ACP2E-1194: Duplicate orders with 2 parallel GraphQL requests

Author: Anna Bukatar

app/code/Magento/QuoteGraphQl/Model/Cart/PlaceOrderMutex.php

@@ -0,0 +1,72 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\QuoteGraphQl\Model\Cart;
+
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\GraphQl\Exception\GraphQlAlreadyExistsException;
+use Magento\Framework\Lock\LockManagerInterface;
+
+/**
+ * @inheritdoc
+ */
+class PlaceOrderMutex implements PlaceOrderMutexInterface
+{
+    private const LOCK_PREFIX = 'quote_lock_';
+
+    private const LOCK_TIMEOUT = 10;
+
+    /**
+     * @var LockManagerInterface
+     */
+    private $lockManager;
+
+    /**
+     * @var int
+     */
+    private $lockWaitTimeout;
+
+    /**
+     * @param LockManagerInterface $lockManager
+     * @param int $lockWaitTimeout
+     */
+    public function __construct(
+        LockManagerInterface $lockManager,
+        int $lockWaitTimeout = self::LOCK_TIMEOUT
+    ) {
+        $this->lockManager = $lockManager;
+        $this->lockWaitTimeout = $lockWaitTimeout;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(string $maskedId, callable $callable, array $args = [])
+    {
+        if (empty($maskedId)) {
+            throw new \InvalidArgumentException('Quote masked id must be provided');
+        }
+
+        if ($this->lockManager->isLocked(self::LOCK_PREFIX . $maskedId)) {
+            throw new GraphQlAlreadyExistsException(
+                __('The order has already been placed and is currently processing.')
+            );
+        }
+
+        if ($this->lockManager->lock(self::LOCK_PREFIX . $maskedId, $this->lockWaitTimeout)) {
+            try {
+                return $callable(...$args);
+            } finally {
+                $this->lockManager->unlock(self::LOCK_PREFIX . $maskedId);
+            }
+        } else {
+            throw new LocalizedException(
+                __('Could not acquire lock for the quote id: %1', $maskedId)
+            );
+        }
+    }
+}

app/code/Magento/QuoteGraphQl/Model/Cart/PlaceOrderMutexInterface.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\QuoteGraphQl\Model\Cart;
+
+use Magento\Framework\Exception\LocalizedException;
+
+/**
+ * Intended to prevent race conditions during order place operation by concurrent requests.
+ */
+interface PlaceOrderMutexInterface
+{
+    /**
+     * Acquires a lock for quote, executes callable and releases the lock after.
+     *
+     * @param string $maskedId
+     * @param callable $callable
+     * @param array $args
+     * @return mixed
+     * @throws LocalizedException
+     */
+    public function execute(string $maskedId, callable $callable, array $args = []);
+}

app/code/Magento/QuoteGraphQl/Model/Resolver/PlaceOrder.php

@@ -7,14 +7,17 @@
 
 namespace Magento\QuoteGraphQl\Model\Resolver;
 
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Exception\LocalizedException;
 use Magento\Framework\GraphQl\Config\Element\Field;
 use Magento\Framework\GraphQl\Exception\GraphQlInputException;
 use Magento\Framework\GraphQl\Query\ResolverInterface;
 use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
 use Magento\GraphQl\Helper\Error\AggregateExceptionMessageFormatter;
+use Magento\GraphQl\Model\Query\ContextInterface;
 use Magento\QuoteGraphQl\Model\Cart\GetCartForUser;
 use Magento\QuoteGraphQl\Model\Cart\PlaceOrder as PlaceOrderModel;
+use Magento\QuoteGraphQl\Model\Cart\PlaceOrderMutexInterface;
 use Magento\Sales\Api\OrderRepositoryInterface;
 
 /**
@@ -42,22 +45,30 @@ class PlaceOrder implements ResolverInterface
      */
     private $errorMessageFormatter;
 
+    /**
+     * @var PlaceOrderMutexInterface
+     */
+    private $placeOrderMutex;
+
     /**
      * @param GetCartForUser $getCartForUser
      * @param PlaceOrderModel $placeOrder
      * @param OrderRepositoryInterface $orderRepository
      * @param AggregateExceptionMessageFormatter $errorMessageFormatter
+     * @param PlaceOrderMutexInterface|null $placeOrderMutex
      */
     public function __construct(
         GetCartForUser $getCartForUser,
         PlaceOrderModel $placeOrder,
         OrderRepositoryInterface $orderRepository,
-        AggregateExceptionMessageFormatter $errorMessageFormatter
+        AggregateExceptionMessageFormatter $errorMessageFormatter,
+        ?PlaceOrderMutexInterface $placeOrderMutex = null
     ) {
         $this->getCartForUser = $getCartForUser;
         $this->placeOrder = $placeOrder;
         $this->orderRepository = $orderRepository;
         $this->errorMessageFormatter = $errorMessageFormatter;
+        $this->placeOrderMutex = $placeOrderMutex ?: ObjectManager::getInstance()->get(PlaceOrderMutexInterface::class);
     }
 
