user with no draft order permission can still perform action on draft order's in stocky app (idor)

Summary

@imranhudaa reported that the Shopify Stocky application was missing a permission check to download purchase orders. We implemented the missing check to resolve the issue. This is a limited disclosure at their request.