← All changes
|
backend/src/Controllers/Notification/DeleteNotificationsController.php
+26
-12
0.2
→
1.5
View file →
| @@ -1,18 +1,16 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace IvyForms\Controllers\Notification; |
| 4 | 4 | |
| 5 | -// phpcs:disable PSR1.Files.SideEffects | |
| 6 | -if (!defined('ABSPATH')) { | |
| 7 | - exit; // Exit if accessed directly | |
| 8 | -} | |
| 9 | - | |
| 10 | 5 | use IvyForms\Common\Exceptions\ForbiddenException; |
| 11 | 6 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 12 | 7 | use IvyForms\Controllers\Controller; |
| 13 | 8 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 14 | 9 | use IvyForms\Services\Notification\NotificationService; |
| 10 | +use IvyForms\Services\Permissions\PermissionResourceResolver; | |
| 11 | +use IvyForms\Services\Permissions\RoutePermissionService; | |
| 12 | +use IvyForms\Services\Translations\BackendStrings; | |
| 15 | 13 | use WP_REST_Request; |
| 16 | 14 | use WP_REST_Response; |
| 17 | 15 | |
| 18 | 16 | /** |
| @@ -23,11 +21,20 @@ | ||
| 23 | 21 | class DeleteNotificationsController extends Controller |
| 24 | 22 | { |
| 25 | 23 | private NotificationService $notificationService; |
| 26 | 24 | |
| 27 | - public function __construct(NotificationService $notificationService) | |
| 28 | - { | |
| 29 | - $this->notificationService = $notificationService; | |
| 25 | + private RoutePermissionService $routePermissionService; | |
| 26 | + | |
| 27 | + private PermissionResourceResolver $permissionResourceResolver; | |
| 28 | + | |
| 29 | + public function __construct( | |
| 30 | + NotificationService $notificationService, | |
| 31 | + RoutePermissionService $routePermissionService, | |
| 32 | + PermissionResourceResolver $permissionResourceResolver | |
| 33 | + ) { | |
| 34 | + $this->notificationService = $notificationService; | |
| 35 | + $this->routePermissionService = $routePermissionService; | |
| 36 | + $this->permissionResourceResolver = $permissionResourceResolver; | |
| 30 | 37 | } |
| 31 | 38 | |
| 32 | 39 | /** |
| 33 | 40 | * @param WP_REST_Request $data |
| @@ -42,17 +49,24 @@ | ||
| 42 | 49 | Sanitizer::verifyNonce($data->get_header('X-WP-Nonce')); |
| 43 | 50 | $notificationIds = Sanitizer::sanitizeIds($data->get_param('ids')); |
| 44 | 51 | |
| 45 | 52 | if (empty($notificationIds)) { |
| 46 | - throw new InvalidArgumentException('Notification IDs are required and must be an array.'); | |
| 53 | + throw new InvalidArgumentException( | |
| 54 | + BackendStrings::getExceptionStrings()['notification_ids_required'] | |
| 55 | + ); | |
| 47 | 56 | } |
| 48 | 57 | |
| 49 | - foreach ($notificationIds as $id) { | |
| 50 | - $this->notificationService->deleteNotification($id); | |
| 58 | + foreach ($notificationIds as $notificationId) { | |
| 59 | + $formId = $this->permissionResourceResolver->formIdFromNotificationId((int) $notificationId); | |
| 60 | + if ($formId === null || !$this->routePermissionService->canEditForms($formId)) { | |
| 61 | + throw new ForbiddenException('forbidden'); | |
| 62 | + } | |
| 51 | 63 | } |
| 52 | 64 | |
| 65 | + $this->notificationService->deleteNotifications($notificationIds); | |
| 66 | + | |
| 53 | 67 | return new WP_REST_Response([ |
| 54 | - 'message' => 'Successfully deleted notifications.', | |
| 68 | + 'message' => BackendStrings::getCommonStrings()['ok'], | |
| 55 | 69 | 'data' => [] |
| 56 | 70 | ], 200); |
| 57 | 71 | } |
| 58 | 72 | } |