Openfoodnetwork: Can't delete (some) adjustments - Error 401 Unauthorized

[filipefurtad0]

Description

Follow-up on this comment and the related PR.

Editing an order, clicking on the Adjustments and on the trash-bin of the to-be-deleted adjustment. It generates a 401 error and quite noticeable changes in the UI, if the adjustment is a transaction fee; Other adjustments just seem to be deleted, but refreshing the page brings them back.

This is the case for _some_ of the adjustments. Others are successfully removed. It needs to be investigated which ones.

Expected Behavior

Deleting Adjustments should be possible. The UI should not display any visible change in format/appearance when doing so.

Actual Behaviour

Deleting adjustments doesn't work; it causes a 401 error and displays a prominet UI effect.

Steps to Reproduce

1. Log in as admin.
2. Edit a placed order; visit the Adjustments tab.
3. Try to delete an adjustment.
4. See the UI change, the 401 error and the fact that the adjustment is still there.

Animated Gif/Screenshot

Trying to delete an adjustment related to a transaction fee:

(Trippiest bug award)

It causes a 401 - unauthorized error:

Workaround

Edit the adjustment, setting it to zero.
The UI returns to normal after refreshing the page.

Severity

bug-s3: a feature is broken but there is a workaround

Your Environment

• Version used: v3.6.4
• Browser name and version: latest Chrome and Firefox
• Operating System and version (desktop or mobile): Desktop Ubuntu 20.04

Possible Fix

[RachL]

@openfoodfoundation/train-drivers-product-owners @openfoodfoundation/testers we start to receive a lot of request for this one.

It works as superadmin though, so as a workaround hubs have asked us to do the job: each week they send us the list of adjustments to delete, and we delete it for them, but it happens that we do mistakes :( I would like to bump this to s2. Does anyone disagree?

Most of the time adjustments that are causing this bug are adjustements created because of this bug: https://github.com/openfoodfoundation/openfoodnetwork/issues/3490 🙈 deleting those adjustments is mandatory to retrieve correct balances.

[Matt-Yorkley]

I have a feeling this might have already be fixed in master a while ago? I'll take a look.

[RachL]

@Matt-Yorkley I've just reproduced it in production. So not available in the latest release...

[Matt-Yorkley]

@RachL can you give some more detail on the steps to reproduce it? I just tried it with master and couldn't see how to hit this error... :man_shrugging:

[RachL]

@Matt-Yorkley can you dump FR prod data? Otherwise I can give you manager access on Slack (with super admin it works). On FR prod try deleting the following transaction fee adjustments:

• R284276637 : adjustment/transaction fee 12 april 2021 3:01 PM of 0,75 euros
• R740427146 : April 12th 1,33 €
• R664535834 : April 12th 0,34 €

[Matt-Yorkley]

Thanks, I'll take a look :+1:

I can see two logs for FR prod that show a 401 response on the adjustments controller, which indicates a permissions error...

[Matt-Yorkley]

Any chance there's some weird permissions thing here where the user account you're trying to edit the adjustments with only has permission to view the order in admin because they're a producer with products in the distributor's OC, but they technically don't have full _edit_ permissions on the order you're editing?

[RachL]

@Matt-Yorkley no sorry :( I'm clearly manager of hub 922. The email I'm using is rachel.arnould+test[at]protonmail.com

[filipefurtad0]

Yes, I second that observation @RachL, does not seem related to the hub's permissions to edit the order. But it seems to affect only transaction and shipping fees, see this order below, from staging-ES:

The shipping method (id=17) uses the weight calculator for Kg, and shared by two hubs:

The payment method (id=10) uses a flat rate per order calculator, and is also shared by two hubs:

However, the products on the order are managed by this admin (Epargos place, a producer hub).

The patterns I see here are:

• it only affects shipping and transaction fees (enterprise and tax adjustments can be deleted with no issues)
• it may relate to "shared" payment or shipping methods

I'll try to reproduce this for PM or SM which are owned by only one "actor".
PS: the name "Distributor" here is misleading - this hub is not the distributor for the relevant OC (id=14).

[filipefurtad0]

it may relate to "shared" payment or shipping methods

That's not it either. After creating:

• a Payment Method (ownd only by Espargos Place, id=21):

• an a Shipping Method (owned only by Espargos Place, id=24):

and placing a similar order with these, deleting the respective adjustments still triggers the bug.

[Matt-Yorkley]

Fixed :+1:

Thanks for the extra info!