add order status lookup for customers

Magic link flow on contact page: customer enters email, gets a
time-limited signed link, clicks through to /orders showing all their
paid orders and full detail pages with thumbnails and product links.

- OrderLookupController generates/verifies Phoenix.Token signed links
- Contact LiveView handles lookup_orders + reset_tracking events
- Orders and OrderDetail LiveViews gated by session email
- Order detail shows thumbnails, links to products still available
- .themed-button gets base padding/font-weight so all usages are consistent
- order-summary-card sticky scoped to .cart-grid (was leaking to orders list)
- 27 new tests (1095 total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/berrypod/orders/order_notifier_test.exs

@@ -93,6 +93,20 @@ defmodule Berrypod.Orders.OrderNotifierTest do
     end
   end
 
+  describe "deliver_order_lookup/2" do
+    test "sends magic link email" do
+      link = "https://example.com/orders/verify/tok"
+      assert {:ok, _email} = OrderNotifier.deliver_order_lookup("buyer@example.com", link)
+
+      assert_email_sent(fn email ->
+        assert email.to == [{"", "buyer@example.com"}]
+        assert email.subject == "Your order lookup link"
+        assert email.text_body =~ link
+        assert email.text_body =~ "expires in 1 hour"
+      end)
+    end
+  end
+
   describe "deliver_shipping_notification/1" do
     test "sends notification with tracking info" do
       {order, _v, _p, _c} = submitted_order_fixture(%{customer_email: "buyer@example.com"})

test/berrypod/orders_test.exs

@@ -1,6 +1,7 @@
 defmodule Berrypod.OrdersTest do
   use Berrypod.DataCase, async: false
 
+  import Ecto.Query
   import Mox
   import Berrypod.OrdersFixtures
 
@@ -216,4 +217,62 @@ defmodule Berrypod.OrdersTest do
       assert is_nil(Orders.get_order_by_number("SS-000000-XXXX"))
     end
   end
+
+  describe "list_orders_by_email/1" do
+    test "returns paid orders for the given email" do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      results = Orders.list_orders_by_email("buyer@example.com")
+      ids = Enum.map(results, & &1.id)
+
+      assert order.id in ids
+    end
+
+    test "excludes pending and failed orders" do
+      order_fixture(%{customer_email: "buyer@example.com"})
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "failed"})
+
+      assert Orders.list_orders_by_email("buyer@example.com") == []
+    end
+
+    test "excludes other customers' orders" do
+      order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      assert Orders.list_orders_by_email("buyer@example.com") == []
+    end
+
+    test "is case-insensitive" do
+      order = order_fixture(%{customer_email: "Buyer@Example.COM", payment_status: "paid"})
+
+      results = Orders.list_orders_by_email("buyer@example.com")
+      ids = Enum.map(results, & &1.id)
+
+      assert order.id in ids
+    end
+
+    test "preloads items" do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      [order] = Orders.list_orders_by_email("buyer@example.com")
+      assert Ecto.assoc_loaded?(order.items)
+    end
+
+    test "returns newest first" do
+      old = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+      new = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      # Force different inserted_at by updating order records
+      now = DateTime.utc_now() |> DateTime.truncate(:second)
+      earlier = DateTime.add(now, -60, :second)
+
+      Berrypod.Repo.update_all(
+        from(o in Berrypod.Orders.Order, where: o.id == ^old.id),
+        set: [inserted_at: earlier]
+      )
+
+      [first, second] = Orders.list_orders_by_email("buyer@example.com")
+      assert first.id == new.id
+      assert second.id == old.id
+    end
+  end
 end

