Prevent merging of non-frontend-viewable orders

non-frontend viewable orders are created by Solidus admins, and these can be unintentionally merged into a user's existing orders when they login.

We want to exclude them from the list of order merge candidates

Co-authored-by: Chris Todorov <chris@super.gd>

Author: Noah-Silvera

core/app/helpers/spree/core/controller_helpers/order.rb

@@ -43,7 +43,7 @@ def associate_user
 
         def set_current_order
           if spree_current_user && current_order
-            spree_current_user.orders.by_store(current_store).incomplete.where('id != ?', current_order.id).find_each do |order|
+            spree_current_user.orders.by_store(current_store).incomplete.where(frontend_viewable: true).where('id != ?', current_order.id).find_each do |order|
               current_order.merge!(order, spree_current_user)
             end
           end

core/spec/helpers/controller_helpers/order_spec.rb

@@ -108,6 +108,16 @@
           controller.set_current_order
         end
       end
+
+      context 'an order from the same store but not frontend viewable' do
+        let(:incomplete_order_store) { store }
+        let(:incomplete_order) { create(:order, store: incomplete_order_store, user:, frontend_viewable: false) }
+
+        it 'does not call Spree::Order#merge! method' do
+          expect(order).not_to receive(:merge!)
+          controller.set_current_order
+        end
+      end
     end
   end