reactioncommerce · mikemurray · Nov 26, 2018 · Nov 24, 2018 · Nov 24, 2018 · Nov 24, 2018
diff --git a/imports/collections/schemas/orders.js b/imports/collections/schemas/orders.js
@@ -438,6 +438,7 @@ export const Order = new SimpleSchema({
     optional: true
   },
   "notes.$": Notes,
+  "referenceId": String,
   "shipping": [OrderFulfillmentGroup],
   "shopId": {
     type: String,

diff --git a/imports/plugins/core/checkout/client/components/completedOrder.js b/imports/plugins/core/checkout/client/components/completedOrder.js
@@ -28,18 +28,17 @@ const CompletedOrder = ({ order, paymentMethods, isProfilePage }) => {
   let headerText;
 
   if (isProfilePage) {
-    headerText = (<p className="order-id"><strong>Order ID </strong>{order._id}</p>);
+    headerText = (<p className="order-id"><strong>Order ID </strong>{order.referenceId}</p>);
   } else {
     headerText = (
       <div className="order-details-header">
         {/* This is the left side / main content */}
         <h3><Components.Translation defaultValue="Thank You" i18nKey={"cartCompleted.thankYou"} /></h3>
-        <p><strong>Order ID </strong>{order._id}</p>
+        <p><strong>Order ID </strong>{order.referenceId}</p>
         <p>
           <Components.Translation defaultValue="Order updates will be sent to" i18nKey="cartCompleted.trackYourDelivery" />
           &nbsp;<strong>{order.email}</strong>
         </p>
-        {/* This is the left side / main content*/}
       </div>
     );
   }

diff --git a/imports/plugins/core/core/server/publications/collections/orders.js b/imports/plugins/core/core/server/publications/collections/orders.js
@@ -37,6 +37,7 @@ function createAggregate(shopId, sort = { createdAt: -1 }, limit = 0, query = {}
       cartId: 1,
       createdAt: 1,
       email: 1,
+      referenceId: 1,
       shopId: 1,
       workflow: 1 // workflow is still stored at the top level and used to showing status
     }

diff --git a/imports/plugins/core/orders/client/components/orderSummary.js b/imports/plugins/core/orders/client/components/orderSummary.js
@@ -34,12 +34,12 @@ class OrderSummary extends Component {
   }
 
   orderLink() {
-    const orderId = this.props.order._id;
+    const orderId = this.props.order.referenceId;
     return orderId;
   }
 
   truncateId() {
-    const orderId = this.props.order._id;
+    const orderId = this.props.order.referenceId;
     const shortId = orderId.slice(-5);
 
     return shortId;
@@ -97,7 +97,7 @@ class OrderSummary extends Component {
               <div className="invoice-details" style={{ cursor: "pointer" }}>
                 <ClickToCopy
                   copyToClipboard={this.orderLink()}
-                  displayText={order._id}
+                  displayText={order.referenceId}
                   i18nKeyTooltip="admin.orderWorkflow.summary.copyOrderLink"
                   tooltip="Copy Order Link"
                 />

diff --git a/imports/plugins/core/orders/client/components/orderTable.js b/imports/plugins/core/orders/client/components/orderTable.js
@@ -119,8 +119,8 @@ class OrderTable extends Component {
           <span className="order-data order-data-id">
             <strong>Order ID: </strong>
             <ClickToCopy
-              copyToClipboard={order._id}
-              displayText={order._id}
+              copyToClipboard={order.referenceId}
+              displayText={order.referenceId}
               i18nKeyTooltip="admin.orderWorkflow.summary.copyOrderLink"
               tooltip="Copy Order Link"
             />
@@ -244,8 +244,8 @@ class OrderTable extends Component {
           id: "createdAt"
         },
         id: {
-          accessor: "_id",
-          id: "_id"
+          accessor: "referenceId",
+          id: "referenceId"
         },
         total: {
           accessor: (row) => {

diff --git a/imports/plugins/core/orders/client/components/orderTableColumn.js b/imports/plugins/core/orders/client/components/orderTableColumn.js
@@ -85,8 +85,8 @@ class OrderTableColumn extends Component {
         <div style={{ marginTop: 7 }}>{createdDate}</div>
       );
     }
-    if (columnAccessor === "_id") {
-      const id = order._id;
+    if (columnAccessor === "referenceId") {
+      const id = order.referenceId;
       const truncatedId = id.substring(0, 4);
       return (
         <div style={{ marginTop: 7 }}>

