Problem/Motivation

Commerce Cart Links currently skips the full order item validation pipeline—including availability checkers, required-field checks, and any custom validation handlers—when adding products via URL-based links. It should enforce the same validation logic as the standard add-to-cart form to prevent invalid items from being added to the cart.

Original issue summary:
The availability checker API constrains adding an item to the cart via the add-to-cart form. An example implementation can be found in the commerce_order_test test module, where items with SKUs starting with TEST_ cannot be added to the cart. In such a case user will see the following (or similar) message:

Side Table is not available with a quantity of 1.

However, this module allows adding all product variations, regardless of their availability status.

Proposed resolution

Check availability before adding the item to the cart. Return 403 if the item cannot be added to the cart.

Issue fork commerce_cart_links-3520311

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

zaporylie created an issue. See original summary.

rszrama’s picture

rszrama commented

I'm not sure what the correct course of action should be here, to be honest. On the one hand, availability checkers should be respected, but on the other hand, how they are respected can be context dependent.

I believe this is why, for example, the cart manager itself does not check availability before creating an order item. Additionally, I'm pretty sure Commerce only checks availability after the add to cart has occurred via the order processor, but I could be wrong.

In this case, I'd almost suggest we leave the default behavior as is but optionally execute availability checking first, rendering the message upon failure. (The problem is, that message is pretty non-specific ... but it's the best we have atm.)

Generally speaking, the availability system needs work. Will link to this from our internal Commerce channel for discussion in a future breaking release.

zaporylie opened merge request !12

zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented
Status: Active » Needs review
  1. We not only use the availability manager in the context of the order processor but also in the context of validation constraints. That's what prevents non-available items from being added to the cart.
  2. We can replicate the context in the cart links module and use it to validate the order item, in fact if we call validate on the order item, that would trigger the same code/behavior as the add to cart form.

I added MR with a proposal.

rszrama’s picture

rszrama commented

If we go this direction, I think we may need a couple of different approaches to messaging.

For on-site usage (i.e., a cart link replacing an Add to Cart form in a catalog page), the default messaging is probably fine, though I think taling about "quantity" where there is no quantity input is awkward at best.

For off-site usage (i.e., a link template used in a Google Ad to "buy it now"), I don't think it makes as much sense to talk about a product generically not being available. I envision something more related to a link, promotion, etc. no longer being active, though even there, I'm not sure we can assume. Other ideas?

zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented

The MR adopts the same messaging approach as the standard Add to Cart form. It delegates responsibility to the checker to override the generic message with a more specific one that clearly explains why the item couldn’t be added to the cart.

jsacksick’s picture

jsacksick commented

hm... I guess this approach is ok though we could probably copy what the EditQuantity views field handler is doing:

$violations = $order_item
        ->validate()
        ->filterByFields(array_diff(array_keys($order_item->getFieldDefinitions()), [
          'purchased_entity',
          'quantity',
        ]));

This way we flag only errors for the purchased entity field and the quantity... Thoughts?

We could also implement the availability checker directly though the current approach implemented allows developers to opt out for the availability checks if the constraint is removed from the field.

zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented

I gave some more thought to the proposal in #7. While it makes sense within the scope of the current issue, I believe we should keep the implementation as it is and instead adjust the scope.

In my view, we're aiming to replicate the default behavior of the Add to Cart form—which, like with any other entity type in Drupal, runs validation before creating an order item.

A good example of why this matters: imagine a Commerce site with multiple product types, each tied to its own order item type. Some of those order item types have additional required fields. Full validation ensures we don’t end up creating invalid order items when the Add to Cart form would normally prompt for more data before proceeding.

jsacksick’s picture

jsacksick commented

I'm fine with validating all the fields just like the patch is doing atm. So in EditQuantity we only validate the purchased entity and the quantity since these are the only 2 fields the user is editing. In some cases you might have a constraint that could fail with no way course of action to actually fix the validation. But let's go with this :).

zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented
Title: Cart link doesn't respect Availability Checker » Cart link bypasses order item validation
Issue summary: View changes

  • zaporylie committed b1d0888e on 1.0.x 
    Issue #3520311 by zaporylie: Cart link doesn't respect Availability...
vmarchuk’s picture

vmarchuk
Primary language English
Location Rivne, UA
commented
Status: Needs review » Fixed

Committed!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.