MC-36652: Restricted admin can view "Products in Carts" from all websites

Author: tsviklinskyi

app/code/Magento/Reports/Model/ResourceModel/Quote/Item/Collection.php

@@ -3,6 +3,7 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
 namespace Magento\Reports\Model\ResourceModel\Quote\Item;
 
@@ -17,6 +18,8 @@
  */
 class Collection extends \Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection
 {
+    private const PREPARED_FLAG_NAME = 'reports_collection_prepared';
+
     /**
      * Join fields
      *
@@ -99,6 +102,11 @@ protected function _construct()
     public function prepareActiveCartItems()
     {
         $quoteItemsSelect = $this->getSelect();
+
+        if ($this->getFlag(self::PREPARED_FLAG_NAME)) {
+            return $quoteItemsSelect;
+        }
+
         $quoteItemsSelect->reset()
             ->from(['main_table' => $this->getTable('quote_item')], '')
             ->columns('main_table.product_id')
@@ -114,6 +122,7 @@ public function prepareActiveCartItems()
             )->group(
                 'main_table.product_id'
             );
+        $this->setFlag(self::PREPARED_FLAG_NAME, true);
 
         return $quoteItemsSelect;
     }

app/code/Magento/Reports/Test/Unit/Model/ResourceModel/Report/Quote/CollectionTest.php

@@ -15,6 +15,7 @@
 use Magento\Framework\Event\ManagerInterface;
 use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
 use Magento\Quote\Model\ResourceModel\Quote;
+use Magento\Reports\Model\ResourceModel\Quote\Collection;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 
@@ -42,7 +43,7 @@ protected function setUp(): void
     public function testGetSelectCountSql()
     {
         /** @var MockObject $collection */
-        $collection = $this->getMockBuilder(\Magento\Reports\Model\ResourceModel\Quote\Collection::class)
+        $collection = $this->getMockBuilder(Collection::class)
             ->setMethods(['getSelect'])
             ->disableOriginalConstructor()
             ->getMock();
@@ -62,20 +63,25 @@ public function testPrepareActiveCartItems()
         $constructArgs = $this->objectManager
             ->getConstructArguments(\Magento\Reports\Model\ResourceModel\Quote\Item\Collection::class);
         $collection = $this->getMockBuilder(\Magento\Reports\Model\ResourceModel\Quote\Item\Collection::class)
-            ->setMethods(['getSelect', 'getTable'])
+            ->setMethods(['getSelect', 'getTable', 'getFlag', 'setFlag'])
             ->disableOriginalConstructor()
             ->setConstructorArgs($constructArgs)
             ->getMock();
 
-        $collection->expects($this->once())->method('getSelect')->willReturn($this->selectMock);
+        $collection->expects($this->exactly(2))->method('getSelect')->willReturn($this->selectMock);
         $this->selectMock->expects($this->once())->method('reset')->willReturnSelf();
         $this->selectMock->expects($this->once())->method('from')->willReturnSelf();
         $this->selectMock->expects($this->atLeastOnce())->method('columns')->willReturnSelf();
         $this->selectMock->expects($this->once())->method('joinInner')->willReturnSelf();
         $this->selectMock->expects($this->once())->method('where')->willReturnSelf();
         $this->selectMock->expects($this->once())->method('group')->willReturnSelf();
         $collection->expects($this->exactly(2))->method('getTable')->willReturn('table');
+        $collection->expects($this->once())->method('setFlag')
+            ->with('reports_collection_prepared')->willReturnSelf();
         $collection->prepareActiveCartItems();
+        $collection->method('getFlag')
+            ->with('reports_collection_prepared')->willReturn(true);
+        $this->assertEquals($this->selectMock, $collection->prepareActiveCartItems());
     }
 
     public function testLoadWithFilter()