AC-7058: Guest Checkout REST API Fix

Author: pawan-adobe-security

app/code/Magento/Checkout/Model/ShippingInformationManagement.php

@@ -3,6 +3,7 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
 namespace Magento\Checkout\Model;
 
@@ -39,60 +40,62 @@ class ShippingInformationManagement implements ShippingInformationManagementInte
     /**
      * @var PaymentMethodManagementInterface
      */
-    protected $paymentMethodManagement;
+    protected PaymentMethodManagementInterface $paymentMethodManagement;
 
     /**
      * @var PaymentDetailsFactory
      */
-    protected $paymentDetailsFactory;
+    protected PaymentDetailsFactory $paymentDetailsFactory;
 
     /**
      * @var CartTotalRepositoryInterface
      */
-    protected $cartTotalsRepository;
+    protected CartTotalRepositoryInterface $cartTotalsRepository;
 
     /**
      * @var CartRepositoryInterface
      */
-    protected $quoteRepository;
-
+    protected CartRepositoryInterface $quoteRepository;
     /**
      * @var Logger
      */
-    protected $logger;
+    protected Logger $logger;
 
     /**
      * @var QuoteAddressValidator
      */
-    protected $addressValidator;
+    protected QuoteAddressValidator $addressValidator;
 
     /**
      * @var AddressRepositoryInterface
      * @deprecated 100.2.0
+     * @see AddressRepositoryInterface
      */
-    protected $addressRepository;
+    protected AddressRepositoryInterface $addressRepository;
 
     /**
      * @var ScopeConfigInterface
      * @deprecated 100.2.0
+     * @see ScopeConfigInterface
      */
-    protected $scopeConfig;
+    protected ScopeConfigInterface $scopeConfig;
 
     /**
      * @var TotalsCollector
      * @deprecated 100.2.0
+     * @see TotalsCollector
      */
-    protected $totalsCollector;
+    protected TotalsCollector $totalsCollector;
 
     /**
      * @var CartExtensionFactory
      */
-    private $cartExtensionFactory;
+    private CartExtensionFactory $cartExtensionFactory;
 
     /**
      * @var ShippingAssignmentFactory
      */
-    protected $shippingAssignmentFactory;
+    protected ShippingAssignmentFactory $shippingAssignmentFactory;
 
     /**
      * @var ShippingFactory
@@ -262,8 +265,11 @@ protected function validateQuote(Quote $quote): void
      * @param string $method
      * @return CartInterface
      */
-    private function prepareShippingAssignment(CartInterface $quote, AddressInterface $address, $method): CartInterface
-    {
+    private function prepareShippingAssignment(
+        CartInterface $quote,
+        AddressInterface $address,
+        string $method
+    ): CartInterface {
         $cartExtension = $quote->getExtensionAttributes();
         if ($cartExtension === null) {
             $cartExtension = $this->cartExtensionFactory->create();

app/code/Magento/Quote/Model/QuoteAddressValidator.php

@@ -3,8 +3,15 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
 namespace Magento\Quote\Model;
 
+use Magento\Customer\Api\AddressRepositoryInterface;
+use Magento\Customer\Api\CustomerRepositoryInterface;
+use Magento\Customer\Model\Session;
+use Magento\Framework\Exception\InputException;
+use Magento\Framework\Exception\LocalizedException;
 use Magento\Framework\Exception\NoSuchEntityException;
 use Magento\Quote\Api\Data\AddressInterface;
 use Magento\Quote\Api\Data\CartInterface;
@@ -17,35 +24,33 @@
 class QuoteAddressValidator
 {
     /**
-     * Address factory.
-     *
-     * @var \Magento\Customer\Api\AddressRepositoryInterface
+     * @var AddressRepositoryInterface
      */
-    protected $addressRepository;
+    protected AddressRepositoryInterface $addressRepository;
 
     /**
-     * Customer repository.
-     *
-     * @var \Magento\Customer\Api\CustomerRepositoryInterface
+     * @var CustomerRepositoryInterface
      */
-    protected $customerRepository;
+    protected CustomerRepositoryInterface $customerRepository;
 
     /**
+     * @var Session
      * @deprecated 101.1.1 This class is not a part of HTML presentation layer and should not use sessions.
+     * @see Session
      */
-    protected $customerSession;
+    protected Session $customerSession;
 
