Add a permission specific to unlocking orders

So with this, we're no longer checking that the order can be updated, is that intended? I guess the permission should be sufficient, but still feels weird to allow unlocking an order if you cannot update the order.

Hi,
Please add steps to reproduce this issue.

This issue was created by module owner after discussion in slack. No steps to reproduce required

Up!

If I'm reading this correctly, we're still not checking that the order cannot be updated?

I fixed this in the last commit

Nope, you're overridding result here.

     if ($additional_operation == 'unlock') {
        $result = AccessResult::allowedIf($entity->isLocked())
          ->andIf(AccessResult::allowedIfHasPermission($account, 'unlock orders'));
      }
      else {
        $result = AccessResult::allowedIf(!$entity->isLocked())->andIf($result);
      }

I missed ->andIf($result); for unlock operation. Fixed

Automatically closed - issue fixed for 2 weeks with no activity.