← All changes | backend/src/Routes/Form/Form.php +107 -26 0.7 → 1.5 View file →

		@@ -1,17 +1,13 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Routes\Form;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10	5	use IvyForms\Vendor\DI\Container;
11	6	use IvyForms\Vendor\DI\DependencyException;
12	7	use IvyForms\Vendor\DI\NotFoundException;
13	8	use IvyForms\Controllers\Form\AddFormController;
	9	+use IvyForms\Controllers\Form\BulkUpdateFormController;
14	10	use IvyForms\Controllers\Form\DeleteFormController;
15	11	use IvyForms\Controllers\Form\FormSubmissionController;
16	12	use IvyForms\Controllers\Form\DuplicateFormController;
17	13	use IvyForms\Controllers\Form\GetFormController;
		@@ -20,9 +16,14 @@
20	16	use IvyForms\Controllers\Form\UpdateFormController;
21	17	use IvyForms\Controllers\Form\DeleteFormsController;
22	18	use IvyForms\Controllers\Form\UpdateFormStarredController;
23	19	use IvyForms\Controllers\Form\UpdateFormStatusController;
24		-use IvyForms\Controllers\Form\CheckDuplicateController;
	20	+use IvyForms\Controllers\Form\ValidateBeforeSubmitController;
	21	+use IvyForms\Controllers\Form\ExportFormController;
	22	+use IvyForms\Controllers\Form\ImportFormController;
	23	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	24	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	25	+use IvyForms\Services\Permissions\RoutePermissionService;
25	26	use WP_REST_Server;
26	27
27	28	class Form
28	29	{
		@@ -34,8 +35,9 @@
34	35	{
35	36	self::registerFormCrudRoutes($container, $routeNamespace);
36	37	self::registerFormManagementRoutes($container, $routeNamespace);
37	38	self::registerFormSubmissionRoutes($container, $routeNamespace);
	39	+ self::registerFormImportExportRoutes($container, $routeNamespace);
38	40	}
39	41
40	42	/**
41	43	* Register CRUD routes for forms (Create, Read, Update, Delete)
		@@ -44,8 +46,10 @@
44	46	* @throws NotFoundException
45	47	*/
46	48	private static function registerFormCrudRoutes(Container $container, string $routeNamespace): void
47	49	{
	50	+ $routePermissionService = $container->get(RoutePermissionService::class);
	51	+ $adminFormListPermissionService = $container->get(AdminFormListPermissionService::class);
48	52	// Get single form
49	53	register_rest_route(
50	54	$routeNamespace,
51	55	'/form/(?P<id>\d+)',
		@@ -51,10 +55,21 @@
51	55	'/form/(?P<id>\d+)',
52	56	[
53	57	'methods' => WP_REST_Server::READABLE,
54	58	'callback' => $container->get(GetFormController::class),
55		- 'permission_callback' => function () {
56		- return current_user_can('manage_options');
	59	+ 'permission_callback' => static function ($request) use (
	60	+ $adminFormListPermissionService,
	61	+ $routePermissionService
	62	+ ) {
	63	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	64	+ if ($formId === null) {
	65	+ return false;
	66	+ }
	67	+
	68	+ // Entry-only delegates need the form structure to render entry details,
	69	+ // so allow either forms-list access or entries access for this form.
	70	+ return $adminFormListPermissionService->canAccessFormInAdminLists($formId)
	71	+ || $routePermissionService->canViewEntries($formId);
57	72	}
58	73	]
59	74	);
60	75
		@@ -64,10 +79,10 @@
64	79	'/form',
65	80	[
66	81	'methods' => WP_REST_Server::READABLE,
67	82	'callback' => $container->get(GetFormsController::class),
68		- 'permission_callback' => function () {
69		- return current_user_can('manage_options');
	83	+ 'permission_callback' => static function () use ($routePermissionService) {
	84	+ return $routePermissionService->canViewFormsInLists();
70	85	}
71	86	]
72	87	);
73	88
		@@ -77,10 +92,10 @@
77	92	'/form/add/',
78	93	[
79	94	'methods' => WP_REST_Server::CREATABLE,
80	95	'callback' => $container->get(AddFormController::class),
81		- 'permission_callback' => function () {
82		- return current_user_can('manage_options');
	96	+ 'permission_callback' => static function () use ($routePermissionService) {
	97	+ return $routePermissionService->canEditForms();
83	98	}
84	99	]
85	100	);
86	101
		@@ -90,10 +105,11 @@
90	105	'/form/update/(?P<id>\d+)',
91	106	[
92	107	'methods' => WP_REST_Server::CREATABLE,
93	108	'callback' => $container->get(UpdateFormController::class),
94		- 'permission_callback' => function () {
95		- return current_user_can('manage_options');
	109	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	110	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	111	+ return $routePermissionService->canEditForms($formId);
96	112	}
97	113	]
98	114	);
99	115
		@@ -103,10 +119,11 @@
103	119	'/form/delete/(?P<id>\d+)',
104	120	[
105	121	'methods' => WP_REST_Server::CREATABLE,
106	122	'callback' => $container->get(DeleteFormController::class),
107		- 'permission_callback' => function () {
108		- return current_user_can('manage_options');
	123	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	124	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	125	+ return $routePermissionService->canDeleteForms($formId);
109	126	}
110	127	]
111	128	);
112	129
		@@ -116,10 +133,10 @@
116	133	'/forms/delete',