     /**
      * Constructs a quote shipping address validator service object.
      *
-     * @param \Magento\Customer\Api\AddressRepositoryInterface $addressRepository
-     * @param \Magento\Customer\Api\CustomerRepositoryInterface $customerRepository Customer repository.
-     * @param \Magento\Customer\Model\Session $customerSession
+     * @param AddressRepositoryInterface $addressRepository
+     * @param CustomerRepositoryInterface $customerRepository Customer repository.
+     * @param Session $customerSession
      */
     public function __construct(
-        \Magento\Customer\Api\AddressRepositoryInterface $addressRepository,
-        \Magento\Customer\Api\CustomerRepositoryInterface $customerRepository,
-        \Magento\Customer\Model\Session $customerSession
+        AddressRepositoryInterface $addressRepository,
+        CustomerRepositoryInterface $customerRepository,
+        Session $customerSession
     ) {
         $this->addressRepository = $addressRepository;
         $this->customerRepository = $customerRepository;
@@ -56,18 +61,18 @@ public function __construct(
      * Validate address.
      *
      * @param AddressInterface $address
-     * @param int|null $customerId Cart belongs to
+     * @param int|null $customerId
      * @return void
-     * @throws \Magento\Framework\Exception\InputException The specified address belongs to another customer.
-     * @throws \Magento\Framework\Exception\NoSuchEntityException The specified customer ID or address ID is not valid.
+     * @throws LocalizedException The specified customer ID or address ID is not valid.
+     * @throws NoSuchEntityException The specified customer ID or address ID is not valid.
      */
     private function doValidate(AddressInterface $address, ?int $customerId): void
     {
         //validate customer id
         if ($customerId) {
             $customer = $this->customerRepository->getById($customerId);
             if (!$customer->getId()) {
-                throw new \Magento\Framework\Exception\NoSuchEntityException(
+                throw new NoSuchEntityException(
                     __('Invalid customer id %1', $customerId)
                 );
             }
@@ -76,15 +81,15 @@ private function doValidate(AddressInterface $address, ?int $customerId): void
         if ($address->getCustomerAddressId()) {
             //Existing address cannot belong to a guest
             if (!$customerId) {
-                throw new \Magento\Framework\Exception\NoSuchEntityException(
+                throw new NoSuchEntityException(
                     __('Invalid customer address id %1', $address->getCustomerAddressId())
                 );
             }
             //Validating address ID
             try {
                 $this->addressRepository->getById($address->getCustomerAddressId());
             } catch (NoSuchEntityException $e) {
-                throw new \Magento\Framework\Exception\NoSuchEntityException(
+                throw new NoSuchEntityException(
                     __('Invalid address id %1', $address->getId())
                 );
             }
@@ -94,7 +99,7 @@ private function doValidate(AddressInterface $address, ?int $customerId): void
                 return $address->getId();
             }, $this->customerRepository->getById($customerId)->getAddresses());
             if (!in_array($address->getCustomerAddressId(), $applicableAddressIds)) {
-                throw new \Magento\Framework\Exception\NoSuchEntityException(
+                throw new NoSuchEntityException(
                     __('Invalid customer address id %1', $address->getCustomerAddressId())
                 );
             }
@@ -104,29 +109,53 @@ private function doValidate(AddressInterface $address, ?int $customerId): void
     /**
      * Validates the fields in a specified address data object.
      *
-     * @param \Magento\Quote\Api\Data\AddressInterface $addressData The address data object.
+     * @param AddressInterface $addressData The address data object.
      * @return bool
-     * @throws \Magento\Framework\Exception\InputException The specified address belongs to another customer.
-     * @throws \Magento\Framework\Exception\NoSuchEntityException The specified customer ID or address ID is not valid.
+     * @throws InputException The specified address belongs to another customer.
+     * @throws NoSuchEntityException|LocalizedException The specified customer ID or address ID is not valid.
      */
-    public function validate(AddressInterface $addressData)
+    public function validate(AddressInterface $addressData): bool
     {
         $this->doValidate($addressData, $addressData->getCustomerId());
 
         return true;
     }
 
+    /**
+     * Validate Quest Address for guest user
+     *
+     * @param AddressInterface $address
+     * @param CartInterface $cart
+     * @return void
+     * @throws NoSuchEntityException
+     */
+    private function doValidateForGuestQuoteAddress(AddressInterface $address, CartInterface $cart): void
+    {
+        //validate guest cart address
+        if ($address->getId() !== null) {
+            $old = $cart->getAddressesCollection()->getItemById($address->getId());
+            if ($old === null) {
+                throw new NoSuchEntityException(
+                    __('Invalid quote address id %1', $address->getId())
+                );
+            }
+        }
+    }
+
     /**
      * Validate address to be used for cart.
      *
      * @param CartInterface $cart
      * @param AddressInterface $address
      * @return void
-     * @throws \Magento\Framework\Exception\InputException The specified address belongs to another customer.
-     * @throws \Magento\Framework\Exception\NoSuchEntityException The specified customer ID or address ID is not valid.
+     * @throws InputException The specified address belongs to another customer.
+     * @throws NoSuchEntityException|LocalizedException The specified customer ID or address ID is not valid.
      */
     public function validateForCart(CartInterface $cart, AddressInterface $address): void
     {
-        $this->doValidate($address, $cart->getCustomerIsGuest() ? null : $cart->getCustomer()->getId());
+        if ($cart->getCustomerIsGuest()) {
+            $this->doValidateForGuestQuoteAddress($address, $cart);
+        }
+        $this->doValidate($address, $cart->getCustomerIsGuest() ? null : (int) $cart->getCustomer()->getId());
     }
 }