VCST-4710: Add memberAddresses query by ksavosteev · Pull Request #129 · VirtoCommerce/vc-module-profile-experience-api

ksavosteev · 2026-03-10T10:16:04Z

Description

query address {
  currentCustomerAddresses(
    after: "0"
    first: 20
    #countryCodes: [],
    #regionIds: [],
    #cities: []
  ) {
    totalCount
    items {
      id
      name
      countryCode
      countryName
      city
    }
  }
}

query address {
  currentOrganizationAddresses(
    after: "0"
    first: 20
    #countryCodes: [],
    #regionIds: [],
    #cities: []
  ) {
    totalCount
    items {
      id
      name
      countryCode
      countryName
      city
    }
  }
}

References

QA-test:

Jira-link:

https://virtocommerce.atlassian.net/browse/VCST-4710

Artifact URL:

https://vc3prerelease.blob.core.windows.net/packages/VirtoCommerce.ProfileExperienceApiModule_3.1003.0-pr-129-20d7.zip

Note

Medium Risk
Adds new address search GraphQL endpoints backed by Customer module search and updates authorization/address-loading behavior; issues could expose or omit addresses if filtering/permissions are misapplied. Also changes dependency versions and response groups used when loading members/addresses.

Overview
Adds two new GraphQL search queries, currentCustomerAddresses and currentOrganizationAddresses, to page through addresses for the current user or their current organization with optional filtering by countryCodes, regionIds, and cities and returning term facets.

Reworks address retrieval to use IAddressSearchService via a new IMemberAddressService.SearchMemberAddressesAsync API, introduces MemberAddressSearchCriteria/MemberAddressSearchResult, and extends the address connection schema (MemberAddressConnection*) to include facet data.

Updates authorization and member loading: the handler now explicitly allows the new queries, refactors member authorization checks, loads members using MemberResponseGroup.Default, and reloads contacts/orgs with WithAddresses when validating access to favorite-address operations. Bumps VirtoCommerce.Customer dependency to 3.1003.0-alpha.964-vcst-4710.

^{Written by Cursor Bugbot for commit 20d7077. This will update automatically on new commits. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

✅ Fixed: Excluding addresses from shared loader breaks mutations and defaults
- Restored full member response loading in the shared aggregate repository so address-dependent mutations and default address resolution receive populated addresses.
✅ Fixed: Redundant BeforeMediatorSend override adds no behavior
- Removed the no-op BeforeMediatorSend override and its now-unused imports to keep the query builder behavior unchanged but clearer.

Or push these changes by commenting:

@cursor push b6824ebc74

Preview (b6824ebc74)

diff --git a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs
--- a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs
+++ b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs
@@ -18,7 +18,7 @@
 
         public async Task<T> GetMemberAggregateRootByIdAsync<T>(string id) where T : class, IMemberAggregateRoot
         {
-            var responseGroup = MemberResponseGroup.Full & ~MemberResponseGroup.WithAddresses;
+            var responseGroup = MemberResponseGroup.Full;
             var member = await _memberService.GetByIdAsync(id, responseGroup.ToString());
             return _memberAggregateFactory.Create<T>(member);
         }

diff --git a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs
--- a/src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs
+++ b/src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs
@@ -1,5 +1,3 @@
-using System.Threading.Tasks;
-using GraphQL;
 using MediatR;
 using Microsoft.AspNetCore.Authorization;
 using VirtoCommerce.ProfileExperienceApiModule.Data.Models;
@@ -16,9 +14,4 @@
         : base(mediator, authorizationService)
     {
     }
-
-    protected override Task BeforeMediatorSend(IResolveFieldContext<object> context, MemberAddressesQuery request)
-    {
-        return base.BeforeMediatorSend(context, request);
-    }
 }

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs

src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs

src/VirtoCommerce.ProfileExperienceApiModule.Data/Schemas/MemberBaseType.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.674
Timestamp: 10-03-2026T10:40:28

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.188
Timestamp: 10-03-2026T10:50:32

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.164
Timestamp: 10-03-2026T11:01:16

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.601
Timestamp: 10-03-2026T14:14:56

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.68
Timestamp: 11-03-2026T09:02:47

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.585
Timestamp: 11-03-2026T09:55:34

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.588
Timestamp: 11-03-2026T13:12:17

...ommerce.ProfileExperienceApiModule.Data/VirtoCommerce.ProfileExperienceApiModule.Data.csproj

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.883
Timestamp: 11-03-2026T14:51:23

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.889
Timestamp: 17-03-2026T12:56:57

…module-profile-experience-api into feat/VCST-4710

...Commerce.ProfileExperienceApiModule.Data/Queries/AddressesQuery/BaseAddressesQueryHandler.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.421
Timestamp: 18-03-2026T11:44:54

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.012
Timestamp: 18-03-2026T17:17:31

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.556
Timestamp: 18-03-2026T17:37:30

src/VirtoCommerce.ProfileExperienceApiModule.Data/Services/MemberAddressService.cs

src/VirtoCommerce.ProfileExperienceApiModule.Data/Schemas/MemberAddressType.cs

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.399
Timestamp: 19-03-2026T17:36:13

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.482
Timestamp: 19-03-2026T17:45:58

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.065
Timestamp: 19-03-2026T17:55:48

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.585
Timestamp: 19-03-2026T18:14:17

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs

src/VirtoCommerce.ProfileExperienceApiModule.Data/Services/MemberAddressService.cs

cursor · 2026-03-20T14:29:20Z

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs

+                case CurrentCustomerAddressesQuery when currentMember != null:
+                case CurrentOrganizationAddressesQuery when currentMember != null:
+                    result = true;
+                    break;


Organization addresses lack membership authorization

High Severity

CurrentOrganizationAddressesQuery is authorized for any authenticated member without checking that the user belongs to the requested organization. Authorization should validate currentContact.Organizations against the current organization id before allowing access.

