← All changes | backend/src/Routes/Confirmation/Confirmation.php +47 -15 0.9 → 1.5 View file →

		@@ -1,13 +1,8 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Routes\Confirmation;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10	5	use IvyForms\Vendor\DI\Container;
11	6	use IvyForms\Vendor\DI\DependencyException;
12	7	use IvyForms\Vendor\DI\NotFoundException;
13	8	use IvyForms\Controllers\Confirmation\AddConfirmationController;
		@@ -13,8 +8,11 @@
13	8	use IvyForms\Controllers\Confirmation\AddConfirmationController;
14	9	use IvyForms\Controllers\Confirmation\GetConfirmationsController;
15	10	use IvyForms\Controllers\Confirmation\GetConformationController;
16	11	use IvyForms\Controllers\Confirmation\UpdateConfirmationController;
	12	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	13	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	14	+use IvyForms\Services\Permissions\RoutePermissionService;
17	15	use WP_REST_Server;
18	16
19	17	class Confirmation
20	18	{
		@@ -23,8 +21,11 @@
23	21	* @throws NotFoundException
24	22	*/
25	23	public static function registerRoutes(Container $container, string $routeNamespace): void
26	24	{
	25	+ $routePermissionService = $container->get(RoutePermissionService::class);
	26	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	27	+
27	28	register_rest_route(
28	29	$routeNamespace,
29	30	'/confirmation/(?P<id>\d+)',
30	31	[
		@@ -29,11 +30,12 @@
29	30	'/confirmation/(?P<id>\d+)',
30	31	[
31	32	'methods' => WP_REST_Server::READABLE,
32	33	'callback' => $container->get(GetConformationController::class),
33		- 'permission_callback' => function () {
34		- return current_user_can('manage_options');
35		- },
	34	+ 'permission_callback' => self::permissionForConfirmationForm(
	35	+ $permissionResourceResolver,
	36	+ $routePermissionService
	37	+ ),
36	38	]
37	39	);
38	40
39	41	register_rest_route(
		@@ -41,10 +43,11 @@
41	43	'/confirmations/(?P<id>\d+)',
42	44	[
43	45	'methods' => WP_REST_Server::READABLE,
44	46	'callback' => $container->get(GetConfirmationsController::class),
45		- 'permission_callback' => function () {
46		- return current_user_can('manage_options');
	47	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	48	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	49	+ return $routePermissionService->canEditForms($formId);
47	50	},
48	51	]
49	52	);
50	53
		@@ -53,10 +56,11 @@
53	56	'/confirmation/add/',
54	57	[
55	58	'methods' => WP_REST_Server::CREATABLE,
56	59	'callback' => $container->get(AddConfirmationController::class),
57		- 'permission_callback' => function () {
58		- return current_user_can('manage_options');
	60	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	61	+ $formId = RestRouteParamReader::getPositiveIntParam($request, 'formId');
	62	+ return $routePermissionService->canEditForms($formId);
59	63	}
60	64	]
61	65	);
62	66
		@@ -65,11 +69,39 @@
65	69	'/confirmation/update/(?P<id>\d+)',
66	70	[
67	71	'methods' => WP_REST_Server::CREATABLE,
68	72	'callback' => $container->get(UpdateConfirmationController::class),
69		- 'permission_callback' => function () {
70		- return current_user_can('manage_options');
71		- }
	73	+ 'permission_callback' => self::permissionForConfirmationForm(
	74	+ $permissionResourceResolver,
	75	+ $routePermissionService
	76	+ ),
72	77	]
73	78	);
	79	+ }
	80	+
	81	+ /**
	82	+ * Authorize against the confirmation's owning form, not a client-supplied formId.
	83	+ *
	84	+ * @return callable
	85	+ */
	86	+ private static function permissionForConfirmationForm(
	87	+ PermissionResourceResolver $permissionResourceResolver,
	88	+ RoutePermissionService $routePermissionService
	89	+ ): callable {
	90	+ return static function ($request) use (
	91	+ $permissionResourceResolver,
	92	+ $routePermissionService
	93	+ ): bool {
	94	+ $confirmationId = RestRouteParamReader::getPositiveIntParam($request);
	95	+ if ($confirmationId === null) {
	96	+ return false;
	97	+ }
	98	+
	99	+ $formId = $permissionResourceResolver->formIdFromConfirmationId($confirmationId);
	100	+ if ($formId === null) {
	101	+ return false;
	102	+ }
	103	+
	104	+ return $routePermissionService->canEditForms($formId);
	105	+ };
74	106	}
75	107	}