Out of stock items can still be bought when inside an active order

[kyunal]

Describe the bug
It's possible to buy items that are out of stock if they were added to the cart (added to an active order) before they went out of stock.

To Reproduce
Steps to reproduce the behavior:

1. Consider User A, User B and Item C with a quantity of 20
2. User A puts 5 items in their cart
3. User B puts 20 items in his their and checks out
4. After the items have been bought and the stock is depleted, User A can still check out and buy the things in their cart
5. Saleable stock is negative and the item was oversold

Expected behavior
The shop API should refuse the purchasing of the items and throw an error, forcing User A to take action and to adjust their cart

Environment (please complete the following information):

• @vendure/core version: 1.6.5
• Nodejs version: 16 LTS
• Database (mysql/postgres etc): postgres
• Inventory tracking through vendure is enabled

Additional context
Other variations are possible, e.g. User B does not need to buy the entire stock, just enough so that whatever User B will buy is not fully available anymore.

A potential workaround was discussed through the implementation of a CustomOrderProcess that uses the onTransitionStart hook to check stock levels before the order changes state to ArrangingPayment.

[kyunal]

Example snippet of said workaround for the sake of completeness:

import { CustomOrderProcess } from "@vendure/core";

export const stockValidationProcess: CustomOrderProcess<"ArrangingPayment"> = {
    async onTransitionStart(fromState, toState, data) {
        if (toState !== 'ArrangingPayment') {
            return;
        }

        for (const line of data.order.lines) {
            const availableStock = line.productVariant.stockOnHand - line.productVariant.stockAllocated;
            if (line.quantity > availableStock) {
                return `Not enough stock for ${line.productVariant.name}`;
            }
        }
    },
};

[jpetrich]

Thanks for the workaround @kyunal - really helped!

[kyunal]

Thanks for tackling the issue. This change will prevent the primary issue, but I think that there's more to consider.

For instance, if my storefront decides to set the order to ArrangingPayment first (I can see this happening when working with multiple payment methods) and then uses one of the asynchronous payment methods (e.g. Stripe, Mollie) this will still fail. This is also an issue with the workaround I originally provided. We might not need a logic adjustment for this and simply documenting it would suffice.

In addition, there's no refund mechanism for these failed payments, but this is probably something the payment plugins need to handle themselves.

Also, for the storefront there's no direct way to know that the payment failed because of insufficient stock if it is handled through an asynchronous payment method with webhook events. We can check that the order is still active, but the reason could be something different so it is just guessing. Ideally, there would be an event or an indicator that (part of) the stock is depleted and the order would also be adjusted accordingly.

[michaelbromley]

@kyunal Thanks for this feedback. You're correct, there are still cases where stock can be oversold.

This is a pretty complex issue given all the combinations of possible order processes and payment flows. I am thinking that there may need to be a more fundamental re-think of some parts of the checkout & payment flows.

For example, I don't really like the fact that certain state transition guards are hard-coded in the core. It makes the state machine not truly as flexible as it could be. I've had in mind to re-visit this for v2 and see if we can come up with a better design. Not radically different, just better. And this issue is an example of something that I would like to make simpler to handle if possible.

I don't have any concrete ideas on this yet, but I'm very open to suggestions.