| 1 |
<?php |
| 2 |
|
| 3 |
/** |
| 4 |
* @copyright © Melograno Venture Studio. All rights reserved. |
| 5 |
* @licence See COPYING.md for license details. |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace IvyForms\Controllers\Entry; |
| 9 |
|
| 10 |
use IvyForms\Common\Exceptions\ForbiddenException; |
| 11 |
use IvyForms\Common\Sanitizer\Sanitizer; |
| 12 |
use IvyForms\Controllers\Controller; |
| 13 |
use IvyForms\Services\Form\FormService; |
| 14 |
use IvyForms\Services\Permissions\AdminFormListPermissionService; |
| 15 |
use IvyForms\Services\Permissions\IvyFormsAccess; |
| 16 |
use WP_REST_Request; |
| 17 |
use WP_REST_Response; |
| 18 |
|
| 19 |
/** |
| 20 |
* Returns the forms the current user may view entries for, used to populate the |
| 21 |
* entries-page form filter. Scoped strictly to entries permissions so it does not |
| 22 |
* leak the full All Forms list to entry-only delegates. |
| 23 |
* |
| 24 |
* @package IvyForms\Controllers\Entry |
| 25 |
*/ |
| 26 |
class GetEntryFormsController extends Controller |
| 27 |
{ |
| 28 |
private FormService $formService; |
| 29 |
|
| 30 |
private AdminFormListPermissionService $adminFormListPermissionService; |
| 31 |
|
| 32 |
public function __construct( |
| 33 |
FormService $formService, |
| 34 |
AdminFormListPermissionService $adminFormListPermissionService |
| 35 |
) { |
| 36 |
$this->formService = $formService; |
| 37 |
$this->adminFormListPermissionService = $adminFormListPermissionService; |
| 38 |
} |
| 39 |
|
| 40 |
/** |
| 41 |
* @param WP_REST_Request $data |
| 42 |
* |
| 43 |
* @return WP_REST_Response |
| 44 |
* @throws ForbiddenException |
| 45 |
*/ |
| 46 |
public function handle(WP_REST_Request $data): WP_REST_Response |
| 47 |
{ |
| 48 |
Sanitizer::verifyNonce($data->get_header('X-WP-Nonce')); |
| 49 |
|
| 50 |
$allForms = $this->formService->getAllForms() ?? []; |
| 51 |
|
| 52 |
$forms = []; |
| 53 |
if (IvyFormsAccess::hasImplicitElevatedAccess()) { |
| 54 |
foreach ($allForms as $form) { |
| 55 |
$forms[] = ['id' => (int) $form->getId(), 'name' => (string) $form->getName()]; |
| 56 |
} |
| 57 |
|
| 58 |
return $this->buildResponse($forms); |
| 59 |
} |
| 60 |
|
| 61 |
$allFormIds = array_map(static fn($form) => (int) $form->getId(), $allForms); |
| 62 |
$visibleIds = array_flip($this->adminFormListPermissionService->filterFormIdsVisibleInEntryLists($allFormIds)); |
| 63 |
|
| 64 |
foreach ($allForms as $form) { |
| 65 |
if (!isset($visibleIds[(int) $form->getId()])) { |
| 66 |
continue; |
| 67 |
} |
| 68 |
$forms[] = ['id' => (int) $form->getId(), 'name' => (string) $form->getName()]; |
| 69 |
} |
| 70 |
|
| 71 |
return $this->buildResponse($forms); |
| 72 |
} |
| 73 |
|
| 74 |
/** |
| 75 |
* @param list<array{id:int,name:string}> $forms |
| 76 |
*/ |
| 77 |
private function buildResponse(array $forms): WP_REST_Response |
| 78 |
{ |
| 79 |
return new WP_REST_Response(['forms' => $forms], 200); |
| 80 |
} |
| 81 |
} |
| 82 |
|