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.801
Timestamp: 20-03-2026T14:30:38

sonarqubecloud · 2026-03-20T15:09:59Z

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.55
Timestamp: 20-03-2026T15:11:00

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-20T15:21:12Z

src/VirtoCommerce.ProfileExperienceApiModule.Data/Models/MemberAddress.cs

 public class MemberAddress : Address
 {
-    public string Id { get => Key; set => Key = value; }
-


Removing Id-to-Key mapping breaks address mutation inputs

High Severity

The public string Id { get => Key; set => Key = value; } property was removed from MemberAddress, but InputMemberAddressType still uses Field(x => x.Id) on line 11. Previously, setting Id via a GraphQL mutation input would also set Key. Now Id resolves to the base class Address.Id (inherited from Entity), which is a separate property from Key. Since MemberAggregateRootBase.UpdateAddresses and DeleteAddresses match addresses by Key, clients sending the id field in address mutations will fail to match existing addresses — updates will create duplicates and deletes will silently no-op.

vc-ci

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.657
Timestamp: 20-03-2026T15:20:25

feat: Add memberAddresses query

e7e8846

cursor bot reviewed Mar 10, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Aggregates/MemberAggregateRootRepository.cs Outdated Show resolved Hide resolved

src/VirtoCommerce.ProfileExperienceApiModule.Data/Queries/MemberAddressesQueryBuilder.cs Outdated Show resolved Hide resolved

ksavosteev added 2 commits March 10, 2026 12:36

rollback MemberAggregateRootRepository

ebce644

fix: builder

7b2787e

cursor bot reviewed Mar 10, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Schemas/MemberBaseType.cs Outdated Show resolved Hide resolved

vc-ci reviewed Mar 10, 2026

View reviewed changes

fix: criteria keyword

fcc5f96

vc-ci reviewed Mar 10, 2026

View reviewed changes

fix: revert MemberBaseType

9d7a873

vc-ci reviewed Mar 11, 2026

View reviewed changes

feat: update dependency

32060e4

vc-ci reviewed Mar 11, 2026

View reviewed changes

feat: add MemberId to the query

a0696f0

cursor bot reviewed Mar 11, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs Show resolved Hide resolved

vc-ci reviewed Mar 11, 2026

View reviewed changes

feat: revork queries

a6d0d3b

cursor bot reviewed Mar 11, 2026

View reviewed changes

...ommerce.ProfileExperienceApiModule.Data/VirtoCommerce.ProfileExperienceApiModule.Data.csproj Outdated Show resolved Hide resolved

vc-ci reviewed Mar 11, 2026

View reviewed changes

fix: UI tests

1214714

cursor bot reviewed Mar 17, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs Show resolved Hide resolved

vc-ci reviewed Mar 17, 2026

View reviewed changes

ksavosteev added 4 commits March 18, 2026 12:55

feat: update dependency

3c688f4

Merge branch 'dev' into feat/VCST-4710

c984bdd

fix: dependency mismatch

e202cac

Merge branch 'feat/VCST-4710' of https://github.com/VirtoCommerce/vc-…

fdbf786

…module-profile-experience-api into feat/VCST-4710

cursor bot reviewed Mar 18, 2026

View reviewed changes

...Commerce.ProfileExperienceApiModule.Data/Queries/AddressesQuery/BaseAddressesQueryHandler.cs Outdated Show resolved Hide resolved

vc-ci reviewed Mar 18, 2026

View reviewed changes

fix: sonar

4c32026

cursor bot reviewed Mar 18, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs Show resolved Hide resolved

vc-ci reviewed Mar 18, 2026

View reviewed changes

fix

52362b9

vc-ci reviewed Mar 18, 2026

View reviewed changes

feat: add facets to member address connection

a252c1f

cursor bot reviewed Mar 19, 2026

View reviewed changes

ksavosteev added 3 commits March 19, 2026 19:22

fix: NRE

142c9e2

fix: NRE

5a2b51a

fix: sonar

a885986

vc-ci reviewed Mar 19, 2026

View reviewed changes

feat: refactoring

077b601

cursor bot reviewed Mar 20, 2026

View reviewed changes

src/VirtoCommerce.ProfileExperienceApiModule.Data/Authorization/ProfileAuthorizationHandler.cs Show resolved Hide resolved

src/VirtoCommerce.ProfileExperienceApiModule.Data/Services/MemberAddressService.cs Show resolved Hide resolved

ksavosteev added 3 commits March 20, 2026 16:10

feat: refactoring

3e1e2a8

fix

79d5682

sonar

a22c9df

cursor bot reviewed Mar 20, 2026

View reviewed changes

vc-ci reviewed Mar 20, 2026

View reviewed changes

fix

20d7077

vc-ci reviewed Mar 20, 2026

View reviewed changes

cursor bot reviewed Mar 20, 2026

View reviewed changes

vc-ci reviewed Mar 20, 2026

View reviewed changes

Conversation

ksavosteev commented Mar 10, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

References

QA-test:

Jira-link:

Artifact URL:

Uh oh!

cursor bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor bot Mar 20, 2026

Choose a reason for hiding this comment

Organization addresses lack membership authorization

Uh oh!

vc-ci left a comment

Choose a reason for hiding this comment

ksavosteev commented Mar 10, 2026 •

edited by cursor bot

Loading

cursor bot left a comment •

edited

Loading