Pre-shipment cancellation allowed and functional

Missing pre-shipment cancellation is a direct OWASP A01 (Broken Access Control) and CWE-285 gap: a customer has a legitimate right to cancel an order they just placed, and if no endpoint exists to exercise that right, they lose money or are forced to contact support for a routine action. Beyond customer experience, an absent cancellation flow means that if a payment is captured for an order that should not have been fulfilled — duplicate order, payment error, customer mistake — there is no programmatic path to unwind it. The handler must also guard against cancelling already-shipped orders through the same path, which could incorrectly trigger a refund for a package in transit.

Implement a cancellation route at app/api/orders/[id]/cancel/route.ts with explicit status validation before allowing the transition.

// app/api/orders/[id]/cancel/route.ts
export async function POST(req: Request, { params }: { params: { id: string } }) {
  const session = await getServerSession()
  if (!session?.user) return new Response('Unauthorized', { status: 401 })

  const order = await db.orders.findUnique({ where: { id: params.id, userId: session.user.id } })
  if (!order) return new Response('Not found', { status: 404 })

  const CANCELLABLE = ['pending', 'confirmed']
  if (!CANCELLABLE.includes(order.status)) {
    return Response.json(
      { error: `Cannot cancel an order with status '${order.status}'.` },
      { status: 409 }
    )
  }

  await transitionOrder(params.id, 'cancelled', session.user.id, 'Customer requested cancellation')
  return Response.json({ success: true })
}