← All changes | backend/src/Services/Menu/MenuMapper.php +96 -20 0.8.1 → 1.5.1 View file →

		@@ -1,14 +1,12 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Services\Menu;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10	5	use IvyForms\Services\API\IvyFormsAPI;
	6	+use IvyForms\Services\Payment\PaymentsFeature;
	7	+use IvyForms\Services\Permissions\IvyFormsAccess;
	8	+use IvyForms\Services\Permissions\PermissionResolver;
11	9	use IvyForms\Services\Translations\BackendStrings;
12	10
13	11	/**
14	12	* Class Menu
		@@ -14,8 +12,16 @@
14	12	* Class Menu
15	13	*/
16	14	class MenuMapper
17	15	{
	16	+ private ?PermissionResolver $permissionResolver;
	17	+
	18	+ public function __construct(
	19	+ ?PermissionResolver $permissionResolver = null
	20	+ ) {
	21	+ $this->permissionResolver = $permissionResolver;
	22	+ }
	23	+
18	24	/**
19	25	* @return mixed[]
20	26	*/
21	27	public function __invoke(): array
		@@ -25,10 +31,9 @@
25	31	// [
26	32	// 'parentSlug' => 'ivyforms',
27	33	// 'pageTitle' => 'Dashboard',
28	34	// 'menuTitle' => BackendStrings::getDashboardStrings()['dashboard'],
29		-// // TODO - Add IvyForms capability
30		-// 'capability' => 'read',
	35	+// 'capability' => 'manage_options',
31	36	// 'menuSlug' => 'ivyforms-dashboard',
32	37	// ],
33	38	[
34	39	'parentSlug' => 'ivyforms',
		@@ -33,10 +38,10 @@
33	38	[
34	39	'parentSlug' => 'ivyforms',
35	40	'pageTitle' => 'All Forms',
36	41	'menuTitle' => BackendStrings::getCommonStrings()['all_forms'],
37		- // TODO - Add IvyForms capability
38		- 'capability' => 'read',
	42	+ // WP checks this cap on the admin menu row; fine-grained access uses PermissionResolver below.
	43	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
39	44	'menuSlug' => 'ivyforms-forms',
40	45	],
41	46	[
42	47	'parentSlug' => 'ivyforms',
		@@ -41,10 +46,9 @@
41	46	[
42	47	'parentSlug' => 'ivyforms',
43	48	'pageTitle' => 'New form',
44	49	'menuTitle' => BackendStrings::getCommonStrings()['new_form'],
45		- // TODO - Add IvyForms capability
46		- 'capability' => 'read',
	50	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
47	51	'menuSlug' => 'ivyforms-builder',
48	52	],
49	53	[
50	54	'parentSlug' => 'ivyforms',
		@@ -49,19 +53,23 @@
49	53	[
50	54	'parentSlug' => 'ivyforms',
51	55	'pageTitle' => 'Entries',
52	56	'menuTitle' => BackendStrings::getEntriesStrings()['entries'],
53		- // TODO - Add IvyForms capability
54		- 'capability' => 'read',
	57	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
55	58	'menuSlug' => 'ivyforms-entries',
56	59	],
57		-// // TODO Add Settings page
58	60	[
59	61	'parentSlug' => 'ivyforms',
	62	+ 'pageTitle' => 'Payments',
	63	+ 'menuTitle' => BackendStrings::getPaymentStrings()['payments'],
	64	+ 'capability' => 'manage_options',
	65	+ 'menuSlug' => 'ivyforms-payments',
	66	+ ],
	67	+ [
	68	+ 'parentSlug' => 'ivyforms',
60	69	'pageTitle' => 'Settings',
61	70	'menuTitle' => BackendStrings::getCommonStrings()['settings'],
62		- // TODO - Add IvyForms capability
63		- 'capability' => 'read',
	71	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
64	72	'menuSlug' => 'ivyforms-settings',
65	73	],
66	74	[
67	75	'parentSlug' => 'ivyforms',
		@@ -66,14 +74,21 @@
66	74	[
67	75	'parentSlug' => 'ivyforms',
68	76	'pageTitle' => 'Integrations',
69	77	'menuTitle' => BackendStrings::getIntegrationsStrings()['integrations'],
70		- // TODO - Add IvyForms capability
71		- 'capability' => 'read',
	78	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
72	79	'menuSlug' => 'ivyforms-integrations',
73	80	],
74	81	];
75	82
	83	+ // Payments page stays hidden while Stripe and PayPal are turned off
	84	+ if (!PaymentsFeature::isEnabled()) {
	85	+ $menus = array_values(array_filter(
	86	+ $menus,
