give / src / API / REST / V3 / Routes / Donors / Permissions / DonorPermissions.php

DonorPermissions.php in GiveWP – Donation Plugin and Fundraising Platform 4.17.0, at src/API/REST/V3/Routes/Donors/Permissions/DonorPermissions.php

127 lines 3.3 KB

Raw Download Zip

1	<?php
2
3	namespace Give\API\REST\V3\Routes\Donors\Permissions;
4
5	use Give\API\REST\V3\Routes\Donors\ValueObjects\DonorAnonymousMode;
6	use Give\Donors\Models\Donor;
7	use Give\Framework\Permissions\Facades\UserPermissions;
8	use WP_Error;
9	use WP_REST_Request;
10
11	/**
12	* @since 4.14.0
13	*/
14	class DonorPermissions
15	{
16	/**
17	* Check if current user can edit donors.
18	*
19	* @since 4.14.0
20	*/
21	public static function canEdit(): bool
22	{
23	return UserPermissions::donors()->canEdit();
24	}
25
26
27	/**
28	* Check if current user can view donors.
29	*
30	* @since 4.14.0
31	*/
32	public static function canView(): bool
33	{
34	return UserPermissions::donors()->canView();
35	}
36
37	/**
38	* Check if current user owns the donor (is the donor themselves).
39	*
40	* @since 4.14.0
41	*
42	* @since 4.14.0
43	*/
44	public static function isOwner(int $donorId): bool
45	{
46	if (!is_user_logged_in()) {
47	return false;
48	}
49
50	$donor = Donor::find($donorId);
51	if (!$donor \|\| !$donor->userId) {
52	return false;
53	}
54
55	return (int)$donor->userId === get_current_user_id();
56	}
57
58	/**
59	* @since 4.14.0
60	*/
61	public static function authorizationStatusCode(): int
62	{
63	return is_user_logged_in() ? 403 : 401;
64	}
65
66	/**
67	* @since 4.14.0
68	*
69	* @param WP_REST_Request $request
70	*
71	* @return true\|WP_Error
72	*/
73	public static function validationForGetMethods(WP_REST_Request $request)
74	{
75	$isAdmin = self::canView();
76	$donorId = $request->get_param('id');
77	$isOwner = $donorId ? self::isOwner($donorId) : false;
78
79	$includeSensitiveData = $request->get_param('includeSensitiveData');
80	if (!$isAdmin && !$isOwner && $includeSensitiveData) {
81	return new WP_Error(
82	'rest_forbidden',
83	__('You do not have permission to include sensitive data.', 'give'),
84	['status' => self::authorizationStatusCode()]
85	);
86	}
87
88	if ($request->get_param('anonymousDonors') !== null) {
89	$donorAnonymousMode = new DonorAnonymousMode($request->get_param('anonymousDonors'));
90	if (!$isAdmin && !$isOwner && $donorAnonymousMode->isIncluded()) {
91	return new WP_Error(
92	'rest_forbidden',
93	__('You do not have permission to include anonymous donors.', 'give'),
94	['status' => self::authorizationStatusCode()]
95	);
96	}
97	}
98
99	return true;
100	}
101
102	/**
103	* @since 4.14.0 Allow donors to update their own data
104	*
105	* @param WP_REST_Request $request
106	*
107	* @return true\|WP_Error
108	*/
109	public static function validationForUpdateMethod(WP_REST_Request $request)
110	{
111	$isAdmin = self::canEdit();
112	$donorId = $request->get_param('id');
113	$isOwner = $donorId ? self::isOwner($donorId) : false;
114
115	// Allow access if user is admin or owns the donor
116	if (!$isAdmin && !$isOwner) {
117	return new WP_Error(
118	'rest_forbidden',
119	__('You do not have permission to update this donor.', 'give'),
120	['status' => self::authorizationStatusCode()]
121	);
122	}
123
124	return true;
125	}
126	}
127