Magento2: Create Account not working properly for Guest User : Delete operation is forbidden for current area (Enterprise Magento ver. 2.1.0)

[cybageabhishek]

Error : Delete operation is forbidden for current area

Steps to reproduce :
1. Create an address attribute from stores >> Attribute >> Customer address.
2. Set the attribute input type as Text Field
3. Set show in Front-end and show in Customer Address Registration and Customer Account Address forms.
4. Set values required field 'Yes'
5. The new text field will show up in forms.
6. Add any products to cart >> Checkout with Guest >> Fill data into newly created attributes >> Place Order >> Click on 'Create Account link'
7. Then error message receiving 'Delete operation is forbidden for current area'.

Expected result

• Notification message should be display for create account.

Actual result

• Delete operation is forbidden for current area

[cybageabhishek]

Snapshot for default setup.

[SerhiyShkolyarenko]

Hi @cybageabhishek!
Sorry, here we work with CE specific bugs only. Please, contact our enterprise support team for this issue.

[adamzero1]

This issue exists on CE 2.1.2, the underlying error appears to be that if region selection is not visible at checkout, then no 'region_id' value is passed into the customer address object when it is being created.
Causing the following code to be executed:
vendor/magento/module-customer/Model/AccountManagement.php

public function createAccountWithPasswordHash(CustomerInterface $customer, $hash, $redirectUrl = ''){
...
try {
            foreach ($customerAddresses as $address) {
                 if ($address->getId()) {
                    $newAddress = clone $address;
                    $newAddress->setId(null);
                    $newAddress->setCustomerId($customer->getId());
                    $this->addressRepository->save($newAddress);
                 } else {
                    $address->setCustomerId($customer->getId());
                    $this->addressRepository->save($address);
                }
            }
        } catch (InputException $e) {
            $this->customerRepository->delete($customer);
            throw $e;
        }
...
} 

So I think the issue is a bit of a two parter:
Issue 1: region appears to be mandatory to the customer model, but is not getting passed through.
Issue 2: Customer cannot be deleted from frontend, simulating admin feels to be a bad fix.

[SerhiyShkolyarenko]

OK. Reopened the issue.

[SerhiyShkolyarenko]

@adamzero1 please, provide steps to reproduce for community edition.
Menu item stores >> Attribute >> Customer address is absent in CE.

[paalsoberg]

@SerhiyShkolyarenko Same issue happens on CE without having to create custom address field.

[kanduvisla]

We're currently having the same issue in CE 2.1.3 (running on https). I'll see if I can reproduce the issue and provide more details.

_edit:_ I tried locally with http and https, but cannot reproduce the issue. It seems that (like many bugs) it only exists on the production server :-/. I'll dive deeper in it and if I have more results I'll post them in this issue.

[kanduvisla]

I can reproduce the problem locally!

Stack trace:

