fix(draft-order): don't crash the detail page when the actor is not a user

[breken-ai]

What changed

Fixes #16775 - draft order detail page crashes with 404: User with id apk_... was not found.

Root cause

Draft order changes confirmed via an admin API key store the apk_ id in confirmed_by. The draft-order plugin's ActivityItem passed item.userId straight to useUser regardless of prefix, and on a lookup failure it did throw error, which the error boundary turns into a full page crash. So one activity entry authored by an API key takes down the entire draft order detail page.

Fix

Ports the dashboard's own By component convention (components/common/user-link/user-link.tsx: prefix-gate on user_/cus_, return null otherwise) to the plugin's activity section:

• only call useUser when the actor id is user_-prefixed (enabled gate, hooks stay unconditional)
• never throw the lookup failure into the error boundary
• skip the By-row when the actor is not a resolvable user; the skeleton still shows while a real user lookup is pending

This is a port of the repo's own established pattern, not a new invention.

Verification

• Verified the crash path directly against develop HEAD (e9dc0ed): current code fetches any userId and throws isError into the boundary; an apk_ id 404s in useUser.
• Verified the lineage claim: the dashboard By component prefix-gates and renders null for non-user/non-customer ids.

Honest limit: no render test - the admin dependency tree was not installable in our sandbox, so behavior was verified by direct code-path analysis plus an esbuild TSX transform of the patched file. CI will run the repo suites.

Built by breken, your AI support engineer - breken.ai - this one's on us.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f561a06

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[medusa-os-bot]

Thanks for the contribution! A few items need to be addressed before this can move forward:

The PR fixes a real and verified bug in the draft-order plugin's activity section. When an order change is confirmed via an Admin API key, the confirmed_by field stores an apk_-prefixed ID rather than a user_-prefixed one. The original code passed any non-null userId to useUser, and when that fetch returned a 404, it threw the error directly into the React error boundary, crashing the entire draft order detail page. The fix prefix-gates the user fetch on user_-prefixed IDs (matching the established pattern in the dashboard's own By component in user-link.tsx) and removes the error-propagation. The logic is correct across all scenarios: null actor, non-user actor (apk_), user fetch pending, user loaded successfully, and user fetch error. No security or performance concerns were found — the change is a pure UI component fix with no server-side data flows. One blocking item: the PR is missing a changeset file, which is required for any source-code change under packages/.

• A changeset is required for any source-code change under packages/. Run yarn changeset from the repo root and follow the prompts to add a patch changeset for @medusajs/draft-order. The changeset message should follow the format: fix(draft-order): <short description>.

Triggered by: new PR opened