← All changes | backend/src/Routes/Entry/Entry.php +110 -41 0.3 → 1.5.1 View file →

		@@ -1,24 +1,23 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Routes\Entry;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10		-use DI\Container;
11		-use DI\DependencyException;
12		-use DI\NotFoundException;
13		-use IvyForms\Controllers\Entry\AddEntryController;
	5	+use IvyForms\Vendor\DI\Container;
	6	+use IvyForms\Vendor\DI\DependencyException;
	7	+use IvyForms\Vendor\DI\NotFoundException;
	8	+use IvyForms\Controllers\Entry\BulkUpdateEntryController;
14	9	use IvyForms\Controllers\Entry\DeleteEntriesController;
15	10	use IvyForms\Controllers\Entry\DeleteEntryController;
16	11	use IvyForms\Controllers\Entry\GetEntryController;
17	12	use IvyForms\Controllers\Entry\GetEntryCountController;
	13	+use IvyForms\Controllers\Entry\GetEntryFormsController;
18	14	use IvyForms\Controllers\Entry\SearchEntriesController;
19	15	use IvyForms\Controllers\Entry\UpdateEntryStarredController;
20	16	use IvyForms\Controllers\Entry\UpdateEntryStatusController;
	17	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	18	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	19	+use IvyForms\Services\Permissions\RoutePermissionService;
21	20	use WP_REST_Server;
22	21
23	22	class Entry
24	23	{
		@@ -27,9 +26,21 @@
27	26	* @throws NotFoundException
28	27	*/
29	28	public static function registerRoutes(Container $container, string $routeNamespace): void
30	29	{
31		- // TODO - Add IvyForms capability - Admin only for now
	30	+ self::registerEntryReadRoutes($container, $routeNamespace);
	31	+ self::registerEntryWriteRoutes($container, $routeNamespace);
	32	+ }
	33	+
	34	+ /**
	35	+ * @throws DependencyException
	36	+ * @throws NotFoundException
	37	+ */
	38	+ private static function registerEntryReadRoutes(Container $container, string $routeNamespace): void
	39	+ {
	40	+ $routePermissionService = $container->get(RoutePermissionService::class);
	41	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	42	+
32	43	register_rest_route(
33	44	$routeNamespace,
34	45	'/entry/(?P<id>\d+)',
35	46	[
		@@ -34,24 +45,27 @@
34	45	'/entry/(?P<id>\d+)',
35	46	[
36	47	'methods' => WP_REST_Server::READABLE,
37	48	'callback' => $container->get(GetEntryController::class),
38		- 'permission_callback' => function () {
39		- return current_user_can('manage_options');
40		- }
	49	+ 'permission_callback' => self::permissionForEntryForm(
	50	+ $permissionResourceResolver,
	51	+ static function (int $formId) use ($routePermissionService): bool {
	52	+ return $routePermissionService->canViewEntries($formId);
	53	+ }
	54	+ ),
41	55	]
42	56	);
43	57
44	58	register_rest_route(
45	59	$routeNamespace,
46		- '/entry/add/',
	60	+ '/entries/forms',
47	61	[
48		- 'methods' => WP_REST_Server::CREATABLE,
49		- 'callback' => $container->get(AddEntryController::class),
50		- 'permission_callback' => function () {
51		- return current_user_can('manage_options');
52		- }
53		- ]
	62	+ 'methods' => WP_REST_Server::READABLE,
	63	+ 'callback' => $container->get(GetEntryFormsController::class),
	64	+ 'permission_callback' => static function () use ($routePermissionService) {
	65	+ return $routePermissionService->canViewEntries();
	66	+ },
	67	+ ]
54	68	);
55	69
56	70	register_rest_route(
57	71	$routeNamespace,
		@@ -58,25 +72,48 @@
58	72	'/entries/search',
59	73	[
60	74	'methods' => WP_REST_Server::READABLE,
61	75	'callback' => $container->get(SearchEntriesController::class),
62		- 'permission_callback' => function () {
63		- return current_user_can('manage_options');
64		- }
	76	+ 'permission_callback' => static function () use ($routePermissionService) {
	77	+ return $routePermissionService->canViewEntries();
	78	+ },
65	79	]
66	80	);
67	81
68	82	register_rest_route(
69	83	$routeNamespace,
	84	+ '/entries/count',
	85	+ [
	86	+ 'methods' => WP_REST_Server::READABLE,
	87	+ 'callback' => $container->get(GetEntryCountController::class),
	88	+ 'permission_callback' => static function () use ($routePermissionService) {
	89	+ return $routePermissionService->canViewEntries();
	90	+ },
	91	+ ]
	92	+ );
	93	+ }
	94	+
