Installation notes

The standard composer require + setup:upgrade + setup:di:compile flow applies. The points below cover what's specific to this module.

Required dependency

This module requires wimakeit/module-core ^3.2. Composer will pull it automatically from the Wimakeit registry as long as the registry is declared in your project's composer.json.

What the installation changes

• Two tables are created: wimakeit_guest_order_link_proof (which accounts proved their address; stores a hash, not the address) and wimakeit_guest_order_link_claim (when the last email was sent).
• sales_order is not altered.
• No JavaScript and no static file: setup:static-content:deploy is not needed for this module.

Nothing happens until you enable it

The module is off by default. While it is off, nothing is linked and no email is sent. Enable it per website under Stores → Configuration → Wimakeit → Guest Order Link, or:

bin/magento config:set --scope=websites --scope-code=<code> wimakeit_guest_order_link/general/enabled 1
bin/magento cache:clean config

ACL permissions

After installation, the following ACL resource is available under System → Permissions → User Roles:

Configuration

All settings are scoped to the website, because a customer account is: a customer who ordered on two store views of the same website gets both orders back.

Guest orders - link to the customer account

Email "Add your orders to your account"

Login - message when no account exists

How proof of email ownership works

With Require proof of email ownership on, guest orders are linked only once the account holder has clicked a link received at the account's address:

The link is signed with the installation's encryption key and expires. It does nothing without a session logged in to the account, so a mail scanner opening it triggers nothing. One email is sent per link lifetime, however many guest orders the customer places in the meantime.

Linking the existing order history

At installation no account has proved its address yet. Run the catch-up command once. It covers every website unless you pass --website, and it sends emails only on the websites where linking is enabled:

bin/magento wimakeit:guest-orders:link --dry-run     # 1. count, writes nothing, sends nothing
bin/magento wimakeit:guest-orders:link               # 2. run
bin/magento wimakeit:guest-orders:link --dry-run     # 3. check

Accounts that have proved their address get their orders linked. The others receive the email, and their orders are linked as they click. The first real run therefore sends one email to each account that has guest orders: check the count with --dry-run first.

Worth knowing

• Turning proof off. Orders are then linked as soon as the account is created, and later guest orders placed with an account's address go straight to it. Only do this on a store where Magento's account confirmation is required: otherwise whoever registers with someone else's address reads that person's guest orders.
• Linking at order placement. Anyone can place a guest order with the address of a proven account, and it lands in that account's history. Nothing leaks from the account, but its holder sees an order they did not place. With the address book options on, the address typed at checkout is also added to the account.
• "No account exists" message. It lets anyone check whether an address has an account, which Magento's native messages avoid on purpose. Forgotten password requests stay rate-limited by Magento. On the login form, enable it only with a captcha (customer/captcha/forms).
• Customer group. The group stored on an order is a snapshot taken at purchase time and it carries a tax class. Overwriting it relabels past sales in reports without recalculating the tax already stored, which is why the option is off by default.
• Order save. Each linked order goes through OrderRepository::save(): the order grid is resynchronised and sales_order_save_after observers run. Test it on a project that exports orders to an ERP on save.
• Up to 50 orders are linked per customer action, to keep the request fast. The catch-up command picks up the rest.
• Password reset as proof relies on the core passing the account's email to AccountManagement::resetPassword(), verified on Magento 2.4.6-p4, 2.4.7 and Mage-OS 3.x. On older cores this path links nothing; the email link and the account confirmation still work.
• Large order tables. No index is added on sales_order.customer_email. Beyond roughly 100,000 orders, add an index on (customer_email, store_id) in your project.
• A failure never blocks account creation or the order: it is logged in var/log/ (lines starting with Guest order link:).

Cron jobs

None.