[eicyer]

Summary

When a seller used Add order for a Zelle or cash sale, the order was saved under the seller's own name and NetID, so the orders list (which clubs like Project Hope use as a mailing list) showed the admin instead of the real buyer. The manual order form now asks for the buyer's name and NetID, and the seller views show them.

Task: Add buyer name and NetID fields to manual orders (merged with "Add buyer NetID to manual orders", Oct 19)

Storage decision: the buyer is stored as free text on the order (buyer_name, buyer_net_id). buyerId still points at the seller who entered it. Linking to a PendingUser would mean making Order.buyerId nullable, which ripples through emails, access checks, analytics, and the shared schemas. The trade-off: a manual order won't appear in the real buyer's account if they sign in later. The stored NetID makes that a straightforward follow-up if we want it.

Changes

backend

• Migration adds nullable buyer_name and buyer_net_id to orders. Existing rows stay NULL and keep showing the account holder, so no backfill is needed.
• createOrder saves the two fields.
• createOrderHandler returns 403 if a non-admin sends buyer details, so buyers can't put a different name on their own orders.

common

• CreateOrderBody accepts optional buyerName and buyerNetId. They must be sent together, and the NetID is trimmed, lowercased, and must look like abc123.
• BasicOrderSchema includes the two fields.

frontend

• ManualOrderModal: a required "Buyer" section with Name and NetID. A pasted abc123@cornell.edu is accepted.
• New lib/order-buyer.ts helper prefers the entered buyer and falls back to the account holder. It's used by the orders table name/NetID columns (and therefore the name/NetID filter), the CSV export, and the seller order detail page.
• For manual orders, the CSV Email column is <netid>@cornell.edu.

Not in this PR: the order confirmation email for manual orders still goes to the seller. That's the separate "skip confirmation email for admin-created orders" ticket, which is still needed because orders aren't linked to the buyer's account.

How to test

1. pnpm assemble, then cd backend && pnpm migrate:dev.
2. As a seller (org admin), open a fundraiser's Orders tab and click Add order.
3. Check that Save stays disabled until a name, a valid NetID, and at least one item are entered, and that jd@x shows the NetID error.
4. Save the order. The table should show the entered name and NetID, filtering by either should find it, and Export should put them in the CSV.
5. Open the order's detail page. Customer and Buyer Info should show the entered buyer.
6. Regular buyer orders should look unchanged.

cd backend && pnpm test covers saving the fields and the request validation.

Screenshots

Orders table: the manual order shows the entered buyer instead of the admin.

Add order form: new Buyer section, filled in.

NetID validation:

Order detail page: Customer and Buyer Info use the entered buyer.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
curaise	Ready	Preview	Oct 29, 2026 4:07pm UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Emir icyer seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: bade7c37-b6d2-4e9b-9046-6971e5f9ba0c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}