← All changes | backend/src/Routes/Entry/Entry.php +103 -47 0.9 → 1.5 View file →

		@@ -1,25 +1,23 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Routes\Entry;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10	5	use IvyForms\Vendor\DI\Container;
11	6	use IvyForms\Vendor\DI\DependencyException;
12	7	use IvyForms\Vendor\DI\NotFoundException;
13		-use IvyForms\Controllers\Entry\AddEntryController;
14	8	use IvyForms\Controllers\Entry\BulkUpdateEntryController;
15	9	use IvyForms\Controllers\Entry\DeleteEntriesController;
16	10	use IvyForms\Controllers\Entry\DeleteEntryController;
17	11	use IvyForms\Controllers\Entry\GetEntryController;
18	12	use IvyForms\Controllers\Entry\GetEntryCountController;
	13	+use IvyForms\Controllers\Entry\GetEntryFormsController;
19	14	use IvyForms\Controllers\Entry\SearchEntriesController;
20	15	use IvyForms\Controllers\Entry\UpdateEntryStarredController;
21	16	use IvyForms\Controllers\Entry\UpdateEntryStatusController;
	17	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	18	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	19	+use IvyForms\Services\Permissions\RoutePermissionService;
22	20	use WP_REST_Server;
23	21
24	22	class Entry
25	23	{
		@@ -28,9 +26,21 @@
28	26	* @throws NotFoundException
29	27	*/
30	28	public static function registerRoutes(Container $container, string $routeNamespace): void
31	29	{
32		- // TODO - Add IvyForms capability - Admin only for now
	30	+ self::registerEntryReadRoutes($container, $routeNamespace);
	31	+ self::registerEntryWriteRoutes($container, $routeNamespace);
	32	+ }
	33	+
	34	+ /**
	35	+ * @throws DependencyException
	36	+ * @throws NotFoundException
	37	+ */
	38	+ private static function registerEntryReadRoutes(Container $container, string $routeNamespace): void
	39	+ {
	40	+ $routePermissionService = $container->get(RoutePermissionService::class);
	41	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	42	+
33	43	register_rest_route(
34	44	$routeNamespace,
35	45	'/entry/(?P<id>\d+)',
36	46	[
		@@ -35,24 +45,27 @@
35	45	'/entry/(?P<id>\d+)',
36	46	[
37	47	'methods' => WP_REST_Server::READABLE,
38	48	'callback' => $container->get(GetEntryController::class),
39		- 'permission_callback' => function () {
40		- return current_user_can('manage_options');
41		- }
	49	+ 'permission_callback' => self::permissionForEntryForm(
	50	+ $permissionResourceResolver,
	51	+ static function (int $formId) use ($routePermissionService): bool {
	52	+ return $routePermissionService->canViewEntries($formId);
	53	+ }
	54	+ ),
42	55	]
43	56	);
44	57
45	58	register_rest_route(
46	59	$routeNamespace,
47		- '/entry/add/',
	60	+ '/entries/forms',
48	61	[
49		- 'methods' => WP_REST_Server::CREATABLE,
50		- 'callback' => $container->get(AddEntryController::class),
51		- 'permission_callback' => function () {
52		- return current_user_can('manage_options');
53		- }
54		- ]
	62	+ 'methods' => WP_REST_Server::READABLE,
	63	+ 'callback' => $container->get(GetEntryFormsController::class),
	64	+ 'permission_callback' => static function () use ($routePermissionService) {
	65	+ return $routePermissionService->canViewEntries();
	66	+ },
	67	+ ]
55	68	);
56	69
57	70	register_rest_route(
58	71	$routeNamespace,
		@@ -59,25 +72,48 @@
59	72	'/entries/search',
60	73	[
61	74	'methods' => WP_REST_Server::READABLE,
62	75	'callback' => $container->get(SearchEntriesController::class),
63		- 'permission_callback' => function () {
64		- return current_user_can('manage_options');
65		- }
	76	+ 'permission_callback' => static function () use ($routePermissionService) {
	77	+ return $routePermissionService->canViewEntries();
	78	+ },
66	79	]
67	80	);
68	81
69	82	register_rest_route(
70	83	$routeNamespace,
	84	+ '/entries/count',
	85	+ [
	86	+ 'methods' => WP_REST_Server::READABLE,
	87	+ 'callback' => $container->get(GetEntryCountController::class),
	88	+ 'permission_callback' => static function () use ($routePermissionService) {
	89	+ return $routePermissionService->canViewEntries();
	90	+ },
	91	+ ]
	92	+ );
	93	+ }
	94	+
	95	+ /**
	96	+ * @throws DependencyException
	97	+ * @throws NotFoundException
	98	+ */
	99	+ private static function registerEntryWriteRoutes(Container $container, string $routeNamespace): void
