Trying to order unorderable product leads to access denied

Created on 17 June 2024, 10 months ago

Problem/Motivation

Currently, if a product is orderable and a user adds the product to their cart, but then an admin makes the product unorderable and the user wants to check out, he gets an "Access Denied" and the order is gone from his cart.

This is good, as a User shouldn't be able to order unorderable items. BUT, the way the order is denied will be very confusing for the user.

We currently have a "AvailabilityOrderProcessor" implemneted, which decides, whether an order can be processed based on the order items "orderable" status. If an order item is unavailable, the orderitem will be removed from the order and deleted. Afterwards an order error is added.

What I think is happening, that if we only have one order item in our cart, which is unavailable and we remove this order (through proceeding to checkout), there are no more order items in our order and commerce doesn't know how to proceed to checkout without any order items and shows an "access denied" message instead.

Steps to reproduce

See Problem/Motivation.

Proposed resolution

Hook into precheckout and throw the error there.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report

Status

Active

Component

Code

Created by

🇩🇪Germany Grevil

Live updates comments and jobs are added and updated live.

Comments & Activities

Issue created by @Grevil
Comment 10 months ago →
🇩🇪Germany Grevil
Here is a link of when our order processor is run: https://docs.drupalcommerce.org/v2/developer-guide/orders/getting-starte....

I think we really need to hook into the pre checkout.
Comment 10 months ago →
🇩🇪Germany Anybody Porta Westfalica
Let's mark this minor, as it's definitely an edge-case.

I think we should look for similar issues in the related issues and list them here. Then we should copy their solution. If there's none, it's even more edgy :)
Comment 10 months ago →
🇩🇪Germany Grevil
Btw, the commerce core "order" module has a quite similiar implementation (with some minor "performance" adjustments, which I don't think we need). See https://git.drupalcode.org/project/commerce/-/blob/8.x-2.x/modules/order....

So this edge case will also apply there.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024