ivyforms / backend / src / Services / Permissions / RoutePermissionService.php

RoutePermissionService.php in The Innovative Form Builder – IvyForms 1.5, at backend/src/Services/Permissions/RoutePermissionService.php

149 lines 4.1 KB

Raw Download Zip

1	<?php
2
3	/**
4	* @copyright © Melograno Venture Studio. All rights reserved.
5	*/
6
7	namespace IvyForms\Services\Permissions;
8
9	// phpcs:disable PSR1.Files.SideEffects
10	if (!defined('ABSPATH')) {
11	exit;
12	}
13
14	use WP_User;
15
16	/**
17	* Bridges stored IvyForms access rules to REST route permission callbacks.
18	*
19	* Fallback behavior:
20	* - Multisite: super admins are always allowed.
21	* - Single site: users with manage_options are always allowed.
22	* - Anyone with IvyForms capabilities (including ivyforms_manage_all) is evaluated via PermissionResolver.
23	* - When no rules are configured and the user has no IvyForms caps, non-elevated users are denied.
24	*/
25	class RoutePermissionService
26	{
27	private PermissionResolver $permissionResolver;
28
29	public function __construct(PermissionResolver $permissionResolver)
30	{
31	$this->permissionResolver = $permissionResolver;
32	}
33
34	public function canViewForms(?int $formId = null): bool
35	{
36	if (IvyFormsAccess::hasImplicitElevatedAccess()) {
37	return true;
38	}
39	$user = $this->getCurrentUser();
40	if (!$user) {
41	return false;
42	}
43
44	$keys = ['view_forms_list', 'add_edit_forms', 'delete_forms'];
45	if ($formId !== null) {
46	return $this->userCanAnyOfKeys($user, $keys, $formId);
47	}
48
49	return $this->permissionResolver->userCanAnyOf($user, $keys);
50	}
51
52	/**
53	* Gate for the All Forms list/search.
54	*
55	* Strictly forms permissions: entry-only delegates do not get the All Forms list. The
56	* entries page reads its form filter from the entries-scoped endpoint instead, so it no
57	* longer depends on this gate.
58	*/
59	public function canViewFormsInLists(?int $formId = null): bool
60	{
61	return $this->canViewForms($formId);
62	}
63
64	public function canExportForms(?int $formId = null): bool
65	{
66	return $this->checkPermission('view_forms_list', $formId);
67	}
68
69	public function canEditForms(?int $formId = null): bool
70	{
71	return $this->checkPermission('add_edit_forms', $formId);
72	}
73
74	public function canDeleteForms(?int $formId = null): bool
75	{
76	return $this->checkPermission('delete_forms', $formId);
77	}
78
79	public function canViewEntries(?int $formId = null): bool
80	{
81	if (IvyFormsAccess::hasImplicitElevatedAccess()) {
82	return true;
83	}
84	$user = $this->getCurrentUser();
85	if (!$user) {
86	return false;
87	}
88
89	$keys = ['view_entries_admin', 'delete_entries_admin'];
90	if ($formId !== null) {
91	return $this->userCanAnyOfKeys($user, $keys, $formId);
92	}
93
94	return $this->permissionResolver->userCanAnyOf($user, $keys);
95	}
96
97	public function canEditEntries(?int $formId = null): bool
98	{
99	return $this->checkPermission('view_entries_admin', $formId);
100	}
101
102	public function canDeleteEntries(?int $formId = null): bool
103	{
104	return $this->checkPermission('delete_entries_admin', $formId);
105	}
106
107	public function canAccessSettings(?int $formId = null): bool
108	{
109	return $this->checkPermission('access_settings_page', $formId);
110	}
111
112	private function checkPermission(string $permissionKey, ?int $formId = null): bool
113	{
114	if (IvyFormsAccess::hasImplicitElevatedAccess()) {
115	return true;
116	}
117	$user = $this->getCurrentUser();
118	if (!$user) {
119	return false;
120	}
121
122	return $this->permissionResolver->userCanIncludingFormScoped($permissionKey, $user, $formId);
123	}
124
125	private function getCurrentUser(): ?WP_User
126	{
127	$user = wp_get_current_user();
128	if (!$user instanceof WP_User \|\| (int) $user->ID <= 0) {
129	return null;
130	}
131
132	return $user;
133	}
134
135	/**
136	* @param list<string> $permissionKeys
137	*/
138	private function userCanAnyOfKeys(WP_User $user, array $permissionKeys, int $formId): bool
139	{
140	foreach ($permissionKeys as $permissionKey) {
141	if ($this->permissionResolver->userCan($permissionKey, $user, $formId)) {
142	return true;
143	}
144	}
145
146	return false;
147	}
148	}
149