Trace: #0 /var/www/public/vendor/magento/module-customer/Model/Customer.php(1042): Magento\Framework\Model\AbstractModel->beforeDelete()
#1 /var/www/public/vendor/magento/module-eav/Model/Entity/AbstractEntity.php(1699): Magento\Customer\Model\Customer->beforeDelete()
#2 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(74): Magento\Eav\Model\Entity\AbstractEntity->delete(Object(Magento\Customer\Model\Customer))
#3 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(70): Magento\Customer\Model\ResourceModel\Customer\Interceptor->___callParent('delete', Array)
#4 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Custome...', 'delete', Object(Magento\Customer\Model\ResourceModel\Customer\Interceptor), Array, 'clean_cache')
#5 /var/www/public/vendor/magento/framework/App/Cache/FlushCacheByTags.php(93): Magento\Customer\Model\ResourceModel\Customer\Interceptor->Magento\Framework\Interception\{closure}(Object(Magento\Customer\Model\Customer))
#6 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(142): Magento\Framework\App\Cache\FlushCacheByTags->aroundDelete(Object(Magento\Customer\Model\ResourceModel\Customer\Interceptor), Object(Closure), Object(Magento\Customer\Model\Customer))
#7 /var/www/public/var/generation/Magento/Customer/Model/ResourceModel/Customer/Interceptor.php(533): Magento\Customer\Model\ResourceModel\Customer\Interceptor->___callPlugins('delete', Array, Array)
#8 /var/www/public/vendor/magento/framework/Model/AbstractModel.php(816): Magento\Customer\Model\ResourceModel\Customer\Interceptor->delete(Object(Magento\Customer\Model\Customer))
#9 /var/www/public/vendor/magento/module-customer/Model/ResourceModel/CustomerRepository.php(313): Magento\Framework\Model\AbstractModel->delete()
#10 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(74): Magento\Customer\Model\ResourceModel\CustomerRepository->deleteById('29')
#11 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(70): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->___callParent('deleteById', Array)
#12 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Custome...', 'deleteById', Object(Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor), Array, 'update_newslett...')
#13 /var/www/public/vendor/magento/module-newsletter/Model/Plugin/CustomerPlugin.php(88): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->Magento\Framework\Interception\{closure}('29')
#14 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(142): Magento\Newsletter\Model\Plugin\CustomerPlugin->aroundDeleteById(Object(Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor), Object(Closure), '29')
#15 /var/www/public/var/generation/Magento/Customer/Model/ResourceModel/CustomerRepository/Interceptor.php(91): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->___callPlugins('deleteById', Array, Array)
#16 /var/www/public/vendor/magento/module-customer/Model/ResourceModel/CustomerRepository.php(304): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->deleteById('29')
#17 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(74): Magento\Customer\Model\ResourceModel\CustomerRepository->delete(Object(Magento\Customer\Model\Data\Customer))
#18 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(70): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->___callParent('delete', Array)
#19 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Custome...', 'delete', Object(Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor), Array, 'update_newslett...')
#20 /var/www/public/vendor/magento/module-newsletter/Model/Plugin/CustomerPlugin.php(112): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->Magento\Framework\Interception\{closure}(Object(Magento\Customer\Model\Data\Customer))
#21 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(142): Magento\Newsletter\Model\Plugin\CustomerPlugin->aroundDelete(Object(Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor), Object(Closure), Object(Magento\Customer\Model\Data\Customer))
#22 /var/www/public/var/generation/Magento/Customer/Model/ResourceModel/CustomerRepository/Interceptor.php(78): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->___callPlugins('delete', Array, Array)
#23 /var/www/public/vendor/magento/module-customer/Model/AccountManagement.php(731): Magento\Customer\Model\ResourceModel\CustomerRepository\Interceptor->delete(Object(Magento\Customer\Model\Data\Customer))
#24 /var/www/public/var/generation/Magento/Customer/Model/AccountManagement/Interceptor.php(141): Magento\Customer\Model\AccountManagement->createAccountWithPasswordHash(Object(Magento\Customer\Model\Data\Customer), NULL, '')
#25 /var/www/public/vendor/magento/module-customer/Model/AccountManagement.php(662): Magento\Customer\Model\AccountManagement\Interceptor->createAccountWithPasswordHash(Object(Magento\Customer\Model\Data\Customer), NULL, '')
#26 /var/www/public/var/generation/Magento/Customer/Model/AccountManagement/Interceptor.php(128): Magento\Customer\Model\AccountManagement->createAccount(Object(Magento\Customer\Model\Data\Customer), NULL, '')
#27 /var/www/public/vendor/magento/module-sales/Model/Order/CustomerManagement.php(117): Magento\Customer\Model\AccountManagement\Interceptor->createAccount(Object(Magento\Customer\Model\Data\Customer))
#28 /var/www/public/vendor/magento/module-checkout/Controller/Account/Create.php(78): Magento\Sales\Model\Order\CustomerManagement->create('47')
#29 /var/www/public/var/generation/Magento/Checkout/Controller/Account/Create/Interceptor.php(24): Magento\Checkout\Controller\Account\Create->execute()
#30 /var/www/public/vendor/magento/framework/App/Action/Action.php(102): Magento\Checkout\Controller\Account\Create\Interceptor->execute()
#31 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(74): Magento\Framework\App\Action\Action->dispatch(Object(Magento\Framework\App\Request\Http))
#32 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(70): Magento\Checkout\Controller\Account\Create\Interceptor->___callParent('dispatch', Array)
#33 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Checkou...', 'dispatch', Object(Magento\Checkout\Controller\Account\Create\Interceptor), Array, 'contextPlugin')
#34 /var/www/public/vendor/magento/module-store/App/Action/Plugin/Context.php(106): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#35 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Store\App\Action\Plugin\Context->aroundDispatch(Object(Magento\Checkout\Controller\Account\Create\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#36 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Checkou...', 'dispatch', Object(Magento\Checkout\Controller\Account\Create\Interceptor), Array, 'customer-app-ac...')
#37 /var/www/public/vendor/magento/module-customer/Model/App/Action/ContextPlugin.php(61): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#38 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Customer\Model\App\Action\ContextPlugin->aroundDispatch(Object(Magento\Checkout\Controller\Account\Create\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#39 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Checkou...', 'dispatch', Object(Magento\Checkout\Controller\Account\Create\Interceptor), Array, 'storeCheck')
#40 /var/www/public/vendor/magento/module-store/App/Action/Plugin/StoreCheck.php(44): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#41 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Store\App\Action\Plugin\StoreCheck->aroundDispatch(Object(Magento\Checkout\Controller\Account\Create\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#42 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Checkou...', 'dispatch', Object(Magento\Checkout\Controller\Account\Create\Interceptor), Array, 'weee-app-action...')
#43 /var/www/public/vendor/magento/module-weee/Model/App/Action/ContextPlugin.php(112): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#44 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Weee\Model\App\Action\ContextPlugin->aroundDispatch(Object(Magento\Checkout\Controller\Account\Create\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#45 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Checkou...', 'dispatch', Object(Magento\Checkout\Controller\Account\Create\Interceptor), Array, 'tax-app-action-...')
#46 /var/www/public/vendor/magento/module-tax/Model/App/Action/ContextPlugin.php(91): Magento\Checkout\Controller\Account\Create\Interceptor->Magento\Framework\Interception\{closure}(Object(Magento\Framework\App\Request\Http))
#47 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(142): Magento\Tax\Model\App\Action\ContextPlugin->aroundDispatch(Object(Magento\Checkout\Controller\Account\Create\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#48 /var/www/public/var/generation/Magento/Checkout/Controller/Account/Create/Interceptor.php(39): Magento\Checkout\Controller\Account\Create\Interceptor->___callPlugins('dispatch', Array, Array)
#49 /var/www/public/vendor/magento/framework/App/FrontController.php(55): Magento\Checkout\Controller\Account\Create\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#50 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(74): Magento\Framework\App\FrontController->dispatch(Object(Magento\Framework\App\Request\Http))
#51 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(70): Magento\Framework\App\FrontController\Interceptor->___callParent('dispatch', Array)
#52 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Framewo...', 'dispatch', Object(Magento\Framework\App\FrontController\Interceptor), Array, 'requestPreproce...')
#53 /var/www/public/vendor/magento/module-store/App/FrontController/Plugin/RequestPreprocessor.php(94): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#54 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Store\App\FrontController\Plugin\RequestPreprocessor->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#55 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Framewo...', 'dispatch', Object(Magento\Framework\App\FrontController\Interceptor), Array, 'install')
#56 /var/www/public/vendor/magento/framework/Module/Plugin/DbStatusValidator.php(69): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#57 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\Framework\Module\Plugin\DbStatusValidator->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#58 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(63): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Framewo...', 'dispatch', Object(Magento\Framework\App\FrontController\Interceptor), Array, 'front-controlle...')
#59 /var/www/public/vendor/magento/module-page-cache/Model/App/FrontController/VarnishPlugin.php(55): Magento\Framework\Interception\Chain\Chain->Magento\Framework\Interception\Chain\{closure}(Object(Magento\Framework\App\Request\Http))
#60 /var/www/public/vendor/magento/framework/Interception/Chain/Chain.php(67): Magento\PageCache\Model\App\FrontController\VarnishPlugin->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#61 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\Interception\Chain\Chain->invokeNext('Magento\\Framewo...', 'dispatch', Object(Magento\Framework\App\FrontController\Interceptor), Array, 'front-controlle...')
#62 /var/www/public/vendor/magento/module-page-cache/Model/App/FrontController/BuiltinPlugin.php(68): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception\{closure}(Object(Magento\Framework\App\Request\Http))
#63 /var/www/public/vendor/magento/framework/Interception/Interceptor.php(142): Magento\PageCache\Model\App\FrontController\BuiltinPlugin->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#64 /var/www/public/var/generation/Magento/Framework/App/FrontController/Interceptor.php(26): Magento\Framework\App\FrontController\Interceptor->___callPlugins('dispatch', Array, Array)
#65 /var/www/public/vendor/magento/framework/App/Http.php(135): Magento\Framework\App\FrontController\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#66 /var/www/public/vendor/magento/framework/App/Bootstrap.php(258): Magento\Framework\App\Http->launch()
#67 /var/www/public/pub/index.php(37): Magento\Framework\App\Bootstrap->run(Object(Magento\Framework\App\Http))
#68 {main} [] []