diff --git a/imports/plugins/core/orders/client/templates/list/pdf.html b/imports/plugins/core/orders/client/templates/list/pdf.html
@@ -49,7 +49,7 @@
         <div style="font-family:monospace; text-align: left;" class="col-xs-4 col-sm-3 col-md-3 col-lg-3">
           <h3>DATE:{{dateFormat order.createdAt format="MM/D/YY"}}</h3>
         </div>
-        <div style="font-family:monospace;" class="col-xs-6 col-xs-offset-3 col-sm-4 col-md-3 col-lg-3 col-md-offset-5">ORDER:{{order._id}}</div>
+        <div style="font-family:monospace;" class="col-xs-6 col-xs-offset-3 col-sm-4 col-md-3 col-lg-3 col-md-offset-5">ORDER:{{order.referenceId}}</div>
       </div>
       {{/if}}
     </div>

diff --git a/imports/plugins/core/orders/server/no-meteor/mutations/createOrder.js b/imports/plugins/core/orders/server/no-meteor/mutations/createOrder.js
@@ -382,6 +382,7 @@ export default async function createOrder(context, input) {
     currencyCode,
     discounts,
     email,
+    referenceId: Random.id(),
     shipping: chargedFulfillmentGroups,
     shopId,
     totalItemQuantity: chargedFulfillmentGroups.reduce((sum, group) => sum + group.totalItemQuantity, 0),

diff --git a/imports/plugins/core/orders/server/no-meteor/queries/index.js b/imports/plugins/core/orders/server/no-meteor/queries/index.js
@@ -1,5 +1,7 @@
 import orderById from "./orderById";
+import orderByReferenceId from "./orderByReferenceId";
 
 export default {
-  orderById
+  orderById,
+  orderByReferenceId
 };
diff --git a/imports/plugins/core/orders/server/no-meteor/queries/orderById.js b/imports/plugins/core/orders/server/no-meteor/queries/orderById.js
@@ -40,6 +40,7 @@ export default async function orderById(context, { orderId, shopId, token } = {}
   return Orders.findOne({
     _id: orderId,
     accountId,
-    anonymousAccessToken
+    anonymousAccessToken,
+    shopId
   });
 }
diff --git a/imports/plugins/core/orders/server/no-meteor/queries/orderByReferenceId.js b/imports/plugins/core/orders/server/no-meteor/queries/orderByReferenceId.js
@@ -0,0 +1,46 @@
+import ReactionError from "@reactioncommerce/reaction-error";
+import hashLoginToken from "/imports/node-app/core/util/hashLoginToken";
+
+/**
+ * @name orderByReferenceId
+ * @method
+ * @memberof Order/NoMeteorQueries
+ * @summary Query the Orders collection for an order with the provided order referenceId
+ * @param {Object} context - an object containing the per-request state
+ * @param {Object} params - request parameters
+ * @param {String} params.orderReferenceId - Order reference ID
+ * @param {String} params.shopId - Shop ID for the shop that owns the order
+ * @param {String} [params.token] - Anonymous order token
+ * @return {Promise<Object>|undefined} - An Order document, if one is found
+ */
+export default async function orderByReferenceId(context, { orderReferenceId, shopId, token } = {}) {
+  const { accountId: contextAccountId, collections, userHasPermission } = context;
+  const { Orders } = collections;
+
+  if (!orderReferenceId || !shopId) {
+    throw new ReactionError("invalid-param", "You must provide orderReferenceId and shopId arguments");
+  }
+
+  let accountId;
+  let anonymousAccessToken;
+  if (token) {
+    accountId = null;
+    anonymousAccessToken = hashLoginToken(token);
+  } else {
+    // Unless you are an admin with orders permission, you are limited to seeing it if you placed it
+    if (!userHasPermission(["orders"], shopId)) {
+      if (!contextAccountId) {
+        throw new ReactionError("access-denied", "Access Denied");
+      }
+      accountId = contextAccountId;
+    }
+    anonymousAccessToken = null;
+  }
+
+  return Orders.findOne({
+    accountId,
+    anonymousAccessToken,
+    referenceId: orderReferenceId,
+    shopId
+  });
+}
diff --git a/imports/plugins/core/orders/server/no-meteor/resolvers/Query/index.js b/imports/plugins/core/orders/server/no-meteor/resolvers/Query/index.js
@@ -1,5 +1,7 @@
 import orderById from "./orderById";
+import orderByReferenceId from "./orderByReferenceId";
 
