prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Customer shouldn't be able to query draft order. 
  Customer shouldn't be able to query draft order, by id and by token. 
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `saleor/graphql/order/resolvers.py`
  Content:
  ```
  1 import graphene
  2 import graphene_django_optimizer as gql_optimizer
  3 
  4 from ...order import OrderStatus, models
  5 from ...order.events import OrderEvents
  6 from ...order.models import OrderEvent
  7 from ...order.utils import sum_order_totals
  8 from ..utils import filter_by_period, filter_by_query_param, sort_queryset
  9 from .enums import OrderStatusFilter
  10 from .sorters import OrderSortField
  11 from .types import Order
  12 
  13 ORDER_SEARCH_FIELDS = ("id", "discount_name", "token", "user_email", "user__email")
  14 
  15 
  16 def filter_orders(qs, info, created, status, query):
  17     qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)
  18 
  19     # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.
  20     # filter orders by status
  21     if status is not None:
  22         if status == OrderStatusFilter.READY_TO_FULFILL:
  23             qs = qs.ready_to_fulfill()
  24         elif status == OrderStatusFilter.READY_TO_CAPTURE:
  25             qs = qs.ready_to_capture()
  26 
  27     # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.
  28     # filter orders by creation date
  29     if created is not None:
  30         qs = filter_by_period(qs, created, "created")
  31 
  32     return gql_optimizer.query(qs, info)
  33 
  34 
  35 def resolve_orders(info, created, status, query, sort_by=None):
  36     qs = models.Order.objects.confirmed()
  37     qs = sort_queryset(qs, sort_by, OrderSortField)
  38     return filter_orders(qs, info, created, status, query)
  39 
  40 
  41 def resolve_draft_orders(info, created, query, sort_by=None):
  42     qs = models.Order.objects.drafts()
  43     qs = sort_queryset(qs, sort_by, OrderSortField)
  44     return filter_orders(qs, info, created, None, query)
  45 
  46 
  47 def resolve_orders_total(_info, period):
  48     qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)
  49     qs = filter_by_period(qs, period, "created")
  50     return sum_order_totals(qs)
  51 
  52 
  53 def resolve_order(info, order_id):
  54     return graphene.Node.get_node_from_global_id(info, order_id, Order)
  55 
  56 
  57 def resolve_homepage_events():
  58     # Filter only selected events to be displayed on homepage.
  59     types = [
  60         OrderEvents.PLACED,
  61         OrderEvents.PLACED_FROM_DRAFT,
  62         OrderEvents.ORDER_FULLY_PAID,
  63     ]
  64     return OrderEvent.objects.filter(type__in=types)
  65 
  66 
  67 def resolve_order_by_token(token):
  68     return models.Order.objects.filter(token=token).first()
  69
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/saleor/graphql/order/resolvers.py b/saleor/graphql/order/resolvers.py
  --- a/saleor/graphql/order/resolvers.py
  +++ b/saleor/graphql/order/resolvers.py
  @@ -65,4 +65,8 @@
   
   
   def resolve_order_by_token(token):
  -    return models.Order.objects.filter(token=token).first()
  +    return (
  +        models.Order.objects.exclude(status=OrderStatus.DRAFT)
  +        .filter(token=token)
  +        .first()
  +    )
  
verification_info: {"golden_diff": "diff --git a/saleor/graphql/order/resolvers.py b/saleor/graphql/order/resolvers.py\n--- a/saleor/graphql/order/resolvers.py\n+++ b/saleor/graphql/order/resolvers.py\n@@ -65,4 +65,8 @@\n \n \n def resolve_order_by_token(token):\n-    return models.Order.objects.filter(token=token).first()\n+    return (\n+        models.Order.objects.exclude(status=OrderStatus.DRAFT)\n+        .filter(token=token)\n+        .first()\n+    )\n", "issue": "Customer shouldn't be able to query draft order. \nCustomer shouldn't be able to query draft order, by id and by token. \n", "before_files": [{"content": "import graphene\nimport graphene_django_optimizer as gql_optimizer\n\nfrom ...order import OrderStatus, models\nfrom ...order.events import OrderEvents\nfrom ...order.models import OrderEvent\nfrom ...order.utils import