Hi, could it be possible that you have intruced a new bug in spyker/sales?

UK7KBE2JW

Hi, could it be possible that you have intruced a new bug in spyker/sales? https://github.com/spryker/sales/blob/dc04c502ca4d11b6175dd680cf257d303fe17507/src/Spryker/Zed/Sales/Business/Model/Order/OrderHydrator.php#L160

UKBF1R1S5

@UK7KBE2JW i have the same problem in my b2b stack. i think there a two solutions for that.

Solution 1:

namespace Spryker\Zed\Sales\Business\Order;

...

class OrderHydrator extends OrderHydratorWithoutMultiShipping
{
    ...

    /**
     * @param \Generated\Shared\Transfer\OrderTransfer $orderTransfer
     *
     * @throws \Spryker\Zed\Sales\Business\Exception\InvalidSalesOrderException
     *
     * @return \Orm\Zed\Sales\Persistence\SpySalesOrder
     */
    protected function getOrderEntity(OrderTransfer $orderTransfer)
    {
        $orderTransfer->requireIdSalesOrder()
            ->requireFkCustomer();

        $customerTransfer = $this->getCustomerByFkCustomer($orderTransfer);

        $orderEntity = $this->queryContainer
            ->querySalesOrderDetailsWithoutShippingAddress($orderTransfer->getIdSalesOrder())
            ->findOne();

        if (!$this->isOrderApplicableForRetrieval($customerTransfer, $orderEntity)) {
            throw new InvalidSalesOrderException(sprintf(
                'Order could not be found for ID %s and customer reference %s',
                $orderTransfer->getIdSalesOrder(),
                $orderTransfer->getCustomerReference()
            ));
        }

        return $orderEntity;
    }

    ...
}

namespace Spryker\Zed\Sales\Business\Model\Order;

...

/**
 * @deprecated Use \Spryker\Zed\Sales\Business\Order\OrderHydrator instead.
 */
class OrderHydrator implements OrderHydratorInterface
{
    /**
     * @param \Generated\Shared\Transfer\OrderTransfer $orderTransfer
     *
     * @throws \Spryker\Zed\Sales\Business\Exception\InvalidSalesOrderException
     *
     * @return \Orm\Zed\Sales\Persistence\SpySalesOrder
     */
    protected function getOrderEntity(OrderTransfer $orderTransfer)
    {
        $orderTransfer->requireIdSalesOrder()
            ->requireFkCustomer();

        $customerTransfer = $this->getCustomerByFkCustomer($orderTransfer);

        $orderEntity = $this->queryContainer
            ->querySalesOrderDetails($orderTransfer->getIdSalesOrder())
            ->findOne();

        if (!$this->isOrderApplicableForRetrieval($customerTransfer, $orderEntity)) {
            throw new InvalidSalesOrderException(sprintf(
                'Order could not be found for ID %s and customer reference %s',
                $orderTransfer->getIdSalesOrder(),
                $orderTransfer->getCustomerReference()
            ));
        }

        return $orderEntity;
    }

    ...

    /**
     * @param \Generated\Shared\Transfer\CustomerTransfer $customerTransfer
     * @param \Orm\Zed\Sales\Persistence\SpySalesOrder|null $orderEntity
     *
     * @return bool
     */
    protected function isOrderApplicableForRetrieval(
        CustomerTransfer $customerTransfer,
        ?SpySalesOrder $orderEntity
    ): bool {
        if (!$orderEntity) {
            return false;
        }

        if ($customerTransfer->getCustomerReference() !== $orderEntity->getCustomerReference()) {
            return false;
        }

        return $this->isCustomerOrderAccessGranted($orderEntity, $customerTransfer);
    }
}

Solution 2:

namespace Spryker\Zed\Sales\Business\Order;

...

class OrderHydrator extends OrderHydratorWithoutMultiShipping
{
    ...

    /**
     * @param \Generated\Shared\Transfer\OrderTransfer $orderTransfer
     *
     * @throws \Spryker\Zed\Sales\Business\Exception\InvalidSalesOrderException
     *
     * @return \Orm\Zed\Sales\Persistence\SpySalesOrder
     */
    protected function getOrderEntity(OrderTransfer $orderTransfer)
    {
        $orderTransfer->requireIdSalesOrder()
            ->requireFkCustomer();

        $customerTransfer = $this->getCustomerByFkCustomer($orderTransfer);
        $orderTransfer->setCustomer($customerTransfer);

        $orderEntity = $this->queryContainer
            ->querySalesOrderDetailsWithoutShippingAddress($orderTransfer->getIdSalesOrder())
            ->findOne();

        if (!$this->isOrderApplicableForRetrieval($orderTransfer, $customerTransfer, $orderEntity)) {
            throw new InvalidSalesOrderException(sprintf(
                'Order could not be found for ID %s and customer reference %s',
                $orderTransfer->getIdSalesOrder(),
                $orderTransfer->getCustomerReference()
            ));
        }

        return $orderEntity;
    }

    ...
}

namespace Spryker\Zed\Sales\Business\Model\Order;

...

