How to merge cart items of guest user to logged in user cart items using Store API?

[ahsanshaheen199]

Suppose I add X and Y items as a logged-in user to a cart. Then I logout and add Z item to the cart as a guest user. Later, if I log in again and check my cart, I will see X, Y, and Z items. This is how WooCommerce merges its carts. I would like to achieve the same behavior in a headless app using Store API. Using Store Api I get the logged-in user cart correctly but it does not merge guest user cart items.

As a guest user:
1st step: {{WORDPRESS_URL}}/wc/store/v1/cart - it gives me the cart nonce and cart token
2nd step: {{WORDPRESS_URL}}/wc/store/v1/cart/add-item?id=100&quantity=1(in headers I added cart nonce) - it gives me updated cart
3rd step: {{WORDPRESS_URL}}/wc/store/v1/cart (in headers I added cart token that I got from 2nd step) - cart information is correct.
4th step: {{WORDPRESS_URL}}/wc/store/v1/cart (in headers I added bearer token of a user) - it gives me the previous cart information of logged in user not the merged version of 2 carts.

[senadir]

in 4th step, did you send existing cookies as well? are you using Cart Token or just WooCommerce cookies?

[ahsanshaheen199]

@senadir I am not sending any cookies. In 4th step, I am not sending Cart Token, I am just sending a bearer token in the authorization header.

[phil-sola]

Hey @senadir, this is exactly the same problem I am coming up against at the moment as well. Was there a resolution here?

Like @ahsanshaheen199 I am sending bearer JWT auth token and have tried a combination of sending Cart-Token and Nonce headers as well.

It appears that from a non-logged in guest user adding to cart, If I log in on my headless frontend, and send use the Cart-Token it overrides the Authenticated Cart instead of merging them like on a monolithic WooCommerce store...

Some initial observations I've seen today:

Without Cart-Token header and with JWT auth bearer header

• If logged in and add items to basket, and then log out - basket is empty - Expected whenever logging out
• If log back in, basket has the same items - Expected
• If log out, and add items to basket as a guest, and then log in, I see the previous logged-in basket - either empty or with items (NOT the logged out basket merged in) - Not Expected
• If log out, basket is empty again. - Expected whenever logging out

With Cart-Token header

• If logged out, and add items to basket as a guest, and then log in, guest basket is preserved - Expected
• If I log out after logging in as a user, guest basket is empty - Expected whenever logging out
• If I log back in, logged in basket is now empty too - Cart-Token has overriden previous basket (despite Auth Bearer heading) - Not Expected
• Lose any logged-in basket when I log out. Expected whenever logging out

I must be missing a piece of the puzzle here with merging the two carts like WooCommerce does.

I don't log users in on the WordPress backend, only my headless frontend so there are no Woo Cookies to send.

I am using Cart-Token, Nonce and JWT bearer headers across my app but something clearly isn't triggering the merge behaviour.

Any help would be much appreciated here - Thanks!

[phil-sola]

@senadir @ahsanshaheen199 I've managed to get merged carts working as a basic proof of concept today but only because I'm testing something on the API backend of actually logging the user in and using wp_set_current_user().

The code I've been going through on github for WooCommerce merging carts, leans heavily on get_current_user_id() and php sessions by the looks of it and not sure how this works with JWT tokens, Cart-Token, Nonce headers. From all my testing, it doesn't...
If I remove the logic on my API site of setting the current user on login, the merging stops again.

This seems like a bug to me bearing in mind a lot of users may not be interacting with this on a monolithic woocommerce site with php sessions / default auth flow.

[phil-sola]

I’ve also opened an issue for this as I feel the more I look into this, there’s a potential bug here.

Feels like some sort of race condition between WooCommerce getting the current user id and merging carts and the JWT auth header being processed…

#55653

[senadir]

I took a look at the code and yeah merging carts won't work with Store API's Cart Token because the cart merging flow is handled in the cookie session handler.

woocommerce/plugins/woocommerce/includes/class-wc-cart-session.php

Lines 108 to 118 in 9bdf763

	$merge_saved_cart = (bool) get_user_meta( get_current_user_id(), '_woocommerce_load_saved_cart_after_login', true );
	// Merge saved cart with current cart.
	if ( is_null( $cart ) || $merge_saved_cart ) {
	$saved_cart = $this->get_saved_cart();
	$cart = is_null( $cart ) ? array() : $cart;
	$cart = array_merge( $saved_cart, $cart );
	$update_cart_session = true;
	delete_user_meta( get_current_user_id(), '_woocommerce_load_saved_cart_after_login' );
	}

If the JWT plugin is triggering wp_login, then I think we can support it on Store API, will find some time to test this and see.

[phil-sola]

Hey @senadir I think I have found the commit from 7 years ago which affects this in the issue above if you wouldn't mind taking a look at some point?

#55653