give / src / API / REST / V3 / Routes / Campaigns / Permissions / CampaignPermissions.php

CampaignPermissions.php in GiveWP – Donation Plugin and Fundraising Platform 4.16.8.1, at src/API/REST/V3/Routes/Campaigns/Permissions/CampaignPermissions.php

99 lines 2.6 KB

Raw Download Zip

1	<?php
2
3	namespace Give\API\REST\V3\Routes\Campaigns\Permissions;
4
5	use Give\Campaigns\ValueObjects\CampaignStatus;
6	use WP_Error;
7	use WP_REST_Request;
8	use Give\Framework\Permissions\Facades\UserPermissions;
9	/**
10	* @since 4.10.1
11	*/
12	class CampaignPermissions
13	{
14	/**
15	* Check if current user can edit campaigns.
16	*
17	* @since 4.14.0 replace logic with UserPermissions facade
18	* @since 4.10.1
19	*/
20	public static function canEdit(): bool
21	{
22	return UserPermissions::campaigns()->canEdit();
23	}
24
25	/**
26	* Check if current user can view private/draft/archived campaigns.
27	*
28	* @since 4.14.0 replace logic with UserPermissions facade
29	* @since 4.10.1
30	*/
31	public static function canViewPrivate(): bool
32	{
33	return UserPermissions::campaigns()->canViewPrivate();
34	}
35
36	/**
37	* @since 4.10.1
38	*/
39	public static function authorizationStatusCode(): int
40	{
41	return is_user_logged_in() ? 403 : 401;
42	}
43
44	/**
45	* Validate campaign access permissions for GET items (collections).
46	*
47	* @since 4.10.1
48	*
49	* @param WP_REST_Request $request
50	*
51	* @return true\|WP_Error
52	*/
53	public static function validationForGetItems(WP_REST_Request $request)
54	{
55	$status = $request->get_param('status');
56
57	// If no status is specified, allow access (defaults to active campaigns)
58	if (empty($status)) {
59	return true;
60	}
61
62	// Convert single status to array for consistent handling
63	if (!is_array($status)) {
64	$status = [$status];
65	}
66
67	// Check if user is trying to access any non-active campaigns
68	$hasNonActiveStatus = !empty(array_filter($status, function($campaignStatus) {
69	return $campaignStatus !== CampaignStatus::ACTIVE;
70	}));
71
72	if ($hasNonActiveStatus && !self::canViewPrivate()) {
73	return new WP_Error(
74	'rest_forbidden',
75	__('You do not have permission to view private, draft, or archived campaigns.', 'give'),
76	['status' => self::authorizationStatusCode()]
77	);
78	}
79
80	return true;
81	}
82
83	/**
84	* Validate campaign access permissions for individual campaign GET method.
85	*
86	* @since 4.10.1
87	*
88	* @param WP_REST_Request $request
89	*
90	* @return true\|WP_Error
91	*/
92	public static function validationForGetItem(WP_REST_Request $request)
93	{
94	// Individual campaign access validation is handled in the controller
95	// where we can access the actual campaign data and its status
96	return true;
97	}
98	}
99