add order status lookup for customers

Magic link flow on contact page: customer enters email, gets a
time-limited signed link, clicks through to /orders showing all their
paid orders and full detail pages with thumbnails and product links.

- OrderLookupController generates/verifies Phoenix.Token signed links
- Contact LiveView handles lookup_orders + reset_tracking events
- Orders and OrderDetail LiveViews gated by session email
- Order detail shows thumbnails, links to products still available
- .themed-button gets base padding/font-weight so all usages are consistent
- order-summary-card sticky scoped to .cart-grid (was leaking to orders list)
- 27 new tests (1095 total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/berrypod_web/live/shop/contact_test.exs

@@ -0,0 +1,97 @@
+defmodule BerrypodWeb.Shop.ContactTest do
+  use BerrypodWeb.ConnCase, async: false
+
+  import Phoenix.LiveViewTest
+  import Swoosh.TestAssertions
+  import Berrypod.AccountsFixtures
+  import Berrypod.OrdersFixtures
+
+  setup do
+    user_fixture()
+    {:ok, _} = Berrypod.Settings.set_site_live(true)
+    # drain the confirmation email user_fixture sends so it doesn't leak into assertions
+    receive do
+      {:email, _} -> :ok
+    after
+      0 -> :ok
+    end
+
+    :ok
+  end
+
+  describe "contact page" do
+    test "renders the contact page", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/contact")
+
+      assert html =~ "Get in touch"
+      assert html =~ "Track your order"
+    end
+
+    test "shows order lookup form by default", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/contact")
+
+      assert html =~ "Enter the email address you used at checkout"
+      assert html =~ "Send link"
+    end
+  end
+
+  describe "order lookup" do
+    test "sends magic link when orders exist for email", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "Check your inbox"
+      assert html =~ "sent a link to your email address"
+      assert_email_sent(to: "buyer@example.com", subject: "Your order lookup link")
+    end
+
+    test "shows not-found state for unknown email", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "nobody@example.com"})
+
+      assert html =~ "No orders found for that address"
+      assert html =~ "Try again"
+      assert_no_email_sent()
+    end
+
+    test "is case-insensitive for email lookup", %{conn: conn} do
+      order_fixture(%{customer_email: "Buyer@Example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "Check your inbox"
+      # link is sent to the typed address, not the stored one
+      assert_email_sent(to: "buyer@example.com")
+    end
+
+    test "ignores pending/failed orders", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com"})
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "failed"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+
+      html = render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      assert html =~ "No orders found for that address"
+      assert_no_email_sent()
+    end
+
+    test "reset button returns to idle form", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, view, _html} = live(conn, ~p"/contact")
+      render_submit(view, "lookup_orders", %{"email" => "buyer@example.com"})
+
+      html = render_click(view, "reset_tracking")
+
+      assert html =~ "Enter the email address you used at checkout"
+      assert html =~ "Send link"
+    end
+  end
+end

test/berrypod_web/live/shop/orders_test.exs

@@ -0,0 +1,145 @@
+defmodule BerrypodWeb.Shop.OrdersTest do
+  use BerrypodWeb.ConnCase, async: false
+
+  import Phoenix.LiveViewTest
+  import Berrypod.AccountsFixtures
+  import Berrypod.OrdersFixtures
+
+  setup do
+    user_fixture()
+    {:ok, _} = Berrypod.Settings.set_site_live(true)
+    :ok
+  end
+
+  defp with_lookup_email(conn, email) do
+    conn
+    |> Phoenix.ConnTest.init_test_session(%{})
+    |> Plug.Conn.put_session("order_lookup_email", email)
+  end
+
+  describe "orders list — no session email" do
+    test "shows expired link message", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "expired or is invalid"
+    end
+  end
+
+  describe "orders list — with session email" do
+    setup %{conn: conn} do
+      %{conn: with_lookup_email(conn, "buyer@example.com")}
+    end
+
+    test "shows email address in header", %{conn: conn} do
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "buyer@example.com"
+    end
+
+    test "shows empty state when no paid orders", %{conn: conn} do
+      order_fixture(%{customer_email: "buyer@example.com"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ "No orders found for that email address"
+    end
+
+    test "lists paid orders for the session email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ order.order_number
+      assert html =~ "Test product"
+    end
+
+    test "does not show other customers' orders", %{conn: conn} do
+      other = order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      refute html =~ other.order_number
+    end
+
+    test "links to order detail page", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders")
+
+      assert html =~ ~p"/orders/#{order.order_number}"
+    end
+  end
+
+  describe "order detail" do
+    setup %{conn: conn} do
+      %{conn: with_lookup_email(conn, "buyer@example.com")}
+    end
+
+    test "renders order detail for matching email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ order.order_number
+      assert html =~ "Test product"
+    end
+
+    test "redirects if order belongs to different email", %{conn: conn} do
+      order = order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert to == ~p"/orders"
+    end
+
+    test "redirects if order is not paid", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com"})
+
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert to == ~p"/orders"
+    end
+
+    test "redirects if order number is unknown", %{conn: conn} do
+      {:error, {:live_redirect, %{to: to}}} = live(conn, ~p"/orders/SS-UNKNOWN-0000")
+
+      assert to == ~p"/orders"
+    end
+
+    test "shows tracking card when tracking number present", %{conn: conn} do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      {:ok, order} =
+        Berrypod.Orders.update_fulfilment(order, %{
+          fulfilment_status: "shipped",
+          tracking_number: "RM123456789GB"
+        })
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ "Shipment tracking"
+      assert html =~ "RM123456789GB"
+    end
+
+    test "shows shipping address when present", %{conn: conn} do
+      order =
+        order_fixture(%{
+          customer_email: "buyer@example.com",
+          payment_status: "paid",
+          shipping_address: %{
+            "name" => "Jane Doe",
+            "line1" => "42 Test Street",
+            "city" => "London",
+            "postal_code" => "SW1A 1AA",
+            "country" => "GB"
+          }
+        })
+
+      {:ok, _view, html} = live(conn, ~p"/orders/#{order.order_number}")
+
+      assert html =~ "Jane Doe"
+      assert html =~ "42 Test Street"
+      assert html =~ "London"
+    end
+  end
+end