Order Management
Purpose
Describe discovered customer/creator order surfaces and the verified sample-order concurrency protection.
Eligible Users and Roles
Customers viewing their orders, creators handling authorized work, and administrators through the separate Admin fixture.
Prerequisites
Use synthetic orders in an isolated fixture. Do not access another user's identifiers or real order data.
How to Open This Feature
Use the authenticated order/history destination available to the role. Administrator sample-order actions require port 3007.
Step-by-Step Instructions
Step 1: Open the Authorized Order List
Confirm only role-authorized records are returned.
Step 2: Open One Order
Verify persisted totals/status and refresh behavior. Cross-user authorization breadth is Not Tested in this audit.
Step 3: Perform One Allowed Transition
Only use a documented synthetic transition. Invalid steps must fail without partial update.
Step 4: Verify Concurrent Sample-Order Protection
The backend now locks the canonical sample-order row before admin transition validation. A deterministic race produced one success, one stale rejection, and one history event.
Possible States
Listed and Detailed
Sampled customer/creator reads were operated.
Pending or In Progress
State names vary by order type; do not infer transitions beyond current server rules.
Completed, Cancelled, Rejected, or Failed
The complete browser portfolio is Not Tested.
Concurrent Stale Transition
The stale admin waiter is rejected after the winning transaction commits.
Input Rules and Limits
Order identifiers, ownership, status transitions, cancellations, tracking, and financial effects must be enforced server-side. Exhaustive invalid transition and cross-user matrices remain Not Tested.
Common Problems and Recovery
- Reload authoritative status after an ambiguous transition.
- Do not repeat a state mutation merely because the first response was delayed.
- Escalate mismatched history rather than editing records manually.
Important Warnings
Order, address, payment, and tracking data may be sensitive. Keep fixtures synthetic and redacted.
What Happens Next
The order proceeds only through server-approved transitions; event-delivery timing remains subject to the unresolved outbox backlog policy.