 export default {
-  orderById
+  orderById,
+  orderByReferenceId
 };
diff --git a/imports/plugins/core/orders/server/no-meteor/resolvers/Query/orderByReferenceId.js b/imports/plugins/core/orders/server/no-meteor/resolvers/Query/orderByReferenceId.js
@@ -0,0 +1,24 @@
+import { decodeShopOpaqueId } from "@reactioncommerce/reaction-graphql-xforms/shop";
+
+/**
+ * @name Query.orderByReferenceId
+ * @method
+ * @memberof Order/GraphQL
+ * @summary Get an order by its reference ID
+ * @param {Object} parentResult - unused
+ * @param {ConnectionArgs} args - An object of all arguments that were sent by the client
+ * @param {String} args.id - reference ID of the order
+ * @param {String} args.shopId - shop ID of the order
+ * @param {String} [args.token] - An anonymous order token, required if the order was placed without being logged in
+ * @param {Object} context - An object containing the per-request state
+ * @return {Promise<Object>|undefined} An Order object
+ */
+export default async function orderByReferenceId(parentResult, args, context) {
+  const { id, shopId, token } = args;
+
+  return context.queries.orderByReferenceId(context, {
+    orderReferenceId: id,
+    shopId: decodeShopOpaqueId(shopId),
+    token
+  });
+}
diff --git a/imports/plugins/core/orders/server/no-meteor/schemas/schema.graphql b/imports/plugins/core/orders/server/no-meteor/schemas/schema.graphql
@@ -4,6 +4,9 @@ extend type Query {
 
   "Get all orders for a single account, optionally limited to certain shop IDs"
   ordersByAccountId(accountId: ID!, shopIds: [ID]): [Order]!
+
+  "Get an order by its reference ID (the ID shown to customers)"
+  orderByReferenceId(id: ID!, shopId: ID!, token: String): Order
 }
 
 enum OrderFulfillmentGroupItemsSortByField {
@@ -178,18 +181,24 @@ type Order implements Node {
   "The ID of the cart that created this order. Carts are deleted after becoming orders, so this is just a reference."
   cartId: ID
 
-  "One or more fulfillment groups. Each of these are fulfilled and charged as separate orders."
-  fulfillmentGroups: [OrderFulfillmentGroup]!
-
   "The date and time at which the cart was created, which is when the first item was added to it."
   createdAt: DateTime!
 
   "An email address that has been associated with the cart"
   email: String
 
+  "One or more fulfillment groups. Each of these are fulfilled and charged as separate orders."
+  fulfillmentGroups: [OrderFulfillmentGroup]!
+
   "Notes about the order. This will always return an array but it may be empty"
   notes: [OrderNote]!
 
+  """
+  An ID by which the customer can reference this order when enquiring about it. A storefront user
+  interface may show this to customers. Do not display other IDs (`_id`) to customers.
+  """
+  referenceId: String!
+
   "The shop through which the order was placed"
   shop: Shop!
 

diff --git a/imports/plugins/core/versions/server/migrations/47_order_ref.js b/imports/plugins/core/versions/server/migrations/47_order_ref.js
@@ -0,0 +1,27 @@
+import { Migrations } from "meteor/percolate:migrations";
+import { Orders } from "/lib/collections";
+import findAndConvertInBatches from "../util/findAndConvertInBatches";
+
+Migrations.add({
+  version: 47,
+
+  up() {
+    findAndConvertInBatches({
+      collection: Orders,
+      converter: (order) => {
+        if (!order.referenceId) order.referenceId = order._id;
+        return order;
+      }
+    });
+  },
+
+  down() {
+    Orders.update({
+      referenceId: { $exists: true }
+    }, {
+      $unset: {
+        referenceId: ""
+      }
+    }, { bypassCollection2: true });
+  }
+});
diff --git a/imports/plugins/core/versions/server/migrations/index.js b/imports/plugins/core/versions/server/migrations/index.js
@@ -44,3 +44,4 @@ import "./43_stripe_marketplace_pkg";
 import "./44_tax_rates_pkg";
 import "./45_tax_schema_changes";
 import "./46_cart_item_props";
+import "./47_order_ref";
diff --git a/imports/plugins/included/email-templates/server/index.js b/imports/plugins/included/email-templates/server/index.js
@@ -118,7 +118,7 @@ Reaction.registerTemplate({
   name: TemplatePaths.coreOrderNewTemplate,
   type: "email",
   template: Reaction.Email.getTemplateFile(TemplatePaths.coreOrderNewTemplate),
-  subject: "Your order is confirmed - {{order._id}}"
+  subject: "Your order is confirmed - {{order.referenceId}}"
 });
 
