Pull request #2 · stacks/pet-store

Summary

Rolling PR for ongoing pet-store umbrella work (#1). Per the umbrella's working principle — anything rough/missing/hardcoded that surfaces while building this storefront is a fix to land in the framework / our libs — fixes here may touch both pet-store code and storage/framework/defaults/* (which should land upstream as a stacksjs/stacks PR).

Each commit is self-contained and references #1.

Commits in this PR

`fix(copy)`: 165°F dehydration spec + remove misleading freeze-dryer line

The umbrella's "Copy review" sub-task requires copy to reflect "dehydrated at 165°F for 18-36 hours" and never apply freeze-drying language to the launch line. Spec was missing entirely; standard.stx had a sourcing bullet that said "from slaughter to freeze-dryer".

resources/views/faq.stx — temp + duration added to the dehydrated answer
resources/views/standard.stx — bullet corrected; new "How we dehydrate" section documents the spec

`fix(security)`: capability-URL via uuid on `/orders/{id}`

The order detail page looked up by sequential numeric id with no ownership check, leaking customer name, email, shipping address, items, and total to anyone walking /orders/1, /orders/2, …. The Order model already had useUuid: true and a comment asserting the view re-validates ownership — but it didn't.

Switched to a Shopify/Stripe-style capability URL: the unguessable uuid in the URL is the proof of ownership.

storage/framework/defaults/app/Actions/Storefront/PlaceOrderAction.ts — generates crypto.randomUUID() before insert (raw query-builder insert bypasses the useUuid hook), looks the order up by uuid, redirects + emails using uuid
Both /orders/{id}.stx views (framework default + pet-store mirror) validate the param against a uuid regex and look up WHERE uuid = ?. Numeric ids rejected — falling back would re-open the hole.
Doc updates: Order.ts, OrderConfirmation.ts, SubmitReviewAction.ts

The framework-default change should land upstream as a stacksjs/stacks PR.

Test plan

bunx --bun pickier . clean
Place a guest checkout end-to-end → verify redirect lands on /orders/<uuid> (not numeric id) and the page renders
Open /orders/1 (or any numeric path) → expect "Order not found"
Open /orders/<random-uuid-not-in-db> → expect "Order not found"
Receipt email link is /orders/<uuid> and resolves
Review submission from the order page still works (uses numeric order.id from the form, server-side email check)
Visit /standard and /faq → both show 165°F / 18-36h spec; no "freeze-dryer" applied to the launch line

Refs: #1

🤖 Generated with Claude Code