fix(medusa): allow admin draft orders without an email or customer_id (#16133)

* fix(medusa): allow admin draft orders without an email or customer_id

POST /admin/draft-orders required either email or customer_id via a
validator refine(), but createOrderWorkflow and the Order data model
already tolerate neither being set. This blocked use cases with no
captured customer identity, e.g. POS/walk-in retail orders.

Raised in #15820.

* fix(medusa): don't leak an unrelated customer's email on anonymous draft orders

The customer-lookup fallback in POST /admin/draft-orders queried with
filters: { id: undefined } when customer_id was omitted, which matched
an arbitrary customer instead of none, leaking their email onto the
draft order. Only run the lookup when customer_id is provided.

Caught by the new test added in this PR.

---------

Co-authored-by: Giorgi Bregvadze <gbreg19@duck.com>

Author: GBreg19

.changeset/allow-anonymous-draft-order.md

@@ -0,0 +1,9 @@
+---
+"@medusajs/medusa": patch
+---
+
+fix(medusa): allow admin draft orders without an email or customer_id
+
+`POST /admin/draft-orders` previously rejected requests missing both `email` and `customer_id`, even though `createOrderWorkflow` and the order data model already support neither being set. This blocked use cases with no captured customer identity (e.g. POS/walk-in orders). The admin validator no longer requires either field.
+
+Also fixes a related bug the relaxed validator exposed: the route's customer-lookup fallback queried `customer` with `filters: { id: undefined }` when `customer_id` was omitted, which matched an arbitrary customer instead of none, leaking an unrelated customer's email onto the draft order. The lookup now only runs when `customer_id` is actually provided.

integration-tests/http/__tests__/draft-order/admin/draft-order.spec.ts

@@ -208,6 +208,21 @@ medusaIntegrationTestRunner({
         expect(response.data.draft_order.email).toBe("test2@test.com")
         expect(response.data.draft_order.region_id).toBe(region.id)
       })
+
+      it("should create a draft order without an email or customer_id", async () => {
+        const response = await api.post(
+          "/admin/draft-orders",
+          {
+            region_id: region.id,
+          },
+          adminHeaders
+        )
+
+        expect(response.status).toBe(200)
+        expect(response.data.draft_order.email).toBeFalsy()
+        expect(response.data.draft_order.customer_id).toBeFalsy()
+        expect(response.data.draft_order.region_id).toBe(region.id)
+      })
     })
 
     describe("GET /draft-orders/:id", () => {

packages/medusa/src/api/admin/draft-orders/route.ts

@@ -87,7 +87,7 @@ export const POST = async (
   /**
    * If the email is not provided, we fetch the customer and use the email from there.
    */
-  if (!workflowInput.email) {
+  if (!workflowInput.email && input.customer_id) {
     const queryObject = remoteQueryObjectFromString({
       entryPoint: "customer",
       variables: {

packages/medusa/src/api/admin/draft-orders/validators.ts

@@ -88,21 +88,7 @@ const CreateDraftOrder = z
   })
   .strict()
 
-export const AdminCreateDraftOrder = WithAdditionalData(
-  CreateDraftOrder,
-  (schema) => {
-    return schema.refine(
-      (data) => {
-        if (!data.email && !data.customer_id) {
-          return false
-        }
-
-        return true
-      },
-      { message: "Either email or customer_id must be provided" }
-    )
-  }
-)
+export const AdminCreateDraftOrder = WithAdditionalData(CreateDraftOrder)
 
 export type AdminUpdateDraftOrderType = z.infer<typeof AdminUpdateDraftOrder>
 export const AdminUpdateDraftOrder = z.object({