Heh. My client read me the riot act for making our customers "jump through seventeen hoops" just to make a purchase, so I'm looking at streamlining the order process. We'd really love it if we could simply force the user to choose a password and log the user in as part of the purchase product. There doesn't seem to be a pre-built way to do this, so I'm looking at options, and I'd love some guidance.

I thought about forcing the login in a PHP field in a Rules Action, but that seems seriously dicey: if another user follows along with the same email address (either by malicious design or by typo) and makes a purchase, they can automatically get logged in as the wrong person. Somewhat far-fetched, but I don't like leaving a possibility like that open.

The way to do this seems to be to show the one-time login link for the user on the completion page, so that they can go directly to set their password and look at their order without having to open their emails. That's probably not streamlined enough to satisfy my client, but it would be a big improvement.

Am I going about this the right way? I'm happy to put the work in, but I'd hate to put in the work to find out I've "done it wrong."

Thank you in advance.