The Receipt in JavaScript

Once an order is paid, the shop sends a receipt. The server posts a small JSON object (to, subject, body) to the mail service at http://127.0.0.1:8003/send, the same kind of call as the payment. But the mail service can be down, and by then the card is already charged. So a paid order still answers 201, and the failed receipt is logged with console.error instead of failing the checkout.

fetch throws only when no answer arrives at all. A 503 is an answer, with ok set to false, so you throw that error yourself. Then one catch handles both kinds of failure. For example, a text message service:

const sms = await fetch(SMS_URL + "/text", { method: "POST", … });
if (!sms.ok) {
  throw new Error("the SMS service answered " + sms.status);
}

The page then goes to /orders/8 and asks GET /api/orders/8. Ids are easy to guess, so the route shows an order only to its owner. The owner check goes in the query's WHERE. Anyone else gets 404, the same answer as for an order that doesn't exist.

Your app must answer:

> click "Pay"   →  the page goes to /orders/8: Order 8, Status: paid, Total: $41
GET /sent (mail service)  →  200  [{"to": "ana@example.com", "subject": "Your order 8 is paid", …}]
Ben: GET /api/orders/8    →  404  {"error": "Order not found"}
Ben: GET /api/orders/2    →  200  {"id": 2, "status": "paid", "total": 29}
mail service failing: POST /api/checkout  →  201  {"id": 9, "total": 24}
  console.error: Receipt for order 9 not sent: the mail service answered 503

Your task: in server/app.js, inside the given try, build the receipt and post it to MAIL_URL + "/send". Throw an error when the answer isn't ok, and log it in the catch. Then, in the new GET /api/orders/:id route, read the order only if it belongs to req.user, and answer 404 {"error": "Order not found"} when there is none.

Assignment
Follow the Coding Tutorial to send the receipt without letting a mail failure fail a paid order, and to show each order only to the user who placed it.

Hint
The owner check is a second condition in the WHERE: customers.email = ?, with req.user.email. When no row matches, .get gives back undefined.