Merge commit from fork

The adjustDraftOrderLine Admin API mutation was decorated with
Permission.Owner in addition to Permission.UpdateOrder. Permission.Owner
causes the AuthGuard to create an anonymous session and admit callers that
hold none of the other required permissions, so an unauthenticated caller
could adjust the line quantities of any draft order by supplying its id.
Draft orders have no owning customer, so Owner grants no meaningful scoping
here; every sibling draft-order mutation requires a concrete permission and
none use Owner.

Require Permission.UpdateOrder only, matching the other draft-order
mutations, and add an e2e test asserting an anonymous caller is rejected.

Relates to GHSA-hc75-2v4j-x372

Author: michaelbromley

packages/core/e2e/draft-order.e2e-spec.ts

@@ -168,6 +168,23 @@ describe('Draft Orders resolver', () => {
         expect(adjustDraftOrderLine.lines[0].quantity).toBe(2);
     });
 
+    // GHSA-hc75-2v4j-x372 — adjustDraftOrderLine must reject unauthenticated callers
+    it('adjustDraftOrderLine is not accessible to anonymous users', async () => {
+        const firstLine = draftOrder.lines[0];
+        if (!firstLine) throw new Error('Expected first line to exist');
+        await adminClient.asAnonymousUser();
+        await expect(
+            adminClient.query(adjustDraftOrderLineDocument, {
+                orderId: draftOrder.id,
+                input: {
+                    orderLineId: firstLine.id,
+                    quantity: 99,
+                },
+            }),
+        ).rejects.toThrow('not currently authorized to perform this action');
+        await adminClient.asSuperAdmin();
+    });
+
     it('removeDraftOrderLine', async () => {
         const firstLine = draftOrder.lines[0];
         if (!firstLine) throw new Error('Expected first line to exist');

packages/core/src/api/resolvers/admin/draft-order.resolver.ts

@@ -99,7 +99,7 @@ export class DraftOrderResolver {
 
     @Transaction()
     @Mutation()
-    @Allow(Permission.UpdateOrder, Permission.Owner)
+    @Allow(Permission.UpdateOrder)
     async adjustDraftOrderLine(
         @Ctx() ctx: RequestContext,
         @Args() { orderId, input }: MutationAdjustDraftOrderLineArgs,