refactor: allow all users with token to view order

[kieckhafer]

The original PR, #6082, was accidentally closed when we deleted the old release-3.0.0 branch. This is a copy of the original PR to the trunk branch.

Resolves #5882
Impact: minor
Type: refactor

Issue

Checkout as an anonymous customer, you get an order with an ID and token so you can visit the order complete page /order/:id/:token in your storefront.

When you visit this page not logged in, you see the order details, as the token is in the URL.

Now if you login, the order is not found.

It appears that once logged in, the token value is ignored and it will attempt to find the order from your account. The order resolver, when given a order ID and token, should use these to locate the order, and ignore who they are logged in with. If it's presented with only an Order ID and no token, then it should try to find the order from the current account.

Solution

Refactor check order to allow all users who have the order token to view the order.

Breaking changes

None

Testing

1. Create an order as a logged out user using example-storefront
2. See the order confirmation page, and copy the link to that page
3. Login as any user
4. Paste the link, see you can still see the order with the token URL