← All changes | backend/src/Routes/Form/Form.php +50 -26 1.1 → 1.5.1 View file →

		@@ -19,8 +19,11 @@
19	19	use IvyForms\Controllers\Form\UpdateFormStatusController;
20	20	use IvyForms\Controllers\Form\ValidateBeforeSubmitController;
21	21	use IvyForms\Controllers\Form\ExportFormController;
22	22	use IvyForms\Controllers\Form\ImportFormController;
	23	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	24	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	25	+use IvyForms\Services\Permissions\RoutePermissionService;
23	26	use WP_REST_Server;
24	27
25	28	class Form
26	29	{
		@@ -43,8 +46,10 @@
43	46	* @throws NotFoundException
44	47	*/
45	48	private static function registerFormCrudRoutes(Container $container, string $routeNamespace): void
46	49	{
	50	+ $routePermissionService = $container->get(RoutePermissionService::class);
	51	+ $adminFormListPermissionService = $container->get(AdminFormListPermissionService::class);
47	52	// Get single form
48	53	register_rest_route(
49	54	$routeNamespace,
50	55	'/form/(?P<id>\d+)',
		@@ -50,10 +55,21 @@
50	55	'/form/(?P<id>\d+)',
51	56	[
52	57	'methods' => WP_REST_Server::READABLE,
53	58	'callback' => $container->get(GetFormController::class),
54		- 'permission_callback' => function () {
55		- return current_user_can('manage_options');
	59	+ 'permission_callback' => static function ($request) use (
	60	+ $adminFormListPermissionService,
	61	+ $routePermissionService
	62	+ ) {
	63	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	64	+ if ($formId === null) {
	65	+ return false;
	66	+ }
	67	+
	68	+ // Entry-only delegates need the form structure to render entry details,
	69	+ // so allow either forms-list access or entries access for this form.
	70	+ return $adminFormListPermissionService->canAccessFormInAdminLists($formId)
	71	+ || $routePermissionService->canViewEntries($formId);
56	72	}
57	73	]
58	74	);
59	75
		@@ -63,10 +79,10 @@
63	79	'/form',
64	80	[
65	81	'methods' => WP_REST_Server::READABLE,
66	82	'callback' => $container->get(GetFormsController::class),
67		- 'permission_callback' => function () {
68		- return current_user_can('manage_options');
	83	+ 'permission_callback' => static function () use ($routePermissionService) {
	84	+ return $routePermissionService->canViewFormsInLists();
69	85	}
70	86	]
71	87	);
72	88
		@@ -76,10 +92,10 @@
76	92	'/form/add/',
77	93	[
78	94	'methods' => WP_REST_Server::CREATABLE,
79	95	'callback' => $container->get(AddFormController::class),
80		- 'permission_callback' => function () {
81		- return current_user_can('manage_options');
	96	+ 'permission_callback' => static function () use ($routePermissionService) {
	97	+ return $routePermissionService->canEditForms();
82	98	}
83	99	]
84	100	);
85	101
		@@ -89,10 +105,11 @@
89	105	'/form/update/(?P<id>\d+)',
90	106	[
91	107	'methods' => WP_REST_Server::CREATABLE,
92	108	'callback' => $container->get(UpdateFormController::class),
93		- 'permission_callback' => function () {
94		- return current_user_can('manage_options');
	109	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	110	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	111	+ return $routePermissionService->canEditForms($formId);
95	112	}
96	113	]
97	114	);
98	115
		@@ -102,10 +119,11 @@
102	119	'/form/delete/(?P<id>\d+)',
103	120	[
104	121	'methods' => WP_REST_Server::CREATABLE,
105	122	'callback' => $container->get(DeleteFormController::class),
106		- 'permission_callback' => function () {
107		- return current_user_can('manage_options');
	123	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	124	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	125	+ return $routePermissionService->canDeleteForms($formId);
108	126	}
109	127	]
110	128	);
111	129
		@@ -115,10 +133,10 @@
115	133	'/forms/delete',
116	134	[
117	135	'methods' => WP_REST_Server::CREATABLE,
118	136	'callback' => $container->get(DeleteFormsController::class),
119		- 'permission_callback' => function () {
120		- return current_user_can('manage_options');
	137	+ 'permission_callback' => static function () use ($routePermissionService) {
	138	+ return $routePermissionService->canDeleteForms();
121	139	}
