From 1f6c69092aff4c381024ad03f8f24913f1935dc8 Mon Sep 17 00:00:00 2001
From: Austin Chandra <ac@achandra.io>
Date: Thu, 5 Mar 2026 15:55:26 -0800
Subject: [PATCH] add user-facing order lookup

---
 src/handlers/checkout.py |  2 +-
 src/handlers/printful.py |  2 +-
 src/handlers/user.py     | 57 ++++++++++++++++++++++++++++++++++++++++
 src/lib/errors.py        |  6 +++++
 4 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 src/handlers/user.py

diff --git a/src/handlers/checkout.py b/src/handlers/checkout.py
index 9b0dbba..6fce316 100644
--- a/src/handlers/checkout.py
+++ b/src/handlers/checkout.py
@@ -10,7 +10,7 @@
 
 from lib.types import StripeCheckout
 
-db = Database(url=os.getenv("DATABASE_URL"))
+db = Database(url=os.environ["DATABASE_URL"])
 stripe.api_key = get_api_key()
 
 
diff --git a/src/handlers/printful.py b/src/handlers/printful.py
index 99e39a8..6609e47 100644
--- a/src/handlers/printful.py
+++ b/src/handlers/printful.py
@@ -10,7 +10,7 @@
 
 load_dotenv()
 
-db = Database(url=os.getenv("DATABASE_URL"))
+db = Database(url=os.environ["DATABASE_URL"])
 log = Logs(log_group=os.environ["LOG_GROUP"])
 notify = Notify(topic_arn=os.environ["SNS_TOPIC_ARN"], phone=os.environ["NOTIFY_PHONE"])
 queue = Queue(queue_url=os.environ["PRINTFUL_QUEUE_URL"])
diff --git a/src/handlers/user.py b/src/handlers/user.py
new file mode 100644
index 0000000..3bf3f6a
--- /dev/null
+++ b/src/handlers/user.py
@@ -0,0 +1,57 @@
+import json
+import os
+
+from dotenv import load_dotenv
+
+from lib.db import Database
+from lib.errors import HttpError
+
+load_dotenv()
+
+db = Database(url=os.environ["DATABASE_URL"])
+
+
+def handler(event, context):
+    """
+    Wrap a user order query with error-handling exception logic.
+    """
+    try:
+        return _handle(event)
+    except HttpError as e:
+        return {"statusCode": e.status, "body": json.dumps({"error": e.message})}
+
+
+def _handle(event):
+    """
+    Serve user order lookups given an order ID and email.
+    """
+    path_params = event.get("pathParameters") or {}
+    query_params = event.get("queryStringParameters") or {}
+
+    order_id = path_params.get("id")
+    email = query_params.get("email")
+
+    if not order_id or not email:
+        raise HttpError(400, "missing required parameters")
+
+    try:
+        order_id = int(order_id)
+    except ValueError:
+        raise HttpError(400, "invalid order id")
+
+    order = db.get_order(order_id)
+
+    if order is None or order.email != email:
+        raise HttpError(404, "order not found or email is invalid")
+
+    tracking_urls = [s.tracking_url for s in order.shipments if s.tracking_url]
+
+    return {
+        "statusCode": 200,
+        "body": json.dumps(
+            {
+                "receipt_url": order.receipt_url,
+                "tracking_urls": tracking_urls,
+            }
+        ),
+    }
diff --git a/src/lib/errors.py b/src/lib/errors.py
index 8163e03..32c76cf 100644
--- a/src/lib/errors.py
+++ b/src/lib/errors.py
@@ -1,3 +1,9 @@
+class HttpError(Exception):
+    def __init__(self, status: int, message: str):
+        self.status = status
+        self.message = message
+
+
 class StripeException(Exception):
     """
     This error type stands for an error processing a