We're using Draft Orders API in our live app.
Recently one of our users complained that one of their customers were able to checkout via a draft order created by our app with a shipping address that's not included in the stores' enabled shipping zones. This is of course not acceptable.
Consider the following scenario:
* A merchant has disabled Germany from the supported shipping zones list
* We create a draft order on behalf of the store owner and show it to the customer
* The customer enters Germany as their shipping address and checks out
This flow isn't possible when checking out via the store normal checkout, the customer cannot proceed to pay for his order after entering the shipping address.
This is not acceptable for our users, can someone from the team please share the rational behind this? Is there a chance that this issue will be resoled anytime soon?
Solved! Go to the solution
This is an accepted solution.
Can you provide more information about how your app is creating the order?
Draft orders serve as a "super user" type function for merchants, meaning they can create drafts/orders on the backend and override most restrictions customers will encounter on the storefront, such as selling out of stock inventory, or using addresses not defined in shipping zones. However, overriding these behaviours needs to be done explicitly from the admin or through the API.
For example, you should only be able to sell to a country outside defined shipping zones if you set the customer's address before sending the draft. If you send a draft invoice without setting an address, the buyer will only be able to choose countries in the store's shipping zones while checking out.
If you're seeing something different, please provide more details and a few example order ids, and we can investigate further.
We use the draft order API in our Honeycomb upsell funnels app. The scenario I'm referring to is:
1. On the storefront, the customer sees a discounted cross-sell offer generated by the app.
2. The customer accepts the offer, at this moment our app generates a draft order with the customer cart content and the additional discounted offers.
* we do not fill the customer shipping/billing address in the draft order in the scenario above, hence there's likely an issue here as one of our merchants customers' was able to checkout using an invalid shipping zone.
Here are ids of orders that were generated from draft orders that we created, the shipping address is out of the store defined shipping zones:
That's strange, I'm able to replicate on that store but no where else. The behaviour definitely isn't expected, I'll investigate further and follow up here.
Can you provide the shop_id or DM the shop URL? Hopefully we can spot something similar between the shops experiencing issues, otherwise I'll add it as an example to the issue we're currently tracking.