Credentials used:

Firstname: Foo
Lastname: -
Postal Code: 1111AA
Street[0]: Diemerkade
Street[1]: 1
Street[2]: 18A
City: Diemen
Email: [email protected]
Telephone: -
Country: Netherlands

Magento 2.1.3

All caches are enabled, except the full page cache.

Can anyone replicate this issue with this information?

[kanduvisla]

Fact: When I leave street[2] empty it works, but as soon as street[2] is populated it gives this error. I'll try to confirm again, but it seems like this is the source of the problem.

[kanduvisla]

Once again I'm the victim of a feature, not a bug: If I comment out $this->customerRepository->delete() in \Magento\Customer\Model\AccountManagement::createAccountWithPasswordHash I get the real exception, thrown by the address repository:

Street Address" cannot contain more than 2 lines.

In my _(cough)_ custom checkout template I have 3 address fields, but my configuration was still set to 2. So... yeah... BUT:

It does bring some interesting thoughts above that could still be considered as bugs:

1. The request to the API during checkout didn't fail because address had one field too much. So it could be considered a bug that this endpoint lacks this validation.
2. The error message mentions Delete operation is forbidden for current area, while it would be much more obvious to show the _real_ error, which is Street Address" cannot contain more than 2 lines.. So there's definitely room for improvement there. In my opinion improper error messages could also be considered a bug.

So I'll leave it up to the community what to do with these findings. For now I'm helped. At least I hope this topic helps someone else in the future.

[harrigo]

I'm experiencing this also after a lot of trying to debug what is causing this and whether this is a bug or a problem with my code i am unsure. I know that if i leave the non required street address 2 field blank this issue occurs which is other way around to Kanduvisla issue but have not really modified checkout fields.

[magento-engcom-team]

@cybageabhishek, thank you for your report.
We were not able to reproduce this issue by following the steps you provided. If you'd like to update it, please reopen the issue.
We tested the issue on 2.3.0-dev, 2.2.0, 2.1.9