/**
 * @deprecated Use \Spryker\Zed\Sales\Business\Order\OrderHydrator instead.
 */
class OrderHydrator implements OrderHydratorInterface
{
    /**
     * @param \Generated\Shared\Transfer\OrderTransfer $orderTransfer
     *
     * @throws \Spryker\Zed\Sales\Business\Exception\InvalidSalesOrderException
     *
     * @return \Orm\Zed\Sales\Persistence\SpySalesOrder
     */
    protected function getOrderEntity(OrderTransfer $orderTransfer)
    {
        $orderTransfer->requireIdSalesOrder()
            ->requireFkCustomer();

        $customerTransfer = $this->getCustomerByFkCustomer($orderTransfer);
        $orderTransfer->setCustomer($customerTransfer);

        $orderEntity = $this->queryContainer
            ->querySalesOrderDetails($orderTransfer->getIdSalesOrder())
            ->findOne();

        if (!$this->isOrderApplicableForRetrieval($orderTransfer, $customerTransfer, $orderEntity)) {
            throw new InvalidSalesOrderException(sprintf(
                'Order could not be found for ID %s and customer reference %s',
                $orderTransfer->getIdSalesOrder(),
                $orderTransfer->getCustomerReference()
            ));
        }

        return $orderEntity;
    }
}

UK7KBE2JW

Solution 1 works for me, thx.

Dmitriy Aseev

@UK7KBE2JW could you please share error stack trace?

UK7KBE2JW

UKBF1R1S5

@U0140NZMDTN i don’t understand why you use $orderTransfer->getCustomer()? you get the customerTransfer always over $customerTransfer = $this->getCustomerByFkCustomer($orderTransfer);. The method getCustomerByFkCustomer will throw an exception if customer transfer is not set.

Dmitriy Aseev

These changes needs for sharing orders to other customers (company users with some permission, etc).
@UKBF1R1S5

Dmitriy Aseev

    protected function isOrderApplicableForRetrieval(
        OrderTransfer $orderTransfer,
        CustomerTransfer $customerTransfer,
        ?SpySalesOrder $orderEntity
    ): bool {
        if (!$orderEntity) {
            return false;
        }

        if ($customerTransfer->getCustomerReference() === $orderEntity->getCustomerReference()) {
            return true;
        }

        if (!$orderTransfer->getCustomer()) {
            return false;
        }

        return $this->isCustomerOrderAccessGranted($orderEntity, $orderTransfer->getCustomer());
    }

Use this hot fix in project level, I will create bug ticket for this not-BC issue.

UKBF1R1S5

/**
 * @param \Orm\Zed\Sales\Persistence\SpySalesOrder $orderEntity
 * @param \Generated\Shared\Transfer\CustomerTransfer $customerTransfer
 *
 * @return bool
 */
protected function isCustomerOrderAccessGranted(SpySalesOrder $orderEntity, CustomerTransfer $customerTransfer): bool
{
    $orderTransfer = (new OrderTransfer())->fromArray($orderEntity->toArray(), true);

    if ($orderTransfer->getCustomerReference() === $customerTransfer->getCustomerReference()) {
        return true;
    }

    foreach ($this->customerOrderAccessCheckPlugins as $customerOrderAccessCheckPlugin) {
        if ($customerOrderAccessCheckPlugin->check($orderTransfer, $customerTransfer)) {
            return true;
        }
    }

    return false;
}

UK7KBE2JW

Ok, thank you. When will the bugfix be released?

UKBF1R1S5

@U0140NZMDTN i don’t understand this fix. but if it works, i’ll try it.

Dmitriy Aseev

ASAP as our queue allows this.

Dmitriy Aseev

$orderTransfer->getCustomer() - this is customer who request order to retrieve (get from session). In most cases it's creator of this order.
But now it can be another customer who want's to see this order.

UKBF1R1S5

@U0140NZMDTN but your line is duplicated. you can find it also in the method isCustomerOrderAccessGranted which will execute end the end of isOrderApplica… --> https://github.com/spryker/sales/blob/dc04c502ca4d11b6175dd680cf257d303fe17507/src/Spryker/Zed/Sales/Business/Model/Order/OrderHydrator.php#L612

Dmitriy Aseev

@UKBF1R1S5 you right, in my hotfix we have duplication to avoid changes in method signature. In final bugticket we will provide better solution.

UKBF1R1S5

Cooel. Thx

Valerii Trots

Hi! This should have been fixed in https://github.com/spryker/sales/releases/tag/11.8.1.