We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Customer shouldn't be able to query draft order. 
Customer shouldn't be able to query draft order, by id and by token. 

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `saleor/graphql/order/resolvers.py`
Content:
```
1 import graphene
2 import graphene_django_optimizer as gql_optimizer
3 
4 from ...order import OrderStatus, models
5 from ...order.events import OrderEvents
6 from ...order.models import OrderEvent
7 from ...order.utils import sum_order_totals
8 from ..utils import filter_by_period, filter_by_query_param, sort_queryset
9 from .enums import OrderStatusFilter
10 from .sorters import OrderSortField
11 from .types import Order
12 
13 ORDER_SEARCH_FIELDS = ("id", "discount_name", "token", "user_email", "user__email")
14 
15 
16 def filter_orders(qs, info, created, status, query):
17     qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)
18 
19     # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.
20     # filter orders by status
21     if status is not None:
22         if status == OrderStatusFilter.READY_TO_FULFILL:
23             qs = qs.ready_to_fulfill()
24         elif status == OrderStatusFilter.READY_TO_CAPTURE:
25             qs = qs.ready_to_capture()
26 
27     # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.
28     # filter orders by creation date
29     if created is not None:
30         qs = filter_by_period(qs, created, "created")
31 
32     return gql_optimizer.query(qs, info)
33 
34 
35 def resolve_orders(info, created, status, query, sort_by=None):
36     qs = models.Order.objects.confirmed()
37     qs = sort_queryset(qs, sort_by, OrderSortField)
38     return filter_orders(qs, info, created, status, query)
39 
40 
41 def resolve_draft_orders(info, created, query, sort_by=None):
42     qs = models.Order.objects.drafts()
43     qs = sort_queryset(qs, sort_by, OrderSortField)
44     return filter_orders(qs, info, created, None, query)
45 
46 
47 def resolve_orders_total(_info, period):
48     qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)
49     qs = filter_by_period(qs, period, "created")
50     return sum_order_totals(qs)
51 
52 
53 def resolve_order(info, order_id):
54     return graphene.Node.get_node_from_global_id(info, order_id, Order)
55 
56 
57 def resolve_homepage_events():
58     # Filter only selected events to be displayed on homepage.
59     types = [
60         OrderEvents.PLACED,
61         OrderEvents.PLACED_FROM_DRAFT,
62         OrderEvents.ORDER_FULLY_PAID,
63     ]
64     return OrderEvent.objects.filter(type__in=types)
65 
66 
67 def resolve_order_by_token(token):
68     return models.Order.objects.filter(token=token).first()
69
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/saleor/graphql/order/resolvers.py b/saleor/graphql/order/resolvers.py
--- a/saleor/graphql/order/resolvers.py
+++ b/saleor/graphql/order/resolvers.py
@@ -65,4 +65,8 @@
 
 
 def resolve_order_by_token(token):
-    return models.Order.objects.filter(token=token).first()
+    return (
+        models.Order.objects.exclude(status=OrderStatus.DRAFT)
+        .filter(token=token)
+        .first()
+    )

{"golden_diff": "diff --git a/saleor/graphql/order/resolvers.py b/saleor/graphql/order/resolvers.py\n--- a/saleor/graphql/order/resolvers.py\n+++ b/saleor/graphql/order/resolvers.py\n@@ -65,4 +65,8 @@\n \n \n def resolve_order_by_token(token):\n-    return models.Order.objects.filter(token=token).first()\n+    return (\n+        models.Order.objects.exclude(status=OrderStatus.DRAFT)\n+        .filter(token=token)\n+        .first()\n+    )\n", "issue": "Customer shouldn't be able to query draft order. \nCustomer shouldn't be able to query draft order, by id and by token. \n", "before_files": [{"content": "import graphene\nimport graphene_django_optimizer as gql_optimizer\n\nfrom ...order import OrderStatus, models\nfrom ...order.events import OrderEvents\nfrom ...order.models import OrderEvent\nfrom ...order.utils import sum_order_totals\nfrom ..utils import filter_by_period, filter_by_query_param, sort_queryset\nfrom .enums import OrderStatusFilter\nfrom .sorters import OrderSortField\nfrom .types import