     /**
@@ -68,6 +79,26 @@ public function resolve(Field $field, $context, ResolveInfo $info, array $value
         if (empty($args['input']['cart_id'])) {
             throw new GraphQlInputException(__('Required parameter "cart_id" is missing'));
         }
+
+        return $this->placeOrderMutex->execute(
+            $args['input']['cart_id'],
+            \Closure::fromCallable([$this, 'run']),
+            [$field, $context, $info, $args]
+        );
+    }
+
+    /**
+     * Run the resolver.
+     *
+     * @param Field $field
+     * @param ContextInterface $context
+     * @param ResolveInfo $info
+     * @param array|null $args
+     * @return array[]
+     * @SuppressWarnings(PHPMD.UnusedPrivateMethod)
+     */
+    private function run(Field $field, ContextInterface $context, ResolveInfo $info, ?array $args): array
+    {
         $maskedCartId = $args['input']['cart_id'];
         $userId = (int)$context->getUserId();
         $storeId = (int)$context->getExtensionAttributes()->getStore()->getId();

app/code/Magento/QuoteGraphQl/etc/graphql/di.xml

@@ -12,6 +12,8 @@
                 type="Magento\QuoteGraphQl\Model\Cart\SetShippingMethodsOnCart"/>
     <preference for="Magento\QuoteGraphQl\Model\Cart\MergeCarts\CartQuantityValidatorInterface"
                 type="Magento\QuoteGraphQl\Model\Cart\MergeCarts\CartQuantityValidator"/>
+    <preference for="Magento\QuoteGraphQl\Model\Cart\PlaceOrderMutexInterface"
+                type="Magento\QuoteGraphQl\Model\Cart\PlaceOrderMutex" />
     <type name="Magento\QuoteGraphQl\Model\Cart\BuyRequest\BuyRequestBuilder">
         <arguments>
             <argument name="providers" xsi:type="array">

dev/tests/api-functional/testsuite/Magento/QuoteGraphQl/Model/Cart/PlaceOrderMutexTest.php

@@ -0,0 +1,97 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\QuoteGraphQl\Model\Cart;
+
+use Magento\Quote\Api\GuestCartManagementInterface;
+use Magento\TestFramework\Helper\Bootstrap as BootstrapHelper;
+
+class PlaceOrderMutexTest extends \PHPUnit\Framework\TestCase
+{
+    /**
+     * @var GuestCartManagementInterface
+     */
+    private $guestCartManagement;
+
+    /**
+     * @var PlaceOrderMutexInterface
+     */
+    private $placeOrderMutex;
+
+    protected function setUp(): void
+    {
+        $objectManager = BootstrapHelper::getObjectManager();
+        $this->placeOrderMutex = $objectManager->create(PlaceOrderMutexInterface::class);
+        $this->guestCartManagement = $objectManager->create(GuestCartManagementInterface::class);
+    }
+
+    /**
+     * Tests place order execution with different callables.
+     *
+     * @param callable $callable
+     * @param array $args
+     * @param mixed $expectedResult
+     * @return void
+     * @dataProvider callableDataProvider
+     */
+    public function testSuccessfulExecution(callable $callable, array $args, $expectedResult): void
+    {
+        $maskedQuoteId = $this->guestCartManagement->createEmptyCart();
+        $result = $this->placeOrderMutex->execute($maskedQuoteId, $callable, $args);
+
+        $this->assertEquals($expectedResult, $result);
+    }
+
+    /**
+     * @return array[]
+     */
+    public function callableDataProvider(): array
+    {
+        $functionWithArgs = function (int $a, int $b) {
+            return $a + $b;
+        };
+
+        $functionWithoutArgs = function () {
+            return 'Function without args';
+        };
+
+        return [
+            ['callable' => $functionWithoutArgs, 'args' => [], 'expectedResult' => 'Function without args'],
+            ['callable' => $functionWithArgs, 'args' => [1,2], 'expectedResult' => 3],
+            [
+                'callable' => \Closure::fromCallable([$this, 'privateMethod']),
+                'args' => ['test'],
+                'expectedResult' => 'test'
+            ],
+        ];
+    }
+
+    /**
+     * Private method for data provider.
+     *
+     * @param string $var
+     * @return string
+     * @SuppressWarnings(PHPMD.UnusedPrivateMethod)
+     */
+    private function privateMethod(string $var): string
+    {
+        return $var;
+    }
+
+    /**
+     * Tests exception when empty maskIds array has been provided.
+     *
+     * @return void
+     */
+    public function testWithEmptyMaskIdsArgument(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $callable = function () {
+        };
+        $this->placeOrderMutex->execute('', $callable);
+    }
+}