process_auth_request causes infinite loop with Woocommerce Memberships plugin when redirecting to checkout

[collette-tamez]

Describe the bug
When using both the Woocommerce Memberships plugin with GraphQL Woocommerce an infinite loop can occur when a user who has not already been authenticated by WordPress clicks on a transfer session link ex: https://wp.local/transfer-session?session_id=xxxxx&_wc_checkout=xxxxxx

To Reproduce
Steps to reproduce the behavior:

1. Have both plugins active
2. User must not be currently logged into WP
3. Retrieve a checkoutUrl from customer field via GraphQL-woocommerce
4. Click on a transfer session link
5. Infinite loop should occur

Expected behavior
Infinite loops should not trigger while process_auth_request is executing

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: MacOs Ventura 13.6.1
• Browser Chrome Version 124.0.6367.62 (Official Build) (arm64)

Smartphone (please complete the following information):

• Device: Iphone SE
• OS: iOS 17

Plugin Versions

• WooGraphQL Version: 0.19.0
• WPGraphQL Version: 1.19.0
• WPGraphQL Pro Version: 1.4.1 …
• WordPress Version: 6.4.3
• WooCommerce Version: 8.2.0
• WooCommerce Memberships Version: 1.25.2

Additional context
Here is a pastebin of the stack trace before xdebug bails
https://pastebin.com/6YcbV9iR

What I've determined is that

1. process_auth_request will call eventually wc_get_endpoint_url
2. wc_get_endpoint_url will eventually trigger the woocommerce_get_query_vars filter
3. This filter will trigger WC_Memberships::add_query_vars()
4. WC_Memberships will eventually make a query which will fire pre_get_posts filter
5. WooGraphQL will fire resolve_request() on the pre_get_posts filter since its priority 1
6. resolve_request() will eventually call process_auth_request and now we're in an infinite loop

Using the Woocommerce Memberships plugin in conjunction with Woocommerce Subscriptions is a pretty common use-case. In my specific enviroment I retrieving the checkoutUrl for use in a headless react app, therefore our users would not be already authenticated with WordPress. The check in process_auth_request (line 343) does not trigger this issue and the request resolves normally.