sum_order_totals\nfrom ..utils import filter_by_period, filter_by_query_param, sort_queryset\nfrom .enums import OrderStatusFilter\nfrom .sorters import OrderSortField\nfrom .types import Order\n\nORDER_SEARCH_FIELDS = (\"id\", \"discount_name\", \"token\", \"user_email\", \"user__email\")\n\n\ndef filter_orders(qs, info, created, status, query):\n    qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by status\n    if status is not None:\n        if status == OrderStatusFilter.READY_TO_FULFILL:\n            qs = qs.ready_to_fulfill()\n        elif status == OrderStatusFilter.READY_TO_CAPTURE:\n            qs = qs.ready_to_capture()\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by creation date\n    if created is not None:\n        qs = filter_by_period(qs, created, \"created\")\n\n    return gql_optimizer.query(qs, info)\n\n\ndef resolve_orders(info, created, status, query, sort_by=None):\n    qs = models.Order.objects.confirmed()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, status, query)\n\n\ndef resolve_draft_orders(info, created, query, sort_by=None):\n    qs = models.Order.objects.drafts()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, None, query)\n\n\ndef resolve_orders_total(_info, period):\n    qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)\n    qs = filter_by_period(qs, period, \"created\")\n    return sum_order_totals(qs)\n\n\ndef resolve_order(info, order_id):\n    return graphene.Node.get_node_from_global_id(info, order_id, Order)\n\n\ndef resolve_homepage_events():\n    # Filter only selected events to be displayed on homepage.\n    types = [\n        OrderEvents.PLACED,\n        OrderEvents.PLACED_FROM_DRAFT,\n        OrderEvents.ORDER_FULLY_PAID,\n    ]\n    return OrderEvent.objects.filter(type__in=types)\n\n\ndef resolve_order_by_token(token):\n    return models.Order.objects.filter(token=token).first()\n", "path": "saleor/graphql/order/resolvers.py"}], "after_files": [{"content": "import graphene\nimport graphene_django_optimizer as gql_optimizer\n\nfrom ...order import OrderStatus, models\nfrom ...order.events import OrderEvents\nfrom ...order.models import OrderEvent\nfrom ...order.utils import sum_order_totals\nfrom ..utils import filter_by_period, filter_by_query_param, sort_queryset\nfrom .enums import OrderStatusFilter\nfrom .sorters import OrderSortField\nfrom .types import Order\n\nORDER_SEARCH_FIELDS = (\"id\", \"discount_name\", \"token\", \"user_email\", \"user__email\")\n\n\ndef filter_orders(qs, info, created, status, query):\n    qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by status\n    if status is not None:\n        if status == OrderStatusFilter.READY_TO_FULFILL:\n            qs = qs.ready_to_fulfill()\n        elif status == OrderStatusFilter.READY_TO_CAPTURE:\n            qs = qs.ready_to_capture()\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by creation date\n    if created is not None:\n        qs = filter_by_period(qs, created, \"created\")\n\n    return gql_optimizer.query(qs, info)\n\n\ndef resolve_orders(info, created, status, query, sort_by=None):\n    qs = models.Order.objects.confirmed()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, status, query)\n\n\ndef resolve_draft_orders(info, created, query, sort_by=None):\n    qs = models.Order.objects.drafts()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, None, query)\n\n\ndef resolve_orders_total(_info, period):\n    qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)\n    qs = filter_by_period(qs, period, \"created\")\n    return sum_order_totals(qs)\n\n\ndef resolve_order(info, order_id):\n    return graphene.Node.get_node_from_global_id(info, order_id, Order)\n\n\ndef resolve_homepage_events():\n    # Filter only selected events to be displayed on homepage.\n    types = [\n        OrderEvents.PLACED,\n        OrderEvents.PLACED_FROM_DRAFT,\n        OrderEvents.ORDER_FULLY_PAID,\n    ]\n    return OrderEvent.objects.filter(type__in=types)\n\n\ndef resolve_order_by_token(token):\n    return (\n        models.Order.objects.exclude(status=OrderStatus.DRAFT)\n        .filter(token=token)\n        .first()\n    )\n", "path": "saleor/graphql/order/resolvers.py"}]}