Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

<?php

declare(strict_types=1);

namespace App\Decorator;

use ApiPlatform\Validator\Exception\ValidationException;
use Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface;
use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Model\PaymentMethodInterface;
use Sylius\Component\Core\Repository\PaymentMethodRepositoryInterface;
use Sylius\Component\Core\Repository\PaymentRepositoryInterface;
use Sylius\Component\Payment\Resolver\PaymentMethodsResolverInterface;
use Symfony\Component\Validator\ConstraintViolation;
use Symfony\Component\Validator\ConstraintViolationList;
use Symfony\Contracts\Translation\TranslatorInterface;

final readonly class ChannelCheckingPaymentMethodChanger implements PaymentMethodChangerInterface
{
    public function __construct(
        private PaymentMethodChangerInterface $decorated,
        private PaymentRepositoryInterface $paymentRepository,
        private PaymentMethodRepositoryInterface $paymentMethodRepository,
        private PaymentMethodsResolverInterface $paymentMethodsResolver,
        private TranslatorInterface $translator,
    ) {
    }

    public function changePaymentMethod(string $paymentMethodCode, mixed $paymentId, OrderInterface $order): OrderInterface
    {
        /** @var PaymentMethodInterface|null $paymentMethod */
        $paymentMethod = $this->paymentMethodRepository->findOneBy(['code' => $paymentMethodCode]);
        $payment = $this->paymentRepository->findOneByOrderId($paymentId, $order->getId());

        if (
            $paymentMethod !== null
            && $payment !== null
            && !in_array($paymentMethod, $this->paymentMethodsResolver->getSupportedMethods($payment), true)
        ) {
            $template = 'sylius.payment_method.not_available';
            $parameters = ['%name%' => (string) $paymentMethod->getName()];

            throw new ValidationException(new ConstraintViolationList([
                new ConstraintViolation(
                    message: $this->translator->trans($template, $parameters, 'validators'),
                    messageTemplate: $template,
                    parameters: $parameters,
                    root: $paymentMethodCode,
                    propertyPath: '',
                    invalidValue: $paymentMethodCode,
                ),
            ]));
        }

        return $this->decorated->changePaymentMethod($paymentMethodCode, $paymentId, $order);
    }
}

bin/console cache:clear