Return to Question

When customer or guest uses "reorder" Magento2 somehow verifies, that user have access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if user can return order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if form was created by Magento and doesn't verify if user owns the order]

Thank you in advance for any hints!

Following @Pmclain instructions I have created following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}
private function _validate($type,$orderId){/*$type = 'guest' || 'logged'*/
     if($type==='guest'){
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request); //TRUE if validated; resultRedirect Object if not
    }
    else{
        $validated = $this->_loggedAuthorization->canView($this->_order->load($orderId)); //TRUE if validated; FALSE if not
    }
    return $validated;
}

When customer or guest uses "reorder" Magento2 somehow verifies, that user has access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if the user can return an order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if the form was created by Magento and doesn't verify if the user owns the order]

Thank you in advance for any hints!

Following @pmclain instructions, I have created the following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}

/**
 * @param string $type (guest || logged)
 * @param int $orderId Order Id
 * @return bool|resultRedirect
 */
private function _validate($type, $orderId) 
{ 
    if($type === 'guest') {
        // TRUE if validated; resultRedirect Object if not
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request);  
    } else {
        //TRUE if validated; FALSE if not
        $validated = $this->_loggedAuthorization->canView($this->_order->load($orderId));
    }
    return $validated;
}

When customer or guest uses "reorder" Magento2 somehow verifies, that user have access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if user can return order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if form was created by Magento and doesn't verify if user owns the order]

Thank you in advance for any hints!

Following @Pmclain instructions I have created following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}
private function _validate($type){/*$type = 'guest' || 'logged'*/
    if($type==='guest'){
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request); //TRUE if validated; resultRedirect Object if not
    }
    else{
        $validated = $this->_loggedAuthorization->canView($this->_order->load($request['order_id']))); //TRUE if validated; FALSE if not
    }
    return $validated;
}

When customer or guest uses "reorder" Magento2 somehow verifies, that user have access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if user can return order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if form was created by Magento and doesn't verify if user owns the order]

Thank you in advance for any hints!

Following @Pmclain instructions I have created following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}
private function _validate($type,$orderId){/*$type = 'guest' || 'logged'*/
    if($type==='guest'){
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request); //TRUE if validated; resultRedirect Object if not
    }
    else{
        $validated = $this->_loggedAuthorization->canView($this->_order->load($orderId)); //TRUE if validated; FALSE if not
    }
    return $validated;
}

When customer or guest uses "reorder" Magento2 somehow verifies, that user have access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if user can return order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if form was created by Magento and doesn't verify if user owns the order]

Thank you in advance for any hints!

When customer or guest uses "reorder" Magento2 somehow verifies, that user have access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if user can return order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if form was created by Magento and doesn't verify if user owns the order]

Thank you in advance for any hints!

Following @Pmclain instructions I have created following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}
private function _validate($type){/*$type = 'guest' || 'logged'*/
    if($type==='guest'){
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request); //TRUE if validated; resultRedirect Object if not
    }
    else{
        $validated = $this->_loggedAuthorization->canView($this->_order->load($request['order_id']))); //TRUE if validated; FALSE if not
    }
    return $validated;
}