[shopsys] logged user is not allowed to change their email in cart (#…

…3468)
shopsys · Oct 16, 2024 · e1ef108 · e1ef108
2 parents 410a586 + 5a12518
commit e1ef108
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/src/Model/Mutation/Order/CreateOrderMutation.php b/src/Model/Mutation/Order/CreateOrderMutation.php
@@ -8,6 +8,7 @@
 use Overblog\GraphQLBundle\Validator\InputValidator;
 use Shopsys\FrameworkBundle\Component\Domain\Domain;
 use Shopsys\FrameworkBundle\Model\Customer\User\CurrentCustomerUser;
+use Shopsys\FrameworkBundle\Model\Customer\User\CustomerUser;
 use Shopsys\FrameworkBundle\Model\Order\PlaceOrderFacade;
 use Shopsys\FrameworkBundle\Model\Order\Processing\OrderInputFactory;
 use Shopsys\FrameworkBundle\Model\Order\Processing\OrderProcessor;
@@ -23,6 +24,7 @@ class CreateOrderMutation extends AbstractMutation
 {
     public const string VALIDATION_GROUP_IS_DELIVERY_ADDRESS_DIFFERENT_FROM_BILLING_WITHOUT_PRESELECTED = 'isDeliveryAddressDifferentFromBillingWithoutPreselected';
     public const string VALIDATION_GROUP_ON_COMPANY_BEHALF = 'onCompanyBehalf';
+    public const string VALIDATION_GROUP_ANONYMOUS_USER = 'anonymousUser';
 
     /**
      * @param \Shopsys\FrontendApiBundle\Model\Order\OrderDataFactory $orderDataFactory
@@ -55,14 +57,14 @@ public function __construct(
      */
     public function createOrderMutation(Argument $argument, InputValidator $validator): CreateOrderResult
     {
-        $validationGroups = $this->computeValidationGroups($argument);
+        $customerUser = $this->currentCustomerUser->findCurrentCustomerUser();
+        $validationGroups = $this->computeValidationGroups($argument, $customerUser);
         $validator->validate($validationGroups);
 
         $orderData = $this->orderDataFactory->createOrderDataFromArgument($argument);
 
         $input = $argument['input'];
         $cartUuid = $input['cartUuid'];
-        $customerUser = $this->currentCustomerUser->findCurrentCustomerUser();
         $cart = $this->cartApiFacade->getCartCreateIfNotExists($customerUser, $cartUuid);
 
         $cartWithModifications = $this->cartWatcherFacade->getCheckedCartWithModifications($cart);
@@ -93,9 +95,10 @@ public function createOrderMutation(Argument $argument, InputValidator $validato
 
     /**
      * @param \Overblog\GraphQLBundle\Definition\Argument $argument
+     * @param \Shopsys\FrameworkBundle\Model\Customer\User\CustomerUser|null $currentCustomerUser
      * @return string[]
      */
-    protected function computeValidationGroups(Argument $argument): array
+    protected function computeValidationGroups(Argument $argument, ?CustomerUser $currentCustomerUser): array
     {
         $input = $argument['input'];
         $validationGroups = ['Default'];
@@ -108,6 +111,10 @@ protected function computeValidationGroups(Argument $argument): array
             $validationGroups[] = self::VALIDATION_GROUP_IS_DELIVERY_ADDRESS_DIFFERENT_FROM_BILLING_WITHOUT_PRESELECTED;
         }
 
+        if ($currentCustomerUser === null) {
+            $validationGroups[] = self::VALIDATION_GROUP_ANONYMOUS_USER;
+        }
+
         return $validationGroups;
     }
 }
diff --git a/src/Resources/config/graphql-types/ModelType/Order/Input/OrderInputDecorator.types.yaml b/src/Resources/config/graphql-types/ModelType/Order/Input/OrderInputDecorator.types.yaml
@@ -33,16 +33,19 @@ OrderInputDecorator:
                             max: 100
                             maxMessage: "Last name cannot be longer than {{ limit }} characters"
             email:
-                type: "String!"
+                type: "String"
                 description: "The customer's email address"
                 validation:
                     -   NotBlank:
                             message: "Please enter email"
+                            groups: "anonymousUser"
                     -   Email:
                             message: "Please enter valid email"
+                            groups: "anonymousUser"
                     -   Length:
                             max: 255
                             maxMessage: "Email cannot be longer than {{ limit }} characters"
+                            groups: "anonymousUser"
             telephone:
                 type: "String!"
                 description: "The customer's phone number"