	87	+ static fn(array $menu): bool => $menu['menuSlug'] !== 'ivyforms-payments'
	88	+ ));
	89	+ }
	90	+
76	91	// Add "Upgrade to PRO" menu only if Pro plugin is not installed/activated
77	92	if (!IvyFormsAPI::isProPluginActive()) {
78	93	$menus[] = [
79	94	'parentSlug' => 'ivyforms',
		@@ -79,9 +94,9 @@
79	94	'parentSlug' => 'ivyforms',
80	95	'pageTitle' => 'Upgrade to PRO',
81	96	// phpcs:ignore Generic.Files.LineLength.TooLong
82	97	'menuTitle' => '<span class="ivyforms-upgrade-to-pro">' . __('Upgrade to PRO', 'ivyforms') . '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 14 14" fill="none"><path d="M3.30739 5.78346L5.09363 3.36669C6.24826 1.80449 6.82558 1.02339 7.3642 1.18846C7.90283 1.35352 7.90283 2.31153 7.90283 4.22757V4.40823C7.90283 5.0993 7.90283 5.44483 8.12364 5.66157L8.13533 5.6728C8.36091 5.88496 8.72054 5.88496 9.4398 5.88496C10.7341 5.88496 11.3813 5.88496 11.6 6.27751C11.6037 6.28401 11.6072 6.29056 11.6106 6.29716C11.8171 6.69579 11.4424 7.20277 10.6929 8.21673L8.90667 10.6335C7.75202 12.1957 7.1747 12.9768 6.63607 12.8117C6.09744 12.6466 6.09746 11.6886 6.09748 9.77256L6.09749 9.59198C6.0975 8.9009 6.0975 8.55536 5.87669 8.33861L5.865 8.32739C5.63942 8.11522 5.27979 8.11522 4.56052 8.11522C3.26618 8.11522 2.61901 8.11522 2.40029 7.72267C2.39666 7.71617 2.39314 7.70962 2.38973 7.70302C2.18325 7.3044 2.55796 6.79742 3.30739 5.78346Z" fill="white"/></svg></span>',
83		- 'capability' => 'read',
	98	+ 'capability' => IvyFormsAccess::CAP_ACCESS_PLUGIN,
84	99	// phpcs:ignore Generic.Files.LineLength.TooLong
85	100	'menuSlug' => 'https://ivyforms.com/pricing?utm_source=ivy-lite&utm_medium=lite-upgrade&utm_content=ivy&utm_campaign=ivy',
86	101	'isExternal' => true,
87	102	];
		@@ -86,7 +101,68 @@
86	101	'isExternal' => true,
87	102	];
88	103	}
89	104
90		- return $menus;
	105	+ $visibleMenus = [];
	106	+ foreach ($menus as $menu) {
	107	+ if (!$this->canAccessMenu($menu)) {
	108	+ continue;
	109	+ }
	110	+ $visibleMenus[] = $menu;
	111	+ }
	112	+
	113	+ return $visibleMenus;
	114	+ }
	115	+
	116	+ /**
	117	+ * @param mixed[] $menu
	118	+ */
	119	+ private function canAccessMenu(array $menu): bool
	120	+ {
	121	+ if (IvyFormsAccess::hasImplicitElevatedAccess()) {
	122	+ return true;
	123	+ }
	124	+
	125	+ $resolver = $this->permissionResolver;
	126	+ $user = wp_get_current_user();
	127	+ if (!$resolver || !$user instanceof \WP_User || (int) $user->ID <= 0) {
	128	+ return false;
	129	+ }
	130	+
	131	+ $slug = (string) ($menu['menuSlug'] ?? '');
	132	+ if ($slug === '' || strpos($slug, 'http') === 0) {
	133	+ return true;
	134	+ }
	135	+
	136	+ return $this->canAccessBySlug($slug, $resolver, $user);
	137	+ }
	138	+
	139	+ /**
	140	+ * @param list<string> $permissionKeys
	141	+ */
	142	+ private function userCanAnyOf(PermissionResolver $resolver, \WP_User $user, array $permissionKeys): bool
	143	+ {
	144	+ return $resolver->userCanAnyOf($user, $permissionKeys);
	145	+ }
	146	+
	147	+ private function canAccessBySlug(string $slug, PermissionResolver $resolver, \WP_User $user): bool
	148	+ {
	149	+ if ($slug === 'ivyforms-forms') {
	150	+ return $this->userCanAnyOf($resolver, $user, [
	151	+ 'view_forms_list',
	152	+ 'add_edit_forms',
	153	+ 'delete_forms',
	154	+ ]);
	155	+ }
	156	+ if ($slug === 'ivyforms-builder') {
	157	+ return $resolver->userCanIncludingFormScoped('add_edit_forms', $user, null);
	158	+ }
	159	+ if ($slug === 'ivyforms-entries') {
	160	+ return $this->userCanAnyOf($resolver, $user, ['view_entries_admin', 'delete_entries_admin']);
	161	+ }
	162	+ if (in_array($slug, ['ivyforms-settings', 'ivyforms-integrations'], true)) {
	163	+ return $resolver->userCanIncludingFormScoped('access_settings_page', $user, null);
	164	+ }
	165	+
	166	+ return true;
91	167	}
92	168	}