fix(medusa): Add allowed relations to order retrieval (#2370)

**What**
Add allowed relations to list orders and get order to throw appropriate error message + status code

**Test**
- Integration: Throw on invalid relation provided to list orders
- Integration: Add test suite get order
   - Successfully retrieve order with expand + fields
   - Throw on invalid relation provided

packages/medusa/src/api/routes/admin/orders/index.ts

@@ -1,15 +1,15 @@
 import { Router } from "express"
 import "reflect-metadata"
 import { Order } from "../../../.."
+import SalesChannelFeatureFlag from "../../../../loaders/feature-flags/sales-channels"
 import {
   DeleteResponse,
   FindParams,
   PaginatedResponse,
 } from "../../../../types/common"
+import { FlagRouter } from "../../../../utils/flag-router"
 import middlewares, { transformQuery } from "../../../middlewares"
 import { AdminGetOrdersParams } from "./list-orders"
-import { FlagRouter } from "../../../../utils/flag-router"
-import SalesChannelFeatureFlag from "../../../../loaders/feature-flags/sales-channels"
 
 const route = Router()
 
@@ -30,6 +30,7 @@ export default (app, featureFlagRouter: FlagRouter) => {
       defaultRelations: relations,
       defaultFields: defaultAdminOrdersFields,
       allowedFields: allowedAdminOrdersFields,
+      allowedRelations: allowedAdminOrdersRelations,
       isList: true,
     }),
     middlewares.wrap(require("./list-orders").default)
@@ -44,6 +45,7 @@ export default (app, featureFlagRouter: FlagRouter) => {
       defaultRelations: relations,
       defaultFields: defaultAdminOrdersFields,
       allowedFields: allowedAdminOrdersFields,
+      allowedRelations: allowedAdminOrdersRelations,
       isList: false,
     }),
     middlewares.wrap(require("./get-order").default)
@@ -342,6 +344,7 @@ export const allowedAdminOrdersFields = [
 export const allowedAdminOrdersRelations = [
   "customer",
   "region",
+  "sales_channel",
   "billing_address",
   "shipping_address",
   "discounts",