[brandonkelly]

Summary

Authorization: Bearer <JWT> ──▶ Gql::getSchemaForUser($user)   (craftcms/cms#20147)
                                   │  Commerce components with `authenticated`
                                   ▼
  queries                                  mutations
  productTypes.<uid>:read  viewProductType  productTypes.<uid>:create|save|delete  create/save/deleteProductType
  orders.<store>:read      everyone*        orders.<store>:create|save|delete      editOrders / deleteOrders
  donations.all:read       everyone         donations.all:save                     manageDonationSettings
  transfers.all:read       manageInventoryTransfers  transfers.all:create|save|delete  manageInventoryTransfers
  settings.producttypes    accessCp
  settings.stores, settings.orderstatuses   everyone
  elements.drafts / revisions (from cms)    accessCp

  * limited to the user's own orders unless they have “Manage orders”
  Mutations also run Elements::canSave()/canDelete()/canCreateDrafts() for the authenticated user.

Requires craftcms/cms dev-feature/authenticated-graphql (aliased as 5.12.0 so ckeditor/redactor resolve). commerceguys/addressing stays at 2.2.5.

Non-element queries (following craftcms/cms#20055):

Component	Queries	Element field
settings.producttypes:read	productTypes, productType	productType on products
settings.stores:read	stores, store	store on orders and order statuses
settings.orderstatuses:read	orderStatuses, orderStatus	orderStatus on orders

Element queries and mutations:

Element	Queries	Mutations
Products, variants	(existing), plus draft/revision fields	save_<type>_Product (with sortOrder + variants), save_<type>_ProductDraft, createProductDraft, publishProductDraft, save_<type>_Variant, deleteProduct, deleteVariant
Orders	orders, order, orderCount	save_Order (customer, status, coupon, shipping method, addresses, lineItems: [...], isCompleted), deleteOrder
Donation	donation	save_Donation
Inventory transfers	transfers, transfer, transferCount	save_Transfer (locations, details: [...], markAsPending), deleteTransfer

Subscriptions are intentionally left out, since they're more or less deprecated.

Notes for review:

• Variants work like Matrix fields. sortOrder lists the variant IDs the product should have, in order, with new:1, new:2… for new ones. variants holds data for new and changed variants only. Variants missing from sortOrder are deleted; without sortOrder, the existing variants are kept and only updated.
• Product drafts work like entry drafts. Same arguments (draftId, provisional, asUnpublishedDraft, draftName, draftNotes), and the same draft mutations under product-specific names. Variants changed through a draft are duplicated as drafts first, like Matrix's nested entries, so the live product is untouched until the draft is published. Authenticated requests always create drafts as the authenticated user and only see their own provisional drafts. Product::canCreateDrafts() returns true for everyone, so any user with the product type's save permission can edit another user's saved draft. The control panel behaves the same way.
• lineItems and details still take a full list: items with an id are updated, items without one are created, and the rest are removed.
• save_Order with isCompleted: true calls markAsComplete() after saving, like OrdersController::actionSave(). email creates a user via ensureUserByEmail(), so user authorization is checked before anything is changed. New orders get the remote origin.
• Transfers: only drafts can change locations/items or be deleted, since markAsPending updates inventory in Transfer::afterSave(). Receiving stays in the control panel.
• Bug fix: Transfer::canView/canSave/canDelete checked commerce-manageTransfers, but the registered permission (and TransfersController) is commerce-manageInventoryTransfers. This blocked authenticated transfer mutations, so they now check the registered permission.
• Donation::canSave() is new (“Manage donation settings”), so element authorization works for authenticated requests.
• Not included: custom (non-purchasable) line items, order notices, receiving transfers, variant drafts outside of product drafts.
• productType (products) and lineItems, orderStatus, store (orders) are now reserved field handles.
• The product/variant type generators now implement SingleGeneratorInterface (generateType()), so mutations can return a specific product type's type.
• Also fixes the product/variant field layout fixtures, which used craft\elements\Product/Variant, so product GraphQL queries can run in tests.

Evidence

tests/unit/gql/AuthenticatedSchemaTest.php and tests/unit/gql/MutationsTest.php (fixtures, Gql::executeQuery):

• Authenticated reads: a user with commerce-viewProductType on T-Shirts only gets T-shirt products/variants; orderCount is 3 for the owner, 0 for another customer, 3 with commerce-manageOrders.
• save_tShirts_Product(sortOrder: ["new:2", "new:1"], variants: [...]) creates the variants in that order. variants without sortOrder updates one variant and ignores the unlisted new one. sortOrder: [$large] deletes the other variant.
• Product drafts as an authenticated user with accessCp + save permission: createProductDraft ignores creatorId; save_tShirts_ProductDraft changes the title and a variant's price while the live product and variant stay unchanged; products(drafts: true) returns the draft; publishProductDraft applies both.
• An authenticated user with saveProductType but not createProductType can update a product but gets Unable to perform the action. when creating one.
• save_Order(email, lineItems) → cart; then lineItems: [{purchasableId: blue, qty: 3}], isCompleted: true → completed, dateOrdered set, only hct-blue remains. A customer without “Edit orders” gets no orders.*:save scope; with it, save_Order saves.
• An authenticated user with “Manage inventory transfers” creates a draft transfer and marks it pending; changing its items or deleting it then fails.
• Before/after: removing the own-orders filter (3 is identical to 0), the variant draft duplication (Failed asserting that 99.0 matches expected 19.99), the pending-transfer lock, or the transfer permission fix (save_Transfer → Unable to perform the action.) each fails its test. With them: all pass.

Scratch checks (not committed):

• save_tShirts_ProductDraft(asUnpublishedDraft: true, …) with a new variant, then publishProductDraft, gives a live product with that variant.
• With authenticated schemas, stores and order statuses are available to everyone, product types need accessCp, and save_Donation needs “Manage donation settings”.
• Address validation errors come back as GraphQL errors, and orders can't be created in stores outside the schema.