"Cart has items restricted by user criteria: no thrown error" when trying to order through sn_sc.CartJS orderNow method

[aspeed]

We have an Inbound Email Action for New User Onboarding that reads the content of an email notification from our HR Onboarding system. It has been using sn_sc.CartJS.orderNow all along to submit the order for the single user. While working on development of a new process I discovered that the orderNow method is throwing an exception "Cart has items restricted by user criteria: no thrown error"  Below is a snippet of code from the ordering process within the Inbound Email Action.

var variables = JSON.stringify(newUser);

//create a cart
var cart = new sn_sc.CartJS('cart_fb167863dbe953007151e536ca961935');
var request =
{
'sysparm_id': 'fb167863dbe953007151e536ca961935',
'sysparm_quantity': '1',
'variables': newUser
};

gs.info("request: " + JSON.stringify(request) );

try{
var cartDetails = cart.orderNow(request);
gs.info('cartDetails: ' + JSON.stringify(cartDetails));
}catch(err)
{
gs.error(err.message);
gs.error(err);
}

I have already removed any User Criteria associated with the Catalog item in question.

[Chris Vuocolo]

We are also calling it from an inbound action, and also in the context of email from an unknown sender. In that context, the action runs as an OOTB user called "Guest". Was your expectation that the sender should have been in your User table, or are you intentionally trying to make it work when they are not?

We had a scenario where we thought we wanted the latter. We have observed two changes that impact this. We moved directly from Madrid to Orlando Patch 3, so I cannot say exactly where along that path these changes happened. We have not yet found where they are documented.

First change: In Madrid, when making a call like sn_sc.CartJS().orderNow(orderDetails) from within an inbound email action, the "Available For" list of the catalog item identified within orderDetails is not enforced. As of Orlando Patch 3, it is.

Second change: In Madrid, if a catalog item has no "Available For" list, the User Criteria Diagnostic tool reports that the Guest user can see that item. As of Orlando Patch 3, that tool reports that user cannot see that item.

Taken together, these seem to explain our issue. In Madrid, an anonymous user could order an item via email by default. As of Orlando Patch 3, there has to be a criteria in Available For to explicitly allow that. 

Whether one should allow an anonymous user to order a request item via email is maybe a design question worth considering.