How reorder verifies guest and logged in user

Question

When customer or guest uses "reorder" Magento2 somehow verifies, that user has access to order details (either logged in person owns order or guest verified that it is his order through /sales/guest/form/). I am trying to use the same mechanism to verify if the user can return an order, but I can't find out how Magento2 verifies the user. Does anyone know? So far I have tried:

1. $this->_customerSession->authenticate($loginUrl) [doesn't work at all with guest and doesn't verify if logged in user owns the order]
2. $this->_formKeyValidator->validate($this->getRequest()) [checks only if the form was created by Magento and doesn't verify if the user owns the order]

Thank you in advance for any hints!

Following @pmclain instructions, I have created the following code, which is working. Thank you!

public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Framework\App\Request\Http $request,
    \Magento\Sales\Api\Data\OrderInterface $order,
    \Magento\Sales\Controller\AbstractController\OrderViewAuthorization $loggedAuthorization,
    \Magento\Sales\Helper\Guest $guestAuthorization
){
    $this->_request = $request;
    $this->_order = $order;
    $this->_loggedAuthorization = $loggedAuthorization;
    $this->_guestAuthorization = $guestAuthorization;
    parent::__construct($context);
}

/**
 * @param string $type (guest || logged)
 * @param int $orderId Order Id
 * @return bool|resultRedirect
 */
private function _validate($type, $orderId)
{
    if($type === 'guest') {
        // TRUE if validated; resultRedirect Object if not
        $validated = $this->_guestAuthorization->loadValidOrder($this->_request); 
    } else {
        //TRUE if validated; FALSE if not
        $validated = $this->_loggedAuthorization->canView($this->_order->load($orderId));
    }
    return $validated;
}

Answer 1

Guests

The controllers for sales/guest/view, Magento\Sales\Controller\Guest\View and sales/guest/reorder, Magento\Sales\Controller\Guest\Reorder are using the same helper class, Magento\Sales\Helper\Guest to validate the guest has access to an order.

The controllers are loading the order using Magento\Sales\Helper\Guest::loadValidOrder which uses a few methods to validate the guest.

1. User Input - This function is used to validate the user input from the form on /sales/guest/form matches the order loaded using the supplied increment_id. If so, the loaded order's protect_code and increment_id are base64 encoded and returned in a cookie named 'guest-view'.
2. With a cookie - The cookie named 'guest-view' contains the order's protect_code and increment_id base64 encoded. The helper loads the order by increment_id and validates the protect_code from the cookie is a match.

When either of these validation methods is passed the order is set in the registry as the current_order, else it returns an error.

Logged-in Customers

The OrderLoader class used is Magento\Sales\Controller\AbstractController\OrderLoader instead of Magento\Sales\Controller\Guest\OrderLoader (used for guests). This class uses Magento\Sales\Controller\AbstractController\OrderViewAuthorization::canView for validating the current user can access the order and subsequently perform a reorder request. This function verifies the current user's customer_id matches the requested order's customer_id and that the order has a status allowing frontend visibility.

Answer 2

quote table has a column with remote_ip in it.

It basically uses that to see if user has any relevant quote record for it. Based on that it can figure out if there has been any orders placed by that user.

Every time order is placed it has association to quote item. Hence knowing Quote you can fetch all orders. sales_order has a quote_id column in it.

Generally quote is your cart information.