test/berrypod_web/live/shop/contact_test.exs

@@ -0,0 +1,97 @@
+defmodule BerrypodWeb.Shop.ContactTest do
+  use BerrypodWeb.ConnCase, async: false
+
+  import Phoenix.LiveViewTest
+  import Swoosh.TestAssertions
+  import Berrypod.AccountsFixtures
+  import Berrypod.OrdersFixtures
+
+  setup do
+    user_fixture()
+    {:ok, _} = Berrypod.Settings.set_site_live(true)
+    # drain the confirmation email user_fixture sends so it doesn't leak into assertions
+    receive do
+      {:email, _} -> :ok
+    after
+      0 -> :ok
+    end
+
+    :ok
+  end
+
+  describe "contact page" do
+    test "renders the contact page", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/contact")
+
+      assert html =~ "Get in touch"
+      assert html =~ "Track your order"
+    end
+
+    test "shows order lookup form by default", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/contact")
+
+      assert html =~ "Enter the email address you used at checkout"
+      assert html =~ "Send link"
+    end
+  end
+
+  describe "order lookup" do
+    test "sends magic link when orders exist for email", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "Check your inbox"
+      assert html =~ "sent a link to your email address"
+      assert_email_sent(to: "buyer@example.com", subject: "Your order lookup link")
+    end
+
+    test "shows not-found state for unknown email", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "nobody@example.com"})
+
+      assert html =~ "No orders found for that address"
+      assert html =~ "Try again"
+      assert_no_email_sent()
+    end
+
+    test "is case-insensitive for email lookup", %{conn: conn} do
+      order_fixture(%{customer_email: "Buyer@Example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "Check your inbox"
+      # link is sent to the typed address, not the stored one
+      assert_email_sent(to: "buyer@example.com")
+    end
+
+    test "ignores pending/failed orders", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com"})
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "failed"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "No orders found for that address"
+      assert_no_email_sent()
+    end
+
+    test "reset button returns to idle form", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+      render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      html = render_click(view, "reset_tracking")
+
+      assert html =~ "Enter the email address you used at checkout"
+      assert html =~ "Send link"
+    end
+  end
+end

test/berrypod_web/live/shop/orders_test.exs

@@ -0,0 +1,145 @@
+defmodule BerrypodWeb.Shop.OrdersTest do
+  use BerrypodWeb.ConnCase, async: false
+
+  import Phoenix.LiveViewTest
+  import Berrypod.AccountsFixtures
+  import Berrypod.OrdersFixtures
+
+  setup do
+    user_fixture()
+    {:ok, _} = Berrypod.Settings.set_site_live(true)
+    :ok
+  end
+
+  defp with_lookup_email(conn, email) do
+    conn
+    |> Phoenix.ConnTest.init_test_session(%{})
+    |> Plug.Conn.put_session("order_lookup_email", email)
+  end
+
+  describe "orders list — no session email" do
+    test "shows expired link message", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "expired or is invalid"
+    end
+  end
+
+  describe "orders list — with session email" do
+    setup %{conn: conn} do
+      %{conn: with_lookup_email(conn, "buyer@example.com")}
+    end
+
+    test "shows email address in header", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "buyer@example.com"
+    end
+
+    test "shows empty state when no paid orders", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "No orders found for that email address"
+    end
+
+    test "lists paid orders for the session email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ order.order_number
+      assert html =~ "Test product"
+    end
+
+    test "does not show other customers' orders", %{conn: conn} do
+      other = order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      refute html =~ other.order_number
+    end
+
+    test "links to order detail page", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ ~p"/orders/#{order.order_number}"
+    end
+  end
+
+  describe "order detail" do
+    setup %{conn: conn} do
+      %{conn: with_lookup_email(conn, "buyer@example.com")}
+    end
+
+    test "renders order detail for matching email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ order.order_number
+      assert html =~ "Test product"
+    end
+
+    test "redirects if order belongs to different email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert to == ~p"/orders"
+    end
+
+    test "redirects if order is not paid", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com"})
+
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert to == ~p"/orders"
+    end
+
+    test "redirects if order number is unknown", %{conn: conn} do
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/SS-UNKNOWN-0000")
+
+      assert to == ~p"/orders"
+    end
+
+    test "shows tracking card when tracking number present", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, order} =
+        Berrypod.Orders.update_fulfilment(order, %{
+          fulfilment_status: "shipped",
+          tracking_number: "RM123456789GB"
+        })
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ "Shipment tracking"
+      assert html =~ "RM123456789GB"
+    end
+
+    test "shows shipping address when present", %{conn: conn} do
+      order =
+        order_fixture(%{
+          customer_email: "buyer@example.com",
+          payment_status: "paid",
+          shipping_address: %{
+            "name" => "Jane Doe",
+            "line1" => "42 Test Street",
+            "city" => "London",
+            "postal_code" => "SW1A 1AA",
+            "country" => "GB"
+          }
+        })
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ "Jane Doe"
+      assert html =~ "42 Test Street"
+      assert html =~ "London"
+    end
+  end
+end