Order\n\nORDER_SEARCH_FIELDS = (\"id\", \"discount_name\", \"token\", \"user_email\", \"user__email\")\n\n\ndef filter_orders(qs, info, created, status, query):\n    qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by status\n    if status is not None:\n        if status == OrderStatusFilter.READY_TO_FULFILL:\n            qs = qs.ready_to_fulfill()\n        elif status == OrderStatusFilter.READY_TO_CAPTURE:\n            qs = qs.ready_to_capture()\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by creation date\n    if created is not None:\n        qs = filter_by_period(qs, created, \"created\")\n\n    return gql_optimizer.query(qs, info)\n\n\ndef resolve_orders(info, created, status, query, sort_by=None):\n    qs = models.Order.objects.confirmed()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, status, query)\n\n\ndef resolve_draft_orders(info, created, query, sort_by=None):\n    qs = models.Order.objects.drafts()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, None, query)\n\n\ndef resolve_orders_total(_info, period):\n    qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)\n    qs = filter_by_period(qs, period, \"created\")\n    return sum_order_totals(qs)\n\n\ndef resolve_order(info, order_id):\n    return graphene.Node.get_node_from_global_id(info, order_id, Order)\n\n\ndef resolve_homepage_events():\n    # Filter only selected events to be displayed on homepage.\n    types = [\n        OrderEvents.PLACED,\n        OrderEvents.PLACED_FROM_DRAFT,\n        OrderEvents.ORDER_FULLY_PAID,\n    ]\n    return OrderEvent.objects.filter(type__in=types)\n\n\ndef resolve_order_by_token(token):\n    return models.Order.objects.filter(token=token).first()\n", "path": "saleor/graphql/order/resolvers.py"}], "after_files": [{"content": "import graphene\nimport graphene_django_optimizer as gql_optimizer\n\nfrom ...order import OrderStatus, models\nfrom ...order.events import OrderEvents\nfrom ...order.models import OrderEvent\nfrom ...order.utils import sum_order_totals\nfrom ..utils import filter_by_period, filter_by_query_param, sort_queryset\nfrom .enums import OrderStatusFilter\nfrom .sorters import OrderSortField\nfrom .types import Order\n\nORDER_SEARCH_FIELDS = (\"id\", \"discount_name\", \"token\", \"user_email\", \"user__email\")\n\n\ndef filter_orders(qs, info, created, status, query):\n    qs = filter_by_query_param(qs, query, ORDER_SEARCH_FIELDS)\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by status\n    if status is not None:\n        if status == OrderStatusFilter.READY_TO_FULFILL:\n            qs = qs.ready_to_fulfill()\n        elif status == OrderStatusFilter.READY_TO_CAPTURE:\n            qs = qs.ready_to_capture()\n\n    # DEPRECATED: Will be removed in Saleor 2.11, use the `filter` field instead.\n    # filter orders by creation date\n    if created is not None:\n        qs = filter_by_period(qs, created, \"created\")\n\n    return gql_optimizer.query(qs, info)\n\n\ndef resolve_orders(info, created, status, query, sort_by=None):\n    qs = models.Order.objects.confirmed()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, status, query)\n\n\ndef resolve_draft_orders(info, created, query, sort_by=None):\n    qs = models.Order.objects.drafts()\n    qs = sort_queryset(qs, sort_by, OrderSortField)\n    return filter_orders(qs, info, created, None, query)\n\n\ndef resolve_orders_total(_info, period):\n    qs = models.Order.objects.confirmed().exclude(status=OrderStatus.CANCELED)\n    qs = filter_by_period(qs, period, \"created\")\n    return sum_order_totals(qs)\n\n\ndef resolve_order(info, order_id):\n    return graphene.Node.get_node_from_global_id(info, order_id, Order)\n\n\ndef resolve_homepage_events():\n    # Filter only selected events to be displayed on homepage.\n    types = [\n        OrderEvents.PLACED,\n        OrderEvents.PLACED_FROM_DRAFT,\n        OrderEvents.ORDER_FULLY_PAID,\n    ]\n    return OrderEvent.objects.filter(type__in=types)\n\n\ndef resolve_order_by_token(token):\n    return (\n        models.Order.objects.exclude(status=OrderStatus.DRAFT)\n        .filter(token=token)\n        .first()\n    )\n", "path": "saleor/graphql/order/resolvers.py"}]}