 /*
@@ -131,7 +131,7 @@ Reaction.registerTemplate({
   name: TemplatePaths.orderShipped,
   type: "email",
   template: Reaction.Email.getTemplateFile(TemplatePaths.orderShipped),
-  subject: "{{shop.name}}: Your order has shipped - {{order._id}}"
+  subject: "{{shop.name}}: Your order has shipped - {{order.referenceId}}"
 });
 
 /*
@@ -144,7 +144,7 @@ Reaction.registerTemplate({
   name: TemplatePaths.orderRefunded,
   type: "email",
   template: Reaction.Email.getTemplateFile(TemplatePaths.orderRefunded),
-  subject: "{{shop.name}}: Confirmation of refund for {{order._id}}"
+  subject: "{{shop.name}}: Confirmation of refund for {{order.referenceId}}"
 });
 
 /*
@@ -157,5 +157,5 @@ Reaction.registerTemplate({
   name: TemplatePaths.orderItemRefund,
   type: "email",
   template: Reaction.Email.getTemplateFile(TemplatePaths.orderItemRefund),
-  subject: "{{shop.name}}: Refund confirmation - {{order._id}}"
+  subject: "{{shop.name}}: Refund confirmation - {{order.referenceId}}"
 });
diff --git a/private/email/templates/orders/itemRefund.html b/private/email/templates/orders/itemRefund.html
@@ -191,7 +191,7 @@
                                         <table width="100%" border="0" cellspacing="0" cellpadding="0" class="emailwrapto100pc">
                                           <tbody>
                                             <tr>
-                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order._id}}</a></td>
+                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order.referenceId}}</a></td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">{{orderDate}}</td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">&nbsp;</td>
                                             </tr>

diff --git a/private/email/templates/orders/new.html b/private/email/templates/orders/new.html
@@ -182,7 +182,7 @@
                                         <table width="100%" border="0" cellspacing="0" cellpadding="0" class="emailwrapto100pc">
                                           <tbody>
                                             <tr>
-                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order._id}}</a></td>
+                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order.referenceId}}</a></td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">{{orderDate}}</td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">Not shipped</td>
                                             </tr>

diff --git a/private/email/templates/orders/refunded.html b/private/email/templates/orders/refunded.html
@@ -182,7 +182,7 @@
                                         <table width="100%" border="0" cellspacing="0" cellpadding="0" class="emailwrapto100pc">
                                           <tbody>
                                             <tr>
-                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order._id}}</a></td>
+                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order.referenceId}}</a></td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">{{orderDate}}</td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">&nbsp;</td>
                                             </tr>

diff --git a/private/email/templates/orders/shipped.html b/private/email/templates/orders/shipped.html
@@ -182,7 +182,7 @@
                                         <table width="100%" border="0" cellspacing="0" cellpadding="0" class="emailwrapto100pc">
                                           <tbody>
                                             <tr>
-                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order._id}}</a></td>
+                                              <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#1999dd; font-family:Arial, helvetica;"><a href="{{homepage}}{{orderUrl}}" style="color:#1999dd;">{{order.referenceId}}</a></td>
                                               <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">{{orderDate}}</td>
                                               {{#if shipping.tracking}}
                                                 <td width="33%" align="left" valign="top" style="font-size:14px; line-height:normal; color:#4c4c4d; font-family:Arial, helvetica;">{{shipping.carrier}}<br />{{shipping.tracking}}</td>