Order link in email does not take you to Order

[brent-hoover]

Issue Description

If you click on the order link in the shipping confirmation email it just takes you to a screen that says "Order Not Found". It might/probably is all emails but I found it in the shipping one.

Steps to Reproduce

1. Place an order
2. Approve/Capture/Ship the order
3. Open the email and click on the link
4. Observe it takes you to a page that says "Order Not Found"

Versions

Reaction: 2.0.0-rc1

UPDATE: 2.0.0-rc11

[hfmw]

Issue here is with the completedCartOrder publication.

  return Orders.find({
    accountId,
    cartId
  }, { limit: 1 });

Is accountId required from a security perspective? I would be happy submit a PR removing the requirement for accountId, if that's a valid solution for you.

[brent-hoover]

Yes accountid is required because we can't allow anyone besides the creator of the order to see the order, so removing accountId is not a valid solution

[aldeed]

This is still an issue, but in a different way. Now the link should be going to the storefront order page, but it's going to the operator UI domain. Keeping this open to track this new variation of the issue.

[aldeed]

Some clarity on what needs to be done here:

In sendOrderEmail.js, when building dataForEmail:

homepage: Reaction.absoluteUrl()

Replace Reaction.absoluteUrl() with the storefront base URL (new ENV variable?)

And here:

orderUrl: `cart/completed?_id=${order.cartId}`,

Replace this with the storefront route.

Because this is likely changed by each implementation, a better long-term approach might be to call a query function to get the URL, so that a custom plugin can override that query function.

[focusaurus]

OK I paired a bit with aldeed on this.

Changes to data provided to template

• homepage: shop.storefrontUrls.storefrontHomeUrl
• orderUrl based on shop.storefrontUrls.storefrontOrderUrl, but with templatization of an :orderId placeholder variable
  • The operator should put :orderId in the URL they configure in the email settings
  • Reaction core code will replace that with the relevant order reference id when preparing the template data

Handling anonymous checkout

There's some additional scope to deal with anonymous checkouts and the associated token. Will propose solution there as I dig more into it.

Some UI changes we should also make

• Add inline help text explaining the :orderId and :token placeholders
• Provide a sample value for reference like: http://shop.example.com/my-orders/:orderId?token=:token

[kieckhafer]

@focusaurus can we close this based on #5251?