Skip to content

Conversation

@DanieliMi
Copy link
Contributor

@DanieliMi DanieliMi commented Feb 22, 2024

Deletion of the customer is only possible if isSecureArea is true. If it is not set deletion will fail with an exception and the customer will not know why the registration failed and will not be able to register again due to the existing entity.

Description (*)

When the address form is enabled in the registration and an required address field is missing the registration will fail with the message "Delete operation is forbidden for current area". This is because first the customer is created and then the address is saved. When the address cannot be saved due to validation errors the customer needs to be deleted which will fail in a non secure area. Then the customer cannot register again because the customer entity already exists. Deletion is not possible because isSecureArea is not set at this point. This PR sets isSecureArea for the deletion process.

Related Pull Requests

Fixed Issues (if relevant)

Manual testing scenarios (*)

  1. Enable address form in customer registration in customer_account_create.xml:
<referenceBlock name="customer_form_register">
    <arguments>
        <argument name="show_address_fields" xsi:type="boolean">true</argument>
    </arguments>
</referenceBlock>
  1. Go to /customer/account/create/
  2. Fill in the form
  3. Remove an required address field
  4. Send the form

Questions or comments

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All new or changed code is covered with unit/integration tests (if applicable)
  • README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
  • All automated tests passed successfully (all builds are green)

Resolved issues:

  1. resolves [Issue] Set isSecureArea before deleting customer #40211: Set isSecureArea before deleting customer

Deletion of the customer is only possible if isSecureArea is true. If it is not set deletion will fail with an exception and the customer will not know why the registration failed and will not be able to register again due to the existing entity.
@m2-assistant
Copy link

m2-assistant bot commented Feb 22, 2024

Hi @DanieliMi. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.

Add the comment under your pull request to deploy test or vanilla Magento instance:
  • @magento give me test instance - deploy test instance based on PR changes
  • @magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

  • @magento run all tests - run or re-run all required tests against the PR changes
  • @magento run <test-build(s)> - run or re-run specific test build(s)
    For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:
  1. Database Compare
  2. Functional Tests CE
  3. Functional Tests EE
  4. Functional Tests B2B
  5. Integration Tests
  6. Magento Health Index
  7. Sample Data Tests CE
  8. Sample Data Tests EE
  9. Sample Data Tests B2B
  10. Static Tests
  11. Unit Tests
  12. WebAPI Tests
  13. Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.


For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

@engcom-Hotel engcom-Hotel added the Priority: P1 Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing. label Feb 23, 2024
@engcom-Hotel engcom-Hotel linked an issue Feb 23, 2024 that may be closed by this pull request
4 tasks
@VladyslavSikailo
Copy link
Contributor

This problem has also happened to me.

Thanks for the solution @DanieliMi

But I think the process itself should be rewritten here.
Why does it save customer entitiy before performing address validation?

The address validation is tightly coupled with customer address saving process in here \Magento\Customer\Model\ResourceModel\Address::_validate

We should somehow move/copy it from there and perform before we do any savings

What do you think?

@VladyslavSikailo
Copy link
Contributor

VladyslavSikailo commented Aug 27, 2025

Alright, here is the fix for my use case

We have customer address fields within a registration form, so we receive this error when the address is invalid.

So I created a little plugin that validates the address BEFORE Magento saves anything

<?php

declare(strict_types=1);

namespace Vendor\CustomerAddress\Plugin\Account;

use Magento\Customer\Api\AccountManagementInterface;
use Magento\Customer\Api\Data\AddressInterface;
use Magento\Customer\Api\Data\CustomerInterface;
use Magento\Framework\Validator\Exception;
use Magento\Framework\Validator\Factory;

class ValidateAddressBeforeRegistrationPlugin
{
    public function __construct(private readonly Factory $validatorFactory)
    {
    }

    /**
     * @throws Exception
     */
    public function beforeCreateAccountWithPasswordHash(
        AccountManagementInterface $subject,
        CustomerInterface $customer
    ): null {
        foreach ($customer->getAddresses() ?? [] as $address) {
            $this->validateAddress($address);
        }

        return null;
    }

    /**
     * @throws Exception
     */
    private function validateAddress(AddressInterface $address): void
    {
        $validator = $this->validatorFactory->createValidator('customer_address', 'save');

        if (!$validator->isValid($address)) {
            throw new Exception(null, null, $validator->getMessages());
        }
    }
}
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <type name="Magento\Customer\Api\AccountManagementInterface">
        <plugin name="vendor_validate_address_before_registration"
                type="Vendor\CustomerAddress\Plugin\Account\ValidateAddressBeforeRegistrationPlugin"/>
    </type>
</config>

@ihor-sviziev
Copy link
Contributor

@VladyslavSikailo, could you please create it as a pull request?

@DanieliMi
Copy link
Contributor Author

Yeah I agree, it would be much better to validate first, before even creating the customer! Would be awesome to replace this PR with a better solution!

Another approach could be to wrap it within a transaction.

@VladyslavSikailo
Copy link
Contributor

VladyslavSikailo commented Aug 27, 2025

@ihor-sviziev I am not really sure it should be merged into the core like that.

@engcom-Hotel
Copy link
Contributor

@magento run all tests

Copy link
Contributor

@engcom-Hotel engcom-Hotel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @DanieliMi,

Thank you for the contribution!

I agree with the @VladyslavSikailo's comment here.

