Post-shipment cancellation requires special handling or admin approval

An order that was shipped yesterday cannot be cancelled the same way as an order placed five minutes ago. If the same code path applies to both, a customer can trigger a 'cancelled' transition on an already-shipped order — potentially generating an automated refund while the package is still in transit and arrives at the customer's door. This is a CWE-285 failure: the system grants a cancellation action to a user for an order state where that action should be restricted to admin review. Post-shipment cases require a separate branch: queue the request, notify the admin, and communicate a different resolution timeline to the customer.

Add a second branch to your cancellation handler at app/api/orders/[id]/cancel/route.ts that routes post-shipment requests to an admin review queue rather than auto-cancelling.

const POST_SHIPMENT = ['shipped', 'delivered']

if (POST_SHIPMENT.includes(order.status)) {
  await db.cancellationRequests.create({
    data: {
      orderId: order.id,
      userId: session.user.id,
      requestedAt: new Date(),
      status: 'pending_review',
      reason: body.reason,
    },
  })
  await sendAdminNotification({ type: 'post_shipment_cancellation', orderId: order.id })
  return Response.json({
    message: 'Request received. Our team will contact you within 1–2 business days.',
  })
}