl);
   const params = currentUrl.searchParams;
   const partnerMatch = currentUrl.pathname.match(/^\/partner\/([^/]+)/i);
   const onPartnerEmbedPath = isPublicPartnerMarketingPath(currentUrl.pathname);
@@ -135,7 +207,7 @@ export function buildBookingSourceMetadataFromLocation(): Partial<BookingSourceM
     pageUrl: currentUrl.href,
     pagePath: currentUrl.pathname,
     pageQuery: currentUrl.search || undefined,
-    referrerUrl: document.referrer || undefined,
+    referrerUrl: sanitizeBookingSourceUrl(document.referrer),
     utmSource: params.get('utm_source') || undefined,
     utmMedium: params.get('utm_medium') || undefined,
     utmCampaign: params.get('utm_campaign') || undefined,

package/src/lib/booking-api.ts

@@ -17,7 +17,11 @@ import {
   normalizeBookingProductId,
 } from './booking/normalize-booking-product-id';
 import { ENV } from './env';
-import { DEFAULT_BOOKING_SOURCE, type BookingSourceMetadata } from './booking/source-metadata';
+import {
+  DEFAULT_BOOKING_SOURCE,
+  sanitizeBookingSourceUrl,
+  type BookingSourceMetadata,
+} from './booking/source-metadata';
 
 const API_BASE = ENV.API_URL;
 
@@ -105,7 +109,7 @@ function reportBookingClientTelemetryEvent(
     traceparent,
     ...(traceId ? { traceId } : {}),
     apiBase: API_BASE,
-    pageUrl: window.location.href,
+    pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
     userAgent: window.navigator.userAgent,
     online: window.navigator.onLine,
     occurredAt: new Date().toISOString(),
@@ -424,7 +428,7 @@ function getBrowserDiagnostics(): Record<string, number | string | boolean> {
     siteOrigin: window.location.origin,
     siteProtocol: window.location.protocol,
     isSecureContext: window.isSecureContext,
-    referrer: document.referrer || '',
+    referrer: sanitizeBookingSourceUrl(document.referrer) ?? '',
   };
 }
 
@@ -568,7 +572,7 @@ async function collectNetworkFailureProbeResults(
           correlationId,
           traceparent,
           apiBase: API_BASE,
-          pageUrl: window.location.href,
+          pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
           userAgent: window.navigator.userAgent,
           online: window.navigator.onLine,
           occurredAt: new Date().toISOString(),

package/src/providers/booking-dialog-provider.tsx

@@ -17,6 +17,7 @@ import {
   normalizeBookingProductId,
 } from '../lib/booking/normalize-booking-product-id';
 import { useBookingHostOptional } from '../runtime/BookingHostContext';
+import { sanitizeBookingSourceUrl } from '../lib/booking/source-metadata';
 
 /** Filter IDs for the product grid. Must match BookingProductGrid FILTER_IDS. */
 export type ProductGridFilterId =
@@ -87,8 +88,8 @@ export function BookingDialogProvider({ children }: BookingDialogProviderProps)
         correlationId,
         originalProductId: original,
         sanitizedProductId: sanitized,
-        pageUrl: window.location.href,
-        referrer: document.referrer || null,
+        pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
+        referrer: sanitizeBookingSourceUrl(document.referrer) ?? null,
         userAgent: window.navigator.userAgent,
         occurredAt: new Date().toISOString(),
         stack: new Error('Suspicious booking productId input').stack ?? null,

package/test/change-booking-helpers.test.ts

@@ -8,6 +8,12 @@ import { buildCheckoutModalSummaryFromPricingV2Quote } from '../src/components/b
 import type { ChangeQuoteUiSlice } from '../src/lib/booking/change-flow-pricing';
 import type { ChangeBookingQuoteResponse } from '../src/lib/booking-api';
 import { buildAdminChangeQuoteRequestKey } from '../src/components/booking/admin-change-quote-request-key';
+import {
+  applyResourceAdjustments,
+  privateShuttlePriceChanged,
+  resolveHydratedPrivateShuttleAvailability,
+} from '../src/components/booking/private-shuttle-availability';
+import { sanitizeBookingSourceUrl } from '../src/lib/booking/source-metadata';
 
 function quote(overrides: Partial<ChangeBookingQuoteResponse>): ChangeBookingQuoteResponse {
   return {
@@ -36,6 +42,36 @@ function test(name: string, fn: () => void): void {
   }
 }
 
