← All changes | backend/src/Routes/Entry/Entry.php +103 -42 1.1 → 1.5.1 View file →

		@@ -4,17 +4,20 @@
4	4
5	5	use IvyForms\Vendor\DI\Container;
6	6	use IvyForms\Vendor\DI\DependencyException;
7	7	use IvyForms\Vendor\DI\NotFoundException;
8		-use IvyForms\Controllers\Entry\AddEntryController;
9	8	use IvyForms\Controllers\Entry\BulkUpdateEntryController;
10	9	use IvyForms\Controllers\Entry\DeleteEntriesController;
11	10	use IvyForms\Controllers\Entry\DeleteEntryController;
12	11	use IvyForms\Controllers\Entry\GetEntryController;
13	12	use IvyForms\Controllers\Entry\GetEntryCountController;
	13	+use IvyForms\Controllers\Entry\GetEntryFormsController;
14	14	use IvyForms\Controllers\Entry\SearchEntriesController;
15	15	use IvyForms\Controllers\Entry\UpdateEntryStarredController;
16	16	use IvyForms\Controllers\Entry\UpdateEntryStatusController;
	17	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	18	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	19	+use IvyForms\Services\Permissions\RoutePermissionService;
17	20	use WP_REST_Server;
18	21
19	22	class Entry
20	23	{
		@@ -23,9 +26,21 @@
23	26	* @throws NotFoundException
24	27	*/
25	28	public static function registerRoutes(Container $container, string $routeNamespace): void
26	29	{
27		- // TODO - Add IvyForms capability - Admin only for now
	30	+ self::registerEntryReadRoutes($container, $routeNamespace);
	31	+ self::registerEntryWriteRoutes($container, $routeNamespace);
	32	+ }
	33	+
	34	+ /**
	35	+ * @throws DependencyException
	36	+ * @throws NotFoundException
	37	+ */
	38	+ private static function registerEntryReadRoutes(Container $container, string $routeNamespace): void
	39	+ {
	40	+ $routePermissionService = $container->get(RoutePermissionService::class);
	41	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	42	+
28	43	register_rest_route(
29	44	$routeNamespace,
30	45	'/entry/(?P<id>\d+)',
31	46	[
		@@ -30,24 +45,27 @@
30	45	'/entry/(?P<id>\d+)',
31	46	[
32	47	'methods' => WP_REST_Server::READABLE,
33	48	'callback' => $container->get(GetEntryController::class),
34		- 'permission_callback' => function () {
35		- return current_user_can('manage_options');
36		- }
	49	+ 'permission_callback' => self::permissionForEntryForm(
	50	+ $permissionResourceResolver,
	51	+ static function (int $formId) use ($routePermissionService): bool {
	52	+ return $routePermissionService->canViewEntries($formId);
	53	+ }
	54	+ ),
37	55	]
38	56	);
39	57
40	58	register_rest_route(
41	59	$routeNamespace,
42		- '/entry/add/',
	60	+ '/entries/forms',
43	61	[
44		- 'methods' => WP_REST_Server::CREATABLE,
45		- 'callback' => $container->get(AddEntryController::class),
46		- 'permission_callback' => function () {
47		- return current_user_can('manage_options');
48		- }
49		- ]
	62	+ 'methods' => WP_REST_Server::READABLE,
	63	+ 'callback' => $container->get(GetEntryFormsController::class),
	64	+ 'permission_callback' => static function () use ($routePermissionService) {
	65	+ return $routePermissionService->canViewEntries();
	66	+ },
	67	+ ]
50	68	);
51	69
52	70	register_rest_route(
53	71	$routeNamespace,
		@@ -54,25 +72,48 @@
54	72	'/entries/search',
55	73	[
56	74	'methods' => WP_REST_Server::READABLE,
57	75	'callback' => $container->get(SearchEntriesController::class),
58		- 'permission_callback' => function () {
59		- return current_user_can('manage_options');
60		- }
	76	+ 'permission_callback' => static function () use ($routePermissionService) {
	77	+ return $routePermissionService->canViewEntries();
	78	+ },
61	79	]
62	80	);
63	81
64	82	register_rest_route(
65	83	$routeNamespace,
	84	+ '/entries/count',
	85	+ [
	86	+ 'methods' => WP_REST_Server::READABLE,
	87	+ 'callback' => $container->get(GetEntryCountController::class),
	88	+ 'permission_callback' => static function () use ($routePermissionService) {
	89	+ return $routePermissionService->canViewEntries();
	90	+ },
	91	+ ]
	92	+ );
	93	+ }
	94	+
	95	+ /**
	96	+ * @throws DependencyException
	97	+ * @throws NotFoundException
	98	+ */
	99	+ private static function registerEntryWriteRoutes(Container $container, string $routeNamespace): void