	100	+ {
	101	+ $routePermissionService = $container->get(RoutePermissionService::class);
	102	+ $permissionResourceResolver = $container->get(PermissionResourceResolver::class);
	103	+
	104	+ register_rest_route(
	105	+ $routeNamespace,
71	106	'/entries/delete',
72	107	[
73	108	'methods' => WP_REST_Server::CREATABLE,
74	109	'callback' => $container->get(DeleteEntriesController::class),
75		- 'permission_callback' => function () {
76		- return current_user_can('manage_options');
77		- }
	110	+ 'permission_callback' => static function () use ($routePermissionService) {
	111	+ return $routePermissionService->canDeleteEntries();
	112	+ },
78	113	]
79	114	);
	115	+
80	116	register_rest_route(
81	117	$routeNamespace,
82	118	'/entry/delete/(?P<id>\d+)',
83	119	[
		@@ -82,11 +118,14 @@
82	118	'/entry/delete/(?P<id>\d+)',
83	119	[
84	120	'methods' => WP_REST_Server::CREATABLE,
85	121	'callback' => $container->get(DeleteEntryController::class),
86		- 'permission_callback' => function () {
87		- return current_user_can('manage_options');
88		- }
	122	+ 'permission_callback' => self::permissionForEntryForm(
	123	+ $permissionResourceResolver,
	124	+ static function (int $formId) use ($routePermissionService): bool {
	125	+ return $routePermissionService->canDeleteEntries($formId);
	126	+ }
	127	+ ),
89	128	]
90	129	);
91	130
92	131	register_rest_route(
		@@ -94,11 +133,14 @@
94	133	'/entry/update/starred/(?P<id>\d+)',
95	134	[
96	135	'methods' => WP_REST_Server::CREATABLE,
97	136	'callback' => $container->get(UpdateEntryStarredController::class),
98		- 'permission_callback' => function () {
99		- return current_user_can('manage_options');
100		- }
	137	+ 'permission_callback' => self::permissionForEntryForm(
	138	+ $permissionResourceResolver,
	139	+ static function (int $formId) use ($routePermissionService): bool {
	140	+ return $routePermissionService->canEditEntries($formId);
	141	+ }
	142	+ ),
101	143	]
102	144	);
103	145
104	146	register_rest_route(
		@@ -106,35 +148,49 @@
106	148	'/entry/update/status/(?P<id>\d+)',
107	149	[
108	150	'methods' => WP_REST_Server::CREATABLE,
109	151	'callback' => $container->get(UpdateEntryStatusController::class),
110		- 'permission_callback' => function () {
111		- return current_user_can('manage_options');
112		- }
	152	+ 'permission_callback' => self::permissionForEntryForm(
	153	+ $permissionResourceResolver,
	154	+ static function (int $formId) use ($routePermissionService): bool {
	155	+ return $routePermissionService->canEditEntries($formId);
	156	+ }
	157	+ ),
113	158	]
114	159	);
115	160
116	161	register_rest_route(
117	162	$routeNamespace,
118		- '/entries/count',
119		- [
120		- 'methods' => WP_REST_Server::READABLE,
121		- 'callback' => $container->get(GetEntryCountController::class),
122		- 'permission_callback' => function () {
123		- return current_user_can('manage_options');
124		- }
125		- ]
126		- );
127		-
128		- register_rest_route(
129		- $routeNamespace,
130	163	'/entries/batch-actions',
131	164	[
132	165	'methods' => WP_REST_Server::CREATABLE,
133	166	'callback' => [$container->get(BulkUpdateEntryController::class), 'handle'],
134		- 'permission_callback' => function () {
135		- return current_user_can('manage_options');
136		- }
	167	+ 'permission_callback' => static function () use ($routePermissionService) {
	168	+ return $routePermissionService->canEditEntries();
	169	+ },
137	170	]
138	171	);
	172	+ }
	173	+
	174	+ /**
	175	+ * @param callable(int): bool $canAccessForm
	176	+ * @return callable
	177	+ */
	178	+ private static function permissionForEntryForm(
	179	+ PermissionResourceResolver $permissionResourceResolver,
	180	+ callable $canAccessForm
	181	+ ): callable {
	182	+ return static function ($request) use ($permissionResourceResolver, $canAccessForm): bool {
	183	+ $entryId = RestRouteParamReader::getPositiveIntParam($request);
	184	+ if ($entryId === null) {
	185	+ return false;
	186	+ }
	187	+
	188	+ $formId = $permissionResourceResolver->formIdFromEntryId($entryId);
	189	+ if ($formId === null) {
	190	+ return false;
	191	+ }
	192	+
	193	+ return $canAccessForm($formId);
	194	+ };
139	195	}
140	196	}