117	134	[
118	135	'methods' => WP_REST_Server::CREATABLE,
119	136	'callback' => $container->get(DeleteFormsController::class),
120		- 'permission_callback' => function () {
121		- return current_user_can('manage_options');
	137	+ 'permission_callback' => static function () use ($routePermissionService) {
	138	+ return $routePermissionService->canDeleteForms();
122	139	}
123	140	]
124	141	);
125	142	}
		@@ -131,8 +148,9 @@
131	148	* @throws NotFoundException
132	149	*/
133	150	private static function registerFormManagementRoutes(Container $container, string $routeNamespace): void
134	151	{
	152	+ $routePermissionService = $container->get(RoutePermissionService::class);
135	153	// Search forms
136	154	register_rest_route(
137	155	$routeNamespace,
138	156	'/forms/search',
		@@ -146,10 +164,10 @@
146	164	'orderBy' => ['type' => 'string'],
147	165	'order' => ['type' => 'string'],
148	166	'shouldGetCount' => ['type' => 'boolean'],
149	167	],
150		- 'permission_callback' => function () {
151		- return current_user_can('manage_options');
	168	+ 'permission_callback' => static function () use ($routePermissionService) {
	169	+ return $routePermissionService->canViewFormsInLists();
152	170	}
153	171	]
154	172	);
155	173
		@@ -159,10 +177,11 @@
159	177	'/form/update/starred/(?P<id>\d+)',
160	178	[
161	179	'methods' => WP_REST_Server::CREATABLE,
162	180	'callback' => $container->get(UpdateFormStarredController::class),
163		- 'permission_callback' => function () {
164		- return current_user_can('manage_options');
	181	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	182	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	183	+ return $routePermissionService->canEditForms($formId);
165	184	}
166	185	]
167	186	);
168	187
		@@ -172,10 +191,11 @@
172	191	'/form/update/status/(?P<id>\d+)',
173	192	[
174	193	'methods' => WP_REST_Server::CREATABLE,
175	194	'callback' => $container->get(UpdateFormStatusController::class),
176		- 'permission_callback' => function () {
177		- return current_user_can('manage_options');
	195	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	196	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	197	+ return $routePermissionService->canEditForms($formId);
178	198	}
179	199	]
180	200	);
181	201
		@@ -185,13 +205,27 @@
185	205	'/form/duplicate/(?P<id>\d+)',
186	206	[
187	207	'methods' => WP_REST_Server::CREATABLE,
188	208	'callback' => $container->get(DuplicateFormController::class),
189		- 'permission_callback' => function () {
190		- return current_user_can('manage_options');
	209	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	210	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	211	+ return $routePermissionService->canEditForms($formId);
191	212	}
192	213	]
193	214	);
	215	+
	216	+ // Bulk update forms
	217	+ register_rest_route(
	218	+ $routeNamespace,
	219	+ '/forms/batch-actions',
	220	+ [
	221	+ 'methods' => WP_REST_Server::CREATABLE,
	222	+ 'callback' => [$container->get(BulkUpdateFormController::class), 'handle'],
	223	+ 'permission_callback' => static function () use ($routePermissionService) {
	224	+ return $routePermissionService->canEditForms();
	225	+ }
	226	+ ]
	227	+ );
194	228	}
195	229
196	230	/**
197	231	* Register form submission routes (public-facing)
		@@ -209,8 +243,55 @@
209	243	'methods' => WP_REST_Server::CREATABLE,
210	244	'callback' => $container->get(FormSubmissionController::class),
211	245	// TODO - Add IvyForms capability - Public use
212	246	'permission_callback' => '__return_true'
	247	+ ]
	248	+ );
	249	+
	250	+ register_rest_route(
	251	+ $routeNamespace,
	252	+ '/form/validate_before_submit/',
	253	+ [
	254	+ 'methods' => WP_REST_Server::CREATABLE,
	255	+ 'callback' => $container->get(ValidateBeforeSubmitController::class),
	256	+ 'permission_callback' => '__return_true',
	257	+ ]
	258	+ );
	259	+ }
	260	+
	261	+ /**
	262	+ * Register form import/export routes
	263	+ *
	264	+ * @throws DependencyException
	265	+ * @throws NotFoundException
	266	+ */
	267	+ private static function registerFormImportExportRoutes(Container $container, string $routeNamespace): void
	268	+ {
	269	+ $routePermissionService = $container->get(RoutePermissionService::class);
	270	+
	271	+ // Export forms
	272	+ register_rest_route(
	273	+ $routeNamespace,
	274	+ '/forms/export',
	275	+ [
	276	+ 'methods' => WP_REST_Server::CREATABLE,
	277	+ 'callback' => $container->get(ExportFormController::class),
	278	+ 'permission_callback' => static function () use ($routePermissionService) {
	279	+ return $routePermissionService->canExportForms();
	280	+ }
	281	+ ]
	282	+ );
	283	+
	284	+ // Import forms
	285	+ register_rest_route(
	286	+ $routeNamespace,
	287	+ '/forms/import',
	288	+ [
	289	+ 'methods' => WP_REST_Server::CREATABLE,
	290	+ 'callback' => $container->get(ImportFormController::class),
	291	+ 'permission_callback' => static function () use ($routePermissionService) {
	292	+ return $routePermissionService->canEditForms();
	293	+ }
213	294	]
214	295	);
215	296	}
216	297	}