I\'m stuck on finding the proper way to refer to entities located inside an aggregate root, when we only got their identities coming from URL paramete
In my opinion there is nothing wrong with this approach:
Order order = orderRepository.find(orderId);
order.updateQuantity(orderLineId, 2);
orderLineId
is a 'local identity'. It is specific to aggregate root and does not make sense outside of it. You don't have to call it an 'id', it can be 'order line number'. From Eric Evan's book:
ENTITIES inside the boundary have local identity, unique only within the AGGREGATE.
...only AGGREGATE roots can be obtained directly with database queries. All other objects must be found by traversal of associations.