User Not permitted when trying to update a subscription [3.x]:

[terryupton]

What happened?

Description

When a user tries to update a subscription form on their front-end, we are seeing the following error:
User Not permitted

At the moment this is implemented on the _includes/sprig/subscriptions/sprig-manage-addresses.twig partial.
But essentially it uses the following Craft Commerce Subscription code and subscriptions/save controller.

 <form id="subscriptionAddressesForm" method="POST">
    {{ csrfInput() }}
    {{ hiddenInput('action', 'commerce/subscriptions/save') }}
    {{ hiddenInput('subscriptionId', subscriptionId) }}
    {{ hiddenInput('fields[subscriptionBillingAddressId]', billingAddress) }}
    {{ hiddenInput('fields[subscriptionShippingAddressId]', shippingAddress) }}
    {% if redirectUrl %}
      {{ redirectInput(siteUrl(redirectUrl)) }}
    {% endif %}

This action does work if I am logged in as an admin user. But we need this functionality for customer users.

Craft CMS version

Craft Pro 3.8.7

Craft Commerce version

3.4.20.1

PHP version

8.0.28

Operating system and version

No response

Database type and version

MariaDB 10.4.28

Image driver and version

No response

Installed plugins and versions

[terryupton]

By setting the customers user group to enable 'manage subscriptions', seems to have resolved this.

[lukeholder]

One shouldn't have to create permissions for a customer to edit their custom fields. Looking into it now.

[lukeholder]

We have fixed this for the next release of commerce; a customer can now update (switch, cancel, reactivate etc) a subscription if they are the owner of the subscription and it’s a front-end request. Otherwise, the normal permissions will apply.

To get the fix early, change your craftcms/commerce requirement in composer.json to:

"require": {
  "craftcms/commerce": "dev-develop#190463d8ce9b46b602acaacf814f37fb624fda2f as 4.2.10",
  "...": "..."
}

Then run composer update.

[nfourtythree]

Version 4.2.10 of Commerce is now out with this fix.

Thanks!

[terryupton]

Thanks @lukeholder and @nfourtythree
Is this only Commerce 4? As the client tis on Commerce 3. Will this be ported back to 3 as well?

[ryanirelan]

This also closes this discussion: #3105

And my PR for fixing the docs, since I was told this was expected behavior. craftcms/docs#490