如何通过Saleor API获取全部订单？权限配置后请求异常排查

我创建了一个拥有「Orders management」权限组的用户，该用户已具备MANAGE_ORDERS等相关权限。在localhost:3000登录应用后，调用CurrentCustomer接口返回的权限信息如下：

{
    "data": {
        "me": {
            "id": "VXNlcjoyMDg0NTEwNTU1",
            "permissionGroups": [
                {
                    "id": "R3JvdXA6MTM=",
                    "name": "Orders management",
                    "userCanManage": true
                }
            ],
            "userPermissions": [
                {
                    "code": "HANDLE_CHECKOUTS",
                    "name": "Handle checkouts"
                },
                {
                    "code": "HANDLE_PAYMENTS",
                    "name": "Handle payments"
                },
                {
                    "code": "HANDLE_TAXES",
                    "name": "Handle taxes"
                },
                {
                    "code": "IMPERSONATE_USER",
                    "name": "Impersonate user."
                },
                {
                    "code": "MANAGE_APPS",
                    "name": "Manage apps"
                },
                {
                    "code": "MANAGE_CHANNELS",
                    "name": "Manage channels."
                },
                {
                    "code": "MANAGE_CHECKOUTS",
                    "name": "Manage checkouts"
                },
                {
                    "code": "MANAGE_DISCOUNTS",
                    "name": "Manage sales and vouchers."
                },
                {
                    "code": "MANAGE_GIFT_CARD",
                    "name": "Manage gift cards."
                },
                {
                    "code": "MANAGE_MENUS",
                    "name": "Manage navigation."
                },
                {
                    "code": "MANAGE_OBSERVABILITY",
                    "name": "Manage observability"
                },
                {
                    "code": "MANAGE_ORDERS",
                    "name": "Manage orders."
                },
                {
                    "code": "MANAGE_ORDERS_IMPORT",
                    "name": "Manage orders import."
                },
                {
                    "code": "MANAGE_PAGES",
                    "name": "Manage pages."
                },
                {
                    "code": "MANAGE_PAGE_TYPES_AND_ATTRIBUTES",
                    "name": "Manage page types and attributes."
                },
                {
                    "code": "MANAGE_PLUGINS",
                    "name": "Manage plugins"
                },
                {
                    "code": "MANAGE_PRODUCTS",
                    "name": "Manage products."
                },
                {
                    "code": "MANAGE_PRODUCT_TYPES_AND_ATTRIBUTES",
                    "name": "Manage product types and attributes."
                },
                {
                    "code": "MANAGE_SETTINGS",
                    "name": "Manage settings."
                },
                {
                    "code": "MANAGE_SHIPPING",
                    "name": "Manage shipping."
                },
                {
                    "code": "MANAGE_STAFF",
                    "name": "Manage staff."
                },
                {
                    "code": "MANAGE_TAXES",
                    "name": "Manage taxes"
                },
                {
                    "code": "MANAGE_TRANSLATIONS",
                    "name": "Manage translations."
                },
                {
                    "code": "MANAGE_USERS",
                    "name": "Manage customers."
                }
            ],
            "defaultShippingAddress": null,
            "email": "artur.demenskiy@everget.co",
            "firstName": "Artur",
            "lastName": "Demenskiy",
            "dateJoined": "2024-02-01T08:26:56.144104+00:00"
        }
    },
    "extensions": {
        "cost": {
            "requestedQueryCost": 3,
            "maximumAvailable": 50000
        }
    }
}

但调用自定义的获取全部订单的查询时出现异常，即使移除filter中的customer ID或改用邮箱也无法解决。以下是相关处理函数与GraphQL查询代码：

处理函数 #

import type { OperationContext } from '@vercel/commerce/api/operations'
import { GraphQLFetcherResult } from '@vercel/commerce/api'
import type { Provider, SaleorConfig } from '..'
import * as Query from '../../utils/queries'

type ReturnType = {
  orders: any[]
}

export default function getAllOrdersOperation({
  commerce,
}: OperationContext<Provider>) {
  async function getAllOrders({
    query = Query.OrderMany,
    variables = {
      first: 10,
      filter: {
        customer: 'VXNlcjoyMDg0NTEwNTU1',
      },
    },
    config,
  }: {
    query?: string
    variables?: any
    config?: Partial<SaleorConfig>
    preview?: boolean
  } = {}): Promise<ReturnType> {
    const { fetch, locale, locales = ['en-US'] } = commerce.getConfig(config)

    console.log({ variables, locale })

    try {
      const { data }: GraphQLFetcherResult = await fetch(
        query,
        { variables },
        {
          ...(locale && {
            'Accept-Language': locale,
          }),
        }
      )
      console.log('hello', { data })
      const orders = data?.orders?.edges?.map(({ node: order }: any) => order)
      return { orders }
    } catch (err) {
      console.error('Error fetching orders', err)
      return { orders: [] }
    }
  }

  return getAllOrders
}

GraphQL查询 #

import * as fragment from '../fragments'

export const OrderMany = /* GraphQL */ `
  query OrderMany($first: Int = 10, $filter: OrderFilterInput) {
    orders(first: $first, filter: $filter) {
      ...OrderConnection
    }
  }
  ${fragment.OrderConnection}
`


export const OrderConnection = /* GraphQL */ `
  fragment OrderConnection on OrderCountableConnection {
    pageInfo {
      hasNextPage
      hasPreviousPage
    }
    edges {
      node {
        id
        number
        status
        isShippingRequired
        canFinalize
        created
        customerNote
        paymentStatus
        userEmail
        isPaid
      }
    }
  }
`

我已尝试修改variables中的filter配置，移除customer ID或改用邮箱，但问题依旧，请问这是什么原因？

• 使用了错误的查询字段：在Saleor体系中，普通用户调用orders查询只能获取自身订单，而拥有MANAGE_ORDERS权限的员工需要使用staffOrders查询才能获取全量订单。你当前的查询用的是orders，即使有权限也会被限制范围，应该替换为staffOrders，修改后的查询示例：

export const OrderMany = /* GraphQL */ `
  query OrderMany($first: Int = 10, $filter: OrderFilterInput) {
    staffOrders(first: $first, filter: $filter) {
      ...OrderConnection
    }
  }
  ${fragment.OrderConnection}
`

• 身份验证上下文缺失：检查fetch方法是否正确携带了员工的身份令牌。如果请求没有带上有效的管理员会话，Saleor会默认将请求视为普通用户请求，限制访问范围。可以确认commerce.getConfig()返回的fetch是否自动注入了Authorization: Bearer <token>这类认证头。

• 权限组配置验证：再核对一遍Saleor后台的「Orders management」权限组，确认是否真的包含了查看所有订单的权限。虽然MANAGE_ORDERS通常覆盖该能力，但不排除配置时的遗漏。

• 查询字段权限测试：尝试简化查询字段（比如只保留id和number），排查是否是某些敏感字段需要额外权限导致的异常。

内容的提问来源于stack exchange，提问作者Skitus