	100	+ {
	101	+ $routePermissionService = $container->get(RoutePermissionService::class);
	102	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	103	+
	104	+ register_rest_route(
	105	+ $routeNamespace,
66	106	'/entries/delete',
67	107	[
68	108	'methods' => WP_REST_Server::CREATABLE,
69	109	'callback' => $container->get(DeleteEntriesController::class),
70		- 'permission_callback' => function () {
71		- return current_user_can('manage_options');
72		- }
	110	+ 'permission_callback' => static function () use ($routePermissionService) {
	111	+ return $routePermissionService->canDeleteEntries();
	112	+ },
73	113	]
74	114	);
	115	+
75	116	register_rest_route(
76	117	$routeNamespace,
77	118	'/entry/delete/(?P<id>\d+)',
78	119	[
		@@ -77,11 +118,14 @@
77	118	'/entry/delete/(?P<id>\d+)',
78	119	[
79	120	'methods' => WP_REST_Server::CREATABLE,
80	121	'callback' => $container->get(DeleteEntryController::class),
81		- 'permission_callback' => function () {
82		- return current_user_can('manage_options');
83		- }
	122	+ 'permission_callback' => self::permissionForEntryForm(
	123	+ $permissionResourceResolver,
	124	+ static function (int $formId) use ($routePermissionService): bool {
	125	+ return $routePermissionService->canDeleteEntries($formId);
	126	+ }
	127	+ ),
84	128	]
85	129	);
86	130
87	131	register_rest_route(
		@@ -89,11 +133,14 @@
89	133	'/entry/update/starred/(?P<id>\d+)',
90	134	[
91	135	'methods' => WP_REST_Server::CREATABLE,
92	136	'callback' => $container->get(UpdateEntryStarredController::class),
93		- 'permission_callback' => function () {
94		- return current_user_can('manage_options');
95		- }
	137	+ 'permission_callback' => self::permissionForEntryForm(
	138	+ $permissionResourceResolver,
	139	+ static function (int $formId) use ($routePermissionService): bool {
	140	+ return $routePermissionService->canEditEntries($formId);
	141	+ }
	142	+ ),
96	143	]
97	144	);
98	145
99	146	register_rest_route(
		@@ -101,35 +148,49 @@
101	148	'/entry/update/status/(?P<id>\d+)',
102	149	[
103	150	'methods' => WP_REST_Server::CREATABLE,
104	151	'callback' => $container->get(UpdateEntryStatusController::class),
105		- 'permission_callback' => function () {
106		- return current_user_can('manage_options');
107		- }
	152	+ 'permission_callback' => self::permissionForEntryForm(
	153	+ $permissionResourceResolver,
	154	+ static function (int $formId) use ($routePermissionService): bool {
	155	+ return $routePermissionService->canEditEntries($formId);
	156	+ }
	157	+ ),
108	158	]
109	159	);
110	160
111	161	register_rest_route(
112	162	$routeNamespace,
113		- '/entries/count',
114		- [
115		- 'methods' => WP_REST_Server::READABLE,
116		- 'callback' => $container->get(GetEntryCountController::class),
117		- 'permission_callback' => function () {
118		- return current_user_can('manage_options');
119		- }
120		- ]
121		- );
122		-
123		- register_rest_route(
124		- $routeNamespace,
125	163	'/entries/batch-actions',
126	164	[
127	165	'methods' => WP_REST_Server::CREATABLE,
128	166	'callback' => [$container->get(BulkUpdateEntryController::class), 'handle'],
129		- 'permission_callback' => function () {
130		- return current_user_can('manage_options');
131		- }
	167	+ 'permission_callback' => static function () use ($routePermissionService) {
	168	+ return $routePermissionService->canEditEntries();
	169	+ },
132	170	]
133	171	);
	172	+ }
	173	+
	174	+ /**
	175	+ * @param callable(int): bool $canAccessForm
	176	+ * @return callable
	177	+ */
	178	+ private static function permissionForEntryForm(
	179	+ PermissionResourceResolver $permissionResourceResolver,
	180	+ callable $canAccessForm
	181	+ ): callable {
	182	+ return static function ($request) use ($permissionResourceResolver, $canAccessForm): bool {
	183	+ $entryId = RestRouteParamReader::getPositiveIntParam($request);
	184	+ if ($entryId === null) {
	185	+ return false;
	186	+ }
	187	+
	188	+ $formId = $permissionResourceResolver->formIdFromEntryId($entryId);
	189	+ if ($formId === null) {
	190	+ return false;
	191	+ }
	192	+
	193	+ return $canAccessForm($formId);
	194	+ };
134	195	}
135	196	}