Repository: saleor/saleor

Issue:
Query order as service account 
I'm not able to query order by id as a service account. 
`resolve_order` have `login_required` this decorator doesn't allow to run the function as a service account. 


Discussion:

Resolving patch:
diff --git a/saleor/graphql/order/resolvers.py b/saleor/graphql/order/resolvers.py
--- a/saleor/graphql/order/resolvers.py
+++ b/saleor/graphql/order/resolvers.py
@@ -1,7 +1,6 @@
 import graphene
 import graphene_django_optimizer as gql_optimizer
 
-from ...core.permissions import OrderPermissions
 from ...order import OrderStatus, models
 from ...order.events import OrderEvents
 from ...order.models import OrderEvent
@@ -52,12 +51,7 @@ def resolve_orders_total(_info, period):
 
 
 def resolve_order(info, order_id):
-    """Return order only for user assigned to it or proper staff user."""
-    user = info.context.user
-    order = graphene.Node.get_node_from_global_id(info, order_id, Order)
-    if user.has_perm(OrderPermissions.MANAGE_ORDERS) or order.user == user:
-        return order
-    return None
+    return graphene.Node.get_node_from_global_id(info, order_id, Order)
 
 
 def resolve_homepage_events():
diff --git a/saleor/graphql/order/schema.py b/saleor/graphql/order/schema.py
--- a/saleor/graphql/order/schema.py
+++ b/saleor/graphql/order/schema.py
@@ -1,5 +1,4 @@
 import graphene
-from graphql_jwt.decorators import login_required
 
 from ...core.permissions import OrderPermissions
 from ..core.enums import ReportingPeriod
@@ -130,7 +129,7 @@ class OrderQueries(graphene.ObjectType):
     def resolve_homepage_events(self, *_args, **_kwargs):
         return resolve_homepage_events()
 
-    @login_required
+    @permission_required(OrderPermissions.MANAGE_ORDERS)
     def resolve_order(self, info, **data):
         return resolve_order(info, data.get("id"))
 


Test patch:
diff --git a/tests/api/test_order.py b/tests/api/test_order.py
--- a/tests/api/test_order.py
+++ b/tests/api/test_order.py
@@ -489,7 +489,7 @@ def test_payment_information_order_events_query(
     assert data["paymentGateway"] == payment_dummy.gateway
 
 
-def test_non_staff_user_can_only_see_his_order(user_api_client, order):
+def test_non_staff_user_cannot_only_see_his_order(user_api_client, order):
     query = """
     query OrderQuery($id: ID!) {
         order(id: $id) {
@@ -500,16 +500,27 @@ def test_non_staff_user_can_only_see_his_order(user_api_client, order):
     ID = graphene.Node.to_global_id("Order", order.id)
     variables = {"id": ID}
     response = user_api_client.post_graphql(query, variables)
-    content = get_graphql_content(response)
-    order_data = content["data"]["order"]
-    assert order_data["number"] == str(order.pk)
+    assert_no_permission(response)
 
-    order.user = None
-    order.save()
-    response = user_api_client.post_graphql(query, variables)
+
+def test_query_order_as_service_account(
+    service_account_api_client, permission_manage_orders, order
+):
+    query = """
+    query OrderQuery($id: ID!) {
+        order(id: $id) {
+            token
+        }
+    }
+    """
+    ID = graphene.Node.to_global_id("Order", order.id)
+    variables = {"id": ID}
+    response = service_account_api_client.post_graphql(
+        query, variables, permissions=[permission_manage_orders]
+    )
     content = get_graphql_content(response)
     order_data = content["data"]["order"]
-    assert not order_data
+    assert order_data["token"] == order.token
 
 
 def test_draft_order_create(