+test('source attribution strips Stripe credentials and transient partner checkout identity', () => {
+  const sanitized = sanitizeBookingSourceUrl(
+    'https://staging.booking.viaviamorainelake.com/?partnerId=par_safe&agentId=agent_safe&agentName=Isadora+Buttonmoss&embed_manage=1&reservationRef=resRef_previous&lastName=Tauro&bookingDate=2026-07-16&payment_intent=pi_previous&payment_intent_client_secret=do_not_store&redirect_status=succeeded&tab=bookings',
+  );
+  assert.ok(sanitized);
+
+  const url = new URL(sanitized);
+  assert.equal(url.searchParams.get('partnerId'), 'par_safe');
+  assert.equal(url.searchParams.get('agentId'), 'agent_safe');
+  assert.equal(url.searchParams.get('agentName'), 'Isadora Buttonmoss');
+  assert.equal(url.searchParams.get('tab'), 'bookings');
+  assert.equal(url.searchParams.has('payment_intent_client_secret'), false);
+  assert.equal(url.searchParams.has('payment_intent'), false);
+  assert.equal(url.searchParams.has('reservationRef'), false);
+  assert.equal(url.searchParams.has('lastName'), false);
+  assert.equal(url.searchParams.has('embed_manage'), false);
+});
+
+test('source attribution preserves safe custom partner query keys but strips token-like keys', () => {
+  const sanitized = sanitizeBookingSourceUrl(
+    'https://viaviamorainelake.com/partner/example?utm_source=partner&custom_partner_key=safe-value&accessToken=do-not-store',
+  );
+  assert.ok(sanitized);
+
+  const url = new URL(sanitized);
+  assert.equal(url.searchParams.get('utm_source'), 'partner');
+  assert.equal(url.searchParams.get('custom_partner_key'), 'safe-value');
+  assert.equal(url.searchParams.has('accessToken'), false);
+});
+
 test('admin quote response display state cannot invalidate its request identity', () => {
   const selectedAvailability = {
     availabilityId: 'a_1',
@@ -69,6 +105,52 @@ test('admin quote response display state cannot invalidate its request identity'
   assert.equal(keyAfterResponse, keyBeforeResponse);
 });
 
+test('private shuttle pricing replaces the selected calendar summary with hydrated rate details', () => {
+  const selectedSummary = {
+    availabilityId: 'a_private',
+    productOptionId: 'po_private',
+    dateTime: '2026-07-22',
+    vacancies: 26,
+    currency: 'CAD',
+    isSummary: true,
+  };
+  const hydrated = {
+    ...selectedSummary,
+    dateTime: '2026-07-22T06:00:00+00:00',
+    isSummary: false,
+    rates: [
+      {
+        rateId: 'RESOURCE',
+        category: 'RESOURCE',
+        available: 26,
+        price: 2099.99,
+        priceByCurrency: { CAD: 2099.99 },
+        appliedAdjustments: [
+          {
+            type: 'dynamic',
+            id: 'private-shuttle-busy-season-surcharge',
+            name: 'Private Shuttle Busy Season Surcharge',
+            changeByCurrency: { CAD: 400 },
+          },
+        ],
+      },
+    ],
+  };
+
+  const resolved = resolveHydratedPrivateShuttleAvailability(
+    selectedSummary,
+    [hydrated],
+    'po_private',
+  );
+  assert.equal(resolved, hydrated);
+  assert.equal(applyResourceAdjustments(1699.99, resolved, 'CAD'), 2099.99);
+});
+
+test('private shuttle checkout detects a quote total that differs from the displayed total', () => {
+  assert.equal(privateShuttlePriceChanged(2247, 2681), true);
+  assert.equal(privateShuttlePriceChanged(2681, 2681.0), false);
+});
+
 test('routes customer change quote to paid checkout when amount is due', () => {
   const decision = evaluateChangeBookingQuoteForCheckout({
     quote: quote({