Admin can search orders by order ID or customer identifier

An admin who cannot search orders by identifier cannot do their job. When a customer contacts support with 'my order ORD-48291 hasn't arrived', the admin must be able to pull up that record in under 10 seconds. Without server-side search across at least order ID and customer email, admins are left scrolling a paginated list — and for stores with hundreds of orders, that means support contacts go unresolved or require direct database access. CWE-285 applies here in an operational context: the admin role lacks the access controls and tooling its responsibilities require. iso-25010:2011 operability demands that the system is usable by the people maintaining it.

Add a ?q= search parameter to the admin orders API at app/api/admin/orders/route.ts with an OR query across order ID and customer email.

// app/api/admin/orders/route.ts
const query = new URL(req.url).searchParams.get('q')

const where = query
  ? {
      OR: [
        { id: { contains: query } },
        { user: { email: { contains: query, mode: 'insensitive' as const } } },
        { user: { name: { contains: query, mode: 'insensitive' as const } } },
      ],
    }
  : {}

const orders = await db.orders.findMany({
  where,
  include: { user: true },
  orderBy: { createdAt: 'desc' },
  take: 50,
})

Wire a debounced search input in the admin UI to this endpoint.