122	140	]
123	141	);
124	142	}
		@@ -130,8 +148,9 @@
130	148	* @throws NotFoundException
131	149	*/
132	150	private static function registerFormManagementRoutes(Container $container, string $routeNamespace): void
133	151	{
	152	+ $routePermissionService = $container->get(RoutePermissionService::class);
134	153	// Search forms
135	154	register_rest_route(
136	155	$routeNamespace,
137	156	'/forms/search',
		@@ -145,10 +164,10 @@
145	164	'orderBy' => ['type' => 'string'],
146	165	'order' => ['type' => 'string'],
147	166	'shouldGetCount' => ['type' => 'boolean'],
148	167	],
149		- 'permission_callback' => function () {
150		- return current_user_can('manage_options');
	168	+ 'permission_callback' => static function () use ($routePermissionService) {
	169	+ return $routePermissionService->canViewFormsInLists();
151	170	}
152	171	]
153	172	);
154	173
		@@ -158,10 +177,11 @@
158	177	'/form/update/starred/(?P<id>\d+)',
159	178	[
160	179	'methods' => WP_REST_Server::CREATABLE,
161	180	'callback' => $container->get(UpdateFormStarredController::class),
162		- 'permission_callback' => function () {
163		- return current_user_can('manage_options');
	181	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	182	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	183	+ return $routePermissionService->canEditForms($formId);
164	184	}
165	185	]
166	186	);
167	187
		@@ -171,10 +191,11 @@
171	191	'/form/update/status/(?P<id>\d+)',
172	192	[
173	193	'methods' => WP_REST_Server::CREATABLE,
174	194	'callback' => $container->get(UpdateFormStatusController::class),
175		- 'permission_callback' => function () {
176		- return current_user_can('manage_options');
	195	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	196	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	197	+ return $routePermissionService->canEditForms($formId);
177	198	}
178	199	]
179	200	);
180	201
		@@ -184,10 +205,11 @@
184	205	'/form/duplicate/(?P<id>\d+)',
185	206	[
186	207	'methods' => WP_REST_Server::CREATABLE,
187	208	'callback' => $container->get(DuplicateFormController::class),
188		- 'permission_callback' => function () {
189		- return current_user_can('manage_options');
	209	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	210	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	211	+ return $routePermissionService->canEditForms($formId);
190	212	}
191	213	]
192	214	);
193	215
		@@ -197,10 +219,10 @@
197	219	'/forms/batch-actions',
198	220	[
199	221	'methods' => WP_REST_Server::CREATABLE,
200	222	'callback' => [$container->get(BulkUpdateFormController::class), 'handle'],
201		- 'permission_callback' => function () {
202		- return current_user_can('manage_options');
	223	+ 'permission_callback' => static function () use ($routePermissionService) {
	224	+ return $routePermissionService->canEditForms();
203	225	}
204	226	]
205	227	);
206	228	}
		@@ -243,8 +265,10 @@
243	265	* @throws NotFoundException
244	266	*/
245	267	private static function registerFormImportExportRoutes(Container $container, string $routeNamespace): void
246	268	{
	269	+ $routePermissionService = $container->get(RoutePermissionService::class);
	270	+
247	271	// Export forms
248	272	register_rest_route(
249	273	$routeNamespace,
250	274	'/forms/export',
		@@ -250,10 +274,10 @@
250	274	'/forms/export',
251	275	[
252	276	'methods' => WP_REST_Server::CREATABLE,
253	277	'callback' => $container->get(ExportFormController::class),
254		- 'permission_callback' => function () {
255		- return current_user_can('manage_options');
	278	+ 'permission_callback' => static function () use ($routePermissionService) {
	279	+ return $routePermissionService->canExportForms();
256	280	}
257	281	]
258	282	);
259	283
		@@ -263,10 +287,10 @@
263	287	'/forms/import',
264	288	[
265	289	'methods' => WP_REST_Server::CREATABLE,
266	290	'callback' => $container->get(ImportFormController::class),
267		- 'permission_callback' => function () {
268		- return current_user_can('manage_options');
	291	+ 'permission_callback' => static function () use ($routePermissionService) {
	292	+ return $routePermissionService->canEditForms();
269	293	}
270	294	]
271	295	);
272	296	}