← All changes | app/Http/Controllers/FrontendControllers/CustomerController.php +56 -9 1.3.27 → 1.6.5 View file →

		@@ -10,8 +10,9 @@
10	10	use FluentCart\App\Http\Controllers\Controller;
11	11	use FluentCart\App\Http\Requests\CustomerRequest;
12	12	use FluentCart\App\Http\Requests\FrontendRequests\CustomerAddressRequest;
13	13	use FluentCart\App\Models\CustomerAddresses;
	14	+use FluentCart\App\Services\CustomerIdentity\EmailVerificationService;
14	15	use FluentCart\App\Services\Localization\LocalizationManager;
15	16	use FluentCart\App\Services\Renderer\AddressSelectRenderer;
16	17	use FluentCart\App\Services\Renderer\CheckoutFieldsSchema;
17	18	use FluentCart\Framework\Http\Request\Request;
		@@ -60,9 +61,24 @@
60	61	return $this->sendError([
61	62	'message' => __('You are not authorized to view this customer', 'fluent-cart')
62	63	]);
63	64	}
64		- return CustomerResource::find($customerId, ['with' => $request->get('with', [])]);
	65	+ // The customer never chooses its own eager loads. Forwarding the request's
	66	+ // `with` here let a logged-in customer walk relations off their own record
	67	+ // — `wpUser` for the WordPress user row, or `orders`/`subscriptions` for
	68	+ // gateway identifiers the account pages never show. The ownership check
	69	+ // above limits it to their own data, which is not the same as safe.
	70	+ //
	71	+ // These four are the customer's own addresses, which is what a profile
	72	+ // detail view is for. Anything wider belongs to the admin endpoint.
	73	+ return CustomerResource::find($customerId, [
	74	+ 'with' => [
	75	+ 'billing_address',
	76	+ 'shipping_address',
	77	+ 'primary_billing_address',
	78	+ 'primary_shipping_address',
	79	+ ],
	80	+ ]);
65	81	}
66	82
67	83	public function getAddress(Request $request, $customerId)
68	84	{
		@@ -73,25 +89,38 @@
73	89	}
74	90
75	91	public function updateAddressSelect(Request $request, $customerAddressId)
76	92	{
77		- $address = CustomerAddressResource::find($customerAddressId, ['with' => $request->get('with', [])]);
	93	+ if (is_user_logged_in() && EmailVerificationService::isRequired(get_current_user_id())) {
	94	+ return $this->sendError([
	95	+ 'message' => __('Please verify your email before using saved addresses.', 'fluent-cart')
	96	+ ], 403);
	97	+ }
78	98
79		- if (!$address) {
	99	+ // The imported CustomerResource is the FrontendResource variant, which has
	100	+ // no getCurrentCustomer — calling it there hits BaseResourceApi::__callStatic
	101	+ // and 500s for every caller. The current-customer resolver lives on the
	102	+ // core resource, same as getDetails/createAddress above.
	103	+ $customer = \FluentCart\Api\Resource\CustomerResource::getCurrentCustomer();
	104	+ if (!$customer) {
80	105	return $this->sendError([
81	106	'message' => __('Address not found', 'fluent-cart')
82	107	]);
83	108	}
84	109
85		- // Verify address belongs to current customer before any cart mutation
86		- $customerId = Arr::get($address, 'address.customer_id');
87		- $customer = \FluentCart\Api\Resource\CustomerResource::getCurrentCustomer();
88		- if (empty($customer) || $customer->id != $customerId) {
	110	+ $addressModel = CustomerAddresses::query()
	111	+ ->where('id', $customerAddressId)
	112	+ ->where('customer_id', $customer->id)
	113	+ ->first();
	114	+
	115	+ if (!$addressModel) {
89	116	return $this->sendError([
90		- 'message' => __('You are not authorized to view this address', 'fluent-cart')
	117	+ 'message' => __('Address not found', 'fluent-cart')
91	118	]);
92	119	}
93	120
	121	+ $address = ['address' => $addressModel];
	122	+
94	123	//update address into cart
95	124	$addressId = Arr::get($address, 'address.id');
96	125	$country = Arr::get($address, 'address.country');
97	126	$state = Arr::get($address, 'address.state');
		@@ -153,8 +182,14 @@
153	182
154	183
155	184	public function createAddress(Request $request) //CustomerAddressRequest
156	185	{
	186	+ if (is_user_logged_in() && EmailVerificationService::isRequired(get_current_user_id())) {
	187	+ return $this->sendError([
	188	+ 'message' => __('Please verify your email before using saved addresses.', 'fluent-cart')
	189	+ ], 403);
	190	+ }
	191	+
157	192	$customer = \FluentCart\Api\Resource\CustomerResource::getCurrentCustomer();
158	193
159	194	if (empty($customer)) {
160	195	return $this->sendError([
		@@ -264,9 +299,9 @@
264	299	// Address creation validates against its own type's rules only — no shipping merge
265	300	$validations = array_filter(CheckoutFieldsSchema::getCheckoutFieldsRequirements($type, $fulfillmentType, false));
266	301
267	302	// Name fields are validated via basic_info, not address sections
268		- unset($validations['full_name'], $validations['first_name'], $validations['last_name'], $validations['company_name']);
	303	+ unset($validations['full_name'], $validations['first_name'], $validations['last_name']);
269	304
270	305	$address = [];
271	306	foreach ($validations as $key => $validation) {
272	307	$address[$key] = Arr::get($data, $type . '_' . $key, '');
		@@ -472,8 +507,20 @@
472	507	}
473	508	}
474	509
475	510	$address['type'] = Arr::get($data, 'type');
	511	+
	512	+ if (empty($address['name'])) {
	513	+ if (!empty($address['full_name'])) {
	514	+ $address['name'] = $address['full_name'];
	515	+ } else {
	516	+ $firstName = trim(Arr::get($address, 'first_name', ''));
	517	+ $lastName = trim(Arr::get($address, 'last_name', ''));
	518	+ if ($firstName || $lastName) {
	519	+ $address['name'] = trim($firstName . ' ' . $lastName);
	520	+ }
	521	+ }
	522	+ }
476	523
477	524	return $address;
478	525	}
479	526