Map orders and invoices securely in the customer account
Plan order views and invoice retrieval around sources and permissions. A worked test case covers direct access and switching companies.
An order list in a customer account should show only transactions the signed-in person may access in the selected company context. An invoice also needs the correct link to the document and its source. A visible download button alone does not solve that task.
Define the data scope first
Shopify shows order history and company locations as account functions. This does not promise that every customer account contains all orders from the business management software (ERP) and invoice files. Specify which orders and periods your application includes and which system supplies invoices. An imported order may be visible while its document is still missing.
Explicitly link the order, company account and invoice reference. A similar document number or the same company name is not a reliable mapping. An order may have several associated documents; the interface needs to show the documents actually supplied with clear labels.
Agree on a worked access scenario
All identifiers and results in the following table are fictional requirements for a planned portal. They describe neither an executed test nor a product's default configuration.
Starting point | Request | Expected result |
|---|---|---|
Test account may view company | Order | Order data visible in the correct company context |
Same account has document permission for | Associated invoice | Exactly this document can be retrieved |
Test account belongs only to company | Direct retrieval of | No other company's file or protected document details |
Invoice source for | Open invoice area | Document currently unavailable; no invented invoice |
Check using suitable test accounts and test documents. This must cover direct file retrieval even when the other company's invoice never appears in the list.
Enforce permissions on every request
OWASP requires an authorisation check on the requested object. Check the user, permitted company scope, document mapping and requested action on the server. A browser filter or a hard-to-guess identifier does not replace that decision. The route to the file must also meet the access policy.
Define what happens on a new request after permissions change. When switching companies is permitted, cached orders from the previous company must not appear as data belonging to the newly selected company. Check lists, detail views and download references after the switch as well.
Explain missing data clearly
Distinguish an empty order history from an unreachable source. “Invoice not yet available” and “no access” are also different states; the display must preserve the agreed confidentiality. A portal view should neither invent a payment status nor treat a missing file as business confirmation.
The trial establishes which views are permitted and which requests are blocked. Order association, document source and access need to fit together before the function can reliably become part of the customer account.
Sources
Read more
All articles
E-Commerce with ASES
Online shops, marketplaces and B2B portals