give / src / DonationForms / Routes / Permissions / DonationFormPermissions.php

DonationFormPermissions.php in GiveWP – Donation Plugin and Fundraising Platform 4.17.0, at src/DonationForms/Routes/Permissions/DonationFormPermissions.php

122 lines 3.2 KB

Raw Download Zip

1	<?php
2
3	namespace Give\DonationForms\Routes\Permissions;
4
5	use Give\DonationForms\ValueObjects\DonationFormStatus;
6	use Give\Framework\Permissions\Facades\UserPermissions;
7	use WP_Error;
8	use WP_REST_Request;
9
10	/**
11	* @since 4.10.1
12	*/
13	class DonationFormPermissions
14	{
15	/**
16	* Check if current user can edit donation forms.
17	*
18	* @since 4.14.0 update permission capability to use facade
19	* @since 4.10.1
20	*/
21	public static function canEdit(): bool
22	{
23	return UserPermissions::donationForms()->canEdit();
24	}
25
26	/**
27	* Check if current user can view private/draft donation forms.
28	*
29	* @since 4.14.0 replace logic with UserPermissions facade
30	* @since 4.10.1
31	*/
32	public static function canViewPrivate(): bool
33	{
34	return UserPermissions::donationForms()->canViewPrivate();
35	}
36
37	/**
38	* @since 4.10.1
39	*/
40	public static function authorizationStatusCode(): int
41	{
42	return is_user_logged_in() ? 403 : 401;
43	}
44
45	/**
46	* Validate donation form access permissions for GET items (collections).
47	*
48	* @since 4.10.1
49	*
50	* @param WP_REST_Request $request
51	*
52	* @return true\|WP_Error
53	*/
54	public static function validationForGetItems(WP_REST_Request $request)
55	{
56	$status = $request->get_param('status');
57
58	// If no status is specified, allow access (defaults to published forms)
59	if (empty($status)) {
60	return true;
61	}
62
63	// Convert single status to array for consistent handling
64	if (!is_array($status)) {
65	$status = [$status];
66	}
67
68	// Check if user is trying to access any non-published forms
69	$hasNonPublishedStatus = !empty(array_filter($status, function($formStatus) {
70	return $formStatus !== DonationFormStatus::PUBLISHED;
71	}));
72
73	if ($hasNonPublishedStatus && !self::canViewPrivate()) {
74	return new WP_Error(
75	'rest_forbidden',
76	__('You do not have permission to view private, draft, or trashed donation forms.', 'give'),
77	['status' => self::authorizationStatusCode()]
78	);
79	}
80
81	return true;
82	}
83
84	/**
85	* Validate donation form access permissions for individual form GET method.
86	*
87	* @since 4.10.1
88	*
89	* @param WP_REST_Request $request
90	*
91	* @return true\|WP_Error
92	*/
93	public static function validationForGetItem(WP_REST_Request $request)
94	{
95	// Individual form access validation is handled in the controller
96	// where we can access the actual form data and its status
97	return true;
98	}
99
100	/**
101	* Validate donation form access permissions for associate forms with campaign.
102	*
103	* @since 4.10.1
104	*
105	* @param WP_REST_Request $request
106	*
107	* @return true\|WP_Error
108	*/
109	public static function validationForAssociateForms(WP_REST_Request $request)
110	{
111	if (!self::canEdit()) {
112	return new WP_Error(
113	'rest_forbidden',
114	__('You do not have permission to associate forms with campaigns.', 'give'),
115	['status' => self::authorizationStatusCode()]
116	);
117	}
118
119	return true;
120	}
121	}
122