Permission to view generated PDF

Hello,

while testing if the modules fits my requirements I found out that there is no permission check implemented. Is this by design or by accident?

I figure it's a privacy problem to be able to download any invoice simply by trying order numbers.

The following could be one to solve it, but maybe there's a also a better way.

1. Implement a new permission "view-own-commerce-order-pdf" (similar one "view-own-commerce-order-pdf").The disadvantage here lies in anonymous orders. If the permission is set to anything but `Guest`, there's no chance for a customer to view the invoice.

2. Additionally it would make sense to add a long random string to the URL. This makes guessing URLs to retrieve invoices way more difficult.

Both methods could be used in combination: if it's required to have anonymous customers that are able to retrieve the PDF, on could set the permission to "Guest" and still have the benefit of cryptic URLs.

I'm didn't have the chance to dive into D8 module development, but I would like to get my feet wet.