Skip Order Refresh on draft anonymous orders on CLI

Probably a duplicate of 🐛 Race conditions can theoretically change placed orders Active , feel free to reopen if you think this isn't a duplicate.

Maybe the right fix is to copy what 1.x did...

// If the order is anonymous, check the session to see if the order
      // belongs to the current user. Otherwise just check that the order uid
      // matches the current user.
      if ($order->uid == 0 && !commerce_cart_order_session_exists($order->order_id)) {
        return FALSE;
      }

I'm guessing we could check if the customer is anonymous that the current customer can update the order.

So I'm guessing a 2.x equivalent fix could look like the following:

// Skip the order refresh in case the current customer cannot update the order.
if ($order->getCustomer()->isAnonymous() && !$order->access('update')) {
  return FALSE;
}

Updated patch implementing the suggestion in #3379152-5: Skip Order Refresh on draft anonymous orders on CLI → .

Tested and resolves the issue.

While this isn't as performant as just checking the CLI variable, it is more logical, and better matches the logic back in 7.x.

Let's test this from OrderRefreshTest::testShouldRefresh().

As requested in #7, test steps are added in OrderRefreshTest::testShouldRefresh().

This doesn't actually invoke the _commerce_cart_order_access, though, which would ensure that OrderRefreshTest::testShouldRefresh() returns TRUE when the cart is present in the cart_session.

CartOrderRefreshTest.php has been added to the cart module to test those scenarios, both when the anonymous user has the cart in the cart_session (returning TRUE) and when it does not (returning FALSE).

Committed, thanks Tom!

Automatically closed - issue fixed for 2 weeks with no activity.