	95	+ /**
	96	+ * @throws DependencyException
	97	+ * @throws NotFoundException
	98	+ */
	99	+ private static function registerEntryWriteRoutes(Container $container, string $routeNamespace): void
	100	+ {
	101	+ $routePermissionService = $container->get(RoutePermissionService::class);
	102	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	103	+
	104	+ register_rest_route(
	105	+ $routeNamespace,
70	106	'/entries/delete',
71	107	[
72	108	'methods' => WP_REST_Server::CREATABLE,
73	109	'callback' => $container->get(DeleteEntriesController::class),
74		- 'permission_callback' => function () {
75		- return current_user_can('manage_options');
76		- }
	110	+ 'permission_callback' => static function () use ($routePermissionService) {
	111	+ return $routePermissionService->canDeleteEntries();
	112	+ },
77	113	]
78	114	);
	115	+
79	116	register_rest_route(
80	117	$routeNamespace,
81	118	'/entry/delete/(?P<id>\d+)',
82	119	[
		@@ -81,11 +118,14 @@
81	118	'/entry/delete/(?P<id>\d+)',
82	119	[
83	120	'methods' => WP_REST_Server::CREATABLE,
84	121	'callback' => $container->get(DeleteEntryController::class),
85		- 'permission_callback' => function () {
86		- return current_user_can('manage_options');
87		- }
	122	+ 'permission_callback' => self::permissionForEntryForm(
	123	+ $permissionResourceResolver,
	124	+ static function (int $formId) use ($routePermissionService): bool {
	125	+ return $routePermissionService->canDeleteEntries($formId);
	126	+ }
	127	+ ),
88	128	]
89	129	);
90	130
91	131	register_rest_route(
		@@ -93,11 +133,14 @@
93	133	'/entry/update/starred/(?P<id>\d+)',
94	134	[
95	135	'methods' => WP_REST_Server::CREATABLE,
96	136	'callback' => $container->get(UpdateEntryStarredController::class),
97		- 'permission_callback' => function () {
98		- return current_user_can('manage_options');
99		- }
	137	+ 'permission_callback' => self::permissionForEntryForm(
	138	+ $permissionResourceResolver,
	139	+ static function (int $formId) use ($routePermissionService): bool {
	140	+ return $routePermissionService->canEditEntries($formId);
	141	+ }
	142	+ ),
100	143	]
101	144	);
102	145
103	146	register_rest_route(
		@@ -105,23 +148,49 @@
105	148	'/entry/update/status/(?P<id>\d+)',
106	149	[
107	150	'methods' => WP_REST_Server::CREATABLE,
108	151	'callback' => $container->get(UpdateEntryStatusController::class),
109		- 'permission_callback' => function () {
110		- return current_user_can('manage_options');
111		- }
	152	+ 'permission_callback' => self::permissionForEntryForm(
	153	+ $permissionResourceResolver,
	154	+ static function (int $formId) use ($routePermissionService): bool {
	155	+ return $routePermissionService->canEditEntries($formId);
	156	+ }
	157	+ ),
112	158	]
113	159	);
114	160
115	161	register_rest_route(
116	162	$routeNamespace,
117		- '/entries/count',
	163	+ '/entries/batch-actions',
118	164	[
119		- 'methods' => WP_REST_Server::READABLE,
120		- 'callback' => $container->get(GetEntryCountController::class),
121		- 'permission_callback' => function () {
122		- return current_user_can('manage_options');
123		- }
	165	+ 'methods' => WP_REST_Server::CREATABLE,
	166	+ 'callback' => [$container->get(BulkUpdateEntryController::class), 'handle'],
	167	+ 'permission_callback' => static function () use ($routePermissionService) {
	168	+ return $routePermissionService->canEditEntries();
	169	+ },
124	170	]
125	171	);
	172	+ }
	173	+
	174	+ /**
	175	+ * @param callable(int): bool $canAccessForm
	176	+ * @return callable
	177	+ */
	178	+ private static function permissionForEntryForm(
	179	+ PermissionResourceResolver $permissionResourceResolver,
	180	+ callable $canAccessForm
	181	+ ): callable {
	182	+ return static function ($request) use ($permissionResourceResolver, $canAccessForm): bool {
	183	+ $entryId = RestRouteParamReader::getPositiveIntParam($request);
	184	+ if ($entryId === null) {
	185	+ return false;
	186	+ }
	187	+
	188	+ $formId = $permissionResourceResolver->formIdFromEntryId($entryId);
	189	+ if ($formId === null) {
	190	+ return false;
	191	+ }
	192	+
	193	+ return $canAccessForm($formId);
	194	+ };
126	195	}
127	196	}