wp-graphql / wp-graphql-woocommerce

Add WooCommerce support and functionality to your WPGraphQL server
https://woographql.com
GNU General Public License v3.0
642 stars 130 forks source link

process_auth_request causes infinite loop with Woocommerce Memberships plugin when redirecting to checkout #846

Closed collette-tamez closed 4 months ago

collette-tamez commented 5 months ago

Describe the bug When using both the Woocommerce Memberships plugin with GraphQL Woocommerce an infinite loop can occur when a user who has not already been authenticated by WordPress clicks on a transfer session link ex: https://wp.local/transfer-session?session_id=xxxxx&_wc_checkout=xxxxxx

To Reproduce Steps to reproduce the behavior:

  1. Have both plugins active
  2. User must not be currently logged into WP
  3. Retrieve a checkoutUrl from customer field via GraphQL-woocommerce
  4. Click on a transfer session link
  5. Infinite loop should occur

Expected behavior Infinite loops should not trigger while process_auth_request is executing

Screenshots If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

Smartphone (please complete the following information):

Plugin Versions

Additional context Here is a pastebin of the stack trace before xdebug bails https://pastebin.com/6YcbV9iR

What I've determined is that

  1. process_auth_request will call eventually wc_get_endpoint_url
  2. wc_get_endpoint_url will eventually trigger the woocommerce_get_query_vars filter
  3. This filter will trigger WC_Memberships::add_query_vars()
  4. WC_Memberships will eventually make a query which will fire pre_get_posts filter
  5. WooGraphQL will fire resolve_request() on the pre_get_posts filter since its priority 1
  6. resolve_request() will eventually call process_auth_request and now we're in an infinite loop

Using the Woocommerce Memberships plugin in conjunction with Woocommerce Subscriptions is a pretty common use-case. In my specific enviroment I retrieving the checkoutUrl for use in a headless react app, therefore our users would not be already authenticated with WordPress. The check in process_auth_request (line 343) does not trigger this issue and the request resolves normally.