@@ -23,8 +23,9 @@ class Order_Mutation {
2323 * @param \WPGraphQL\AppContext $context AppContext instance.
2424 * @param \GraphQL\Type\Definition\ResolveInfo $info ResolveInfo instance.
2525 * @param string $mutation Mutation being executed.
26- * @param integer|null $order_id Order ID.
27- *
26+ * @param integer|null|false $order_id Order ID.
27+ * @throws \GraphQL\Error\UserError Error locating order.
28+ *
2829 * @return boolean
2930 */
3031 public static function authorized ( $ input , $ context , $ info , $ mutation = 'create ' , $ order_id = null ) {
@@ -35,21 +36,35 @@ public static function authorized( $input, $context, $info, $mutation = 'create'
3536 */
3637 $ post_type_object = get_post_type_object ( 'shop_order ' );
3738
38- if ( $ order_id === null ) {
39+ if ( ! $ order_id ) {
3940 return apply_filters (
4041 "graphql_woocommerce_authorized_to_ {$ mutation }_orders " ,
41- current_user_can ($ post_type_object ->cap ->edit_posts ),
42+ current_user_can ( $ post_type_object ->cap ->edit_posts ),
4243 $ order_id ,
4344 $ input ,
4445 $ context ,
4546 $ info
4647 );
4748 }
4849
49- $ order = \wc_get_order ( $ order_id );
50+ /** @var false|\WC_Order $order */
51+ $ order = \wc_get_order ( $ order_id );
52+ if ( false === $ order ) {
53+ throw new UserError (
54+ sprintf (
55+ /* translators: %d: Order ID */
56+ __ ( 'Failed to find order with ID of %d. ' , 'wp-graphql-woocommerce ' ),
57+ $ order_id
58+ )
59+ );
60+ }
61+
5062 $ post_type = get_post_type ( $ order_id );
63+ if ( false === $ post_type ) {
64+ throw new UserError ( __ ( 'Failed to identify the post type of the order. ' , 'wp-graphql-woocommerce ' ) );
65+ }
5166
52- // Return true if user is owner or admin
67+ // Return true if user is owner or admin.
5368 $ is_owner = 0 !== get_current_user_id () && $ order ->get_customer_id () === get_current_user_id ();
5469 $ is_admin = \wc_rest_check_post_permissions ( $ post_type , 'edit ' , $ order_id );
5570 return $ is_owner || $ is_admin ;
0 commit comments