vendure-ecommerce/vendure

addItemToOrder mutation allows user to add quantity to cart that exceeds inventory

Closed this issue · 0 comments

Describe the bug
The global track inventory setting is set to true, and the global out of stock threshold is set to 0. If the user adds an item to their cart through the addItemToOrder mutation, then they can exceed the saleable inventory of the product variant that they are trying to add. This does not occur if the adjustOrderLine mutation is used to increment the inventory.

To Reproduce
Steps to reproduce the behavior:
Scenario A - Steps to Reproduce:

  1. Set a certain stock level for a variant - in our case this is 3. The 3 items all show as saleable in the Admin UI.
  2. Open the storefront and add a single item to the cart through the product detail page/component, which ultimately triggers the addItemToOrder mutation. You would have one item in you cart at this point.
  3. If you repeat the add to cart step 3 more times, the cart will allow you to exceed the total amount of saleable items. However, if you were to increase the cart items through the cart drawer component, then you see the expected INSUFFICIENT_STOCK_ERROR. In the latter case, the adjustOrderLine mutation is being called instead of the addItemToOrder mutation.

Scenario B - Steps to Reproduce:

  1. Set a certain stock level for a variant, same as Scenario A.
  2. Open the store front and add a quantity of the item to the cart that exceeds the saleable quantity (e.g. 7). The addItemToOrder mutation will correctly add 3 items to the cart since there are only 3 saleable. However, if you attempt to add 7 items again, the addItemToOrder mutation will add 3 items to the cart again (exceeding the saleable quantity).

Expected behavior
In both scenarios above, I would expect the mutation to prevent the quantity of the order line from exceeding the product variant's saleable inventory.

Environment (please complete the following information):

  • @vendure/core version: 0.18.2
  • Nodejs version: 12.18.4
  • Database (mysql/postgres etc): postgres