However, since the delete customer functionality does not work if the isSecureArea flag is not set to true, the current implementation is also not functioning as expected. Therefore, I believe we can proceed with this PR.

Please review and resolve the static test failure.

Thanks

@engcom-Hotel engcom-Hotel moved this from Pending Review to Changes Requested in Community Dashboard Sep 18, 2025
@DanieliMi
Copy link
Contributor Author

Hi @engcom-Hotel, I have extracted the new code into a separate method which should fix the static tests. Do they run automatically or do I have to start them manually?

@engcom-Hotel
Copy link
Contributor

Hello @DanieliMi,

Thanks for making the changes to fix the static test failures. To run the automate test, we need to run the below command manually:

@magento run all tests

@DanieliMi
Copy link
Contributor Author

@magento run all tests

@engcom-Hotel
Copy link
Contributor

@magento run all tests

@engcom-Hotel engcom-Hotel moved this from Changes Requested to Review in Progress in Community Dashboard Sep 23, 2025
@engcom-Bravo
Copy link
Contributor

@magento run all tests

@engcom-Bravo
Copy link
Contributor

@magento create issue

@ct-prd-pr-scan
Copy link

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

@engcom-Bravo
Copy link
Contributor

Hi @DanieliMi,

Thanks for the collaboration & contribution!

✔️ QA Passed

Preconditions:

  • Install fresh Magento 2.4-develop

Manual testing scenarios

  • Enable address form in customer registration in customer_account_create.xml:
<referenceBlock name="customer_form_register">
    <arguments>
        <argument name="show_address_fields" xsi:type="boolean">true</argument>
    </arguments>
</referenceBlock>
  • Go to /customer/account/create/
  • Fill in the form
  • Remove an required address field
  • Send the form

Before: ✖️

Screenshot 2025-09-25 at 12 11 22 pm

After: ✔️

Now Deletion is Possible and customer can register again successfully.

Builds are failed. Hence, moving this PR to Extended Testing.

Thanks.

@engcom-Bravo engcom-Bravo moved this from Testing in Progress to Extended testing (optional) in Community Dashboard Sep 25, 2025
@engcom-Dash
Copy link
Contributor

@magento run all tests

@engcom-Dash
Copy link
Contributor

@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE, Integration Tests

@engcom-Dash
Copy link
Contributor

@magento run Functional Tests CE

@engcom-Dash
Copy link
Contributor

@magento run Functional Tests B2B

@engcom-Dash
Copy link
Contributor

The consistent failures in Functional B2B, EE, and CE are known issues and JIRA is open for the same. The other failures are inconsistent and flaky. They neither part of the PR nor failing because of the PR changes.

B2B
Build 1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/4608a90fa507db96f3f2f2be83ada2e0/Functional/allure-report-b2b/index.html
image

Build 2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/a736a529f8313e1a50b1d8619909c86e/Functional/allure-report-b2b/index.html
image

Known Issue
StorefrontGuestCreateOrderWithConfigurableProductCustomStockTest ACQE-8846
StorefrontGuestCreateOrderWithBundleProductCustomStockTestACQE-8845
StorefrontGuestCreateOrderWithGroupedProductCustomStockTest ACQE-8847
StorefrontReviewAndPaymentPageWithSimpleProductCustomStockTest ACQE-8852

EE
Build 1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/d17f50ad313a0b9f22b8017d02936167/Functional/allure-report-ee/index.html
image

Build 2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/964970fead8871fc182544e1bc1f0cc2/Functional/allure-report-ee/index.html
image

Known Issue
AdminRmaSettingsConfigurationTest ACQE-8655
StorefrontGuestCreateOrderWithConfigurableProductCustomStockTest ACQE-8846
StorefrontGuestCreateOrderWithBundleProductCustomStockTestACQE-8845
StorefrontGuestCreateOrderWithGroupedProductCustomStockTest ACQE-8847
StorefrontReviewAndPaymentPageWithSimpleProductCustomStockTest ACQE-8852

CE
Build 1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/96e719336f306cc95eea0adc1196ff99/Functional/allure-report-ce/index.html
image

Build 2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38462/a18e54dd69512246d34a3259c35a7c40/Functional/allure-report-ce/index.html
image

Known Issue
StorefrontGuestCreateOrderWithConfigurableProductCustomStockTest ACQE-8846
StorefrontGuestCreateOrderWithBundleProductCustomStockTestACQE-8845
StorefrontGuestCreateOrderWithGroupedProductCustomStockTest ACQE-8847
StorefrontReviewAndPaymentPageWithSimpleProductCustomStockTest ACQE-8852

Hence, Moving this PR to Merge In Progress

@engcom-Dash engcom-Dash moved this from Extended testing (optional) to Merge in Progress in Community Dashboard Oct 8, 2025
@magento-devops-reposync-svc magento-devops-reposync-svc merged commit 22e91fb into magento:2.4-develop Oct 13, 2025
9 of 12 checks passed
@ct-prd-projects-boards-automation ct-prd-projects-boards-automation bot moved this from Merge in Progress to Recently Merged in Community Dashboard Oct 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Priority: P1 Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing. Progress: testing in progress Project: Community Picked PRs upvoted by the community

Projects

Status: Recently Merged

Development

Successfully merging this pull request may close these issues.

[Issue] Set isSecureArea before deleting customer [Issue] Fixed 'Delete operation is forbidden for current area' error.

8 participants