← All changes | backend/src/Routes/Form/Form.php +95 -28 0.9 → 1.5 View file →

		@@ -1,13 +1,8 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Routes\Form;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
10	5	use IvyForms\Vendor\DI\Container;
11	6	use IvyForms\Vendor\DI\DependencyException;
12	7	use IvyForms\Vendor\DI\NotFoundException;
13	8	use IvyForms\Controllers\Form\AddFormController;
		@@ -21,9 +16,14 @@
21	16	use IvyForms\Controllers\Form\UpdateFormController;
22	17	use IvyForms\Controllers\Form\DeleteFormsController;
23	18	use IvyForms\Controllers\Form\UpdateFormStarredController;
24	19	use IvyForms\Controllers\Form\UpdateFormStatusController;
25		-use IvyForms\Controllers\Form\CheckDuplicateController;
	20	+use IvyForms\Controllers\Form\ValidateBeforeSubmitController;
	21	+use IvyForms\Controllers\Form\ExportFormController;
	22	+use IvyForms\Controllers\Form\ImportFormController;
	23	+use IvyForms\Infrastructure\WP\REST\RestRouteParamReader;
	24	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	25	+use IvyForms\Services\Permissions\RoutePermissionService;
26	26	use WP_REST_Server;
27	27
28	28	class Form
29	29	{
		@@ -35,8 +35,9 @@
35	35	{
36	36	self::registerFormCrudRoutes($container, $routeNamespace);
37	37	self::registerFormManagementRoutes($container, $routeNamespace);
38	38	self::registerFormSubmissionRoutes($container, $routeNamespace);
	39	+ self::registerFormImportExportRoutes($container, $routeNamespace);
39	40	}
40	41
41	42	/**
42	43	* Register CRUD routes for forms (Create, Read, Update, Delete)
		@@ -45,8 +46,10 @@
45	46	* @throws NotFoundException
46	47	*/
47	48	private static function registerFormCrudRoutes(Container $container, string $routeNamespace): void
48	49	{
	50	+ $routePermissionService = $container->get(RoutePermissionService::class);
	51	+ $adminFormListPermissionService = $container->get(AdminFormListPermissionService::class);
49	52	// Get single form
50	53	register_rest_route(
51	54	$routeNamespace,
52	55	'/form/(?P<id>\d+)',
		@@ -52,10 +55,21 @@
52	55	'/form/(?P<id>\d+)',
53	56	[
54	57	'methods' => WP_REST_Server::READABLE,
55	58	'callback' => $container->get(GetFormController::class),
56		- 'permission_callback' => function () {
57		- return current_user_can('manage_options');
	59	+ 'permission_callback' => static function ($request) use (
	60	+ $adminFormListPermissionService,
	61	+ $routePermissionService
	62	+ ) {
	63	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	64	+ if ($formId === null) {
	65	+ return false;
	66	+ }
	67	+
	68	+ // Entry-only delegates need the form structure to render entry details,
	69	+ // so allow either forms-list access or entries access for this form.
	70	+ return $adminFormListPermissionService->canAccessFormInAdminLists($formId)
	71	+ || $routePermissionService->canViewEntries($formId);
58	72	}
59	73	]
60	74	);
61	75
		@@ -65,10 +79,10 @@
65	79	'/form',
66	80	[
67	81	'methods' => WP_REST_Server::READABLE,
68	82	'callback' => $container->get(GetFormsController::class),
69		- 'permission_callback' => function () {
70		- return current_user_can('manage_options');
	83	+ 'permission_callback' => static function () use ($routePermissionService) {
	84	+ return $routePermissionService->canViewFormsInLists();
71	85	}
72	86	]
73	87	);
74	88
		@@ -78,10 +92,10 @@
78	92	'/form/add/',
79	93	[
80	94	'methods' => WP_REST_Server::CREATABLE,
81	95	'callback' => $container->get(AddFormController::class),
82		- 'permission_callback' => function () {
83		- return current_user_can('manage_options');
	96	+ 'permission_callback' => static function () use ($routePermissionService) {
	97	+ return $routePermissionService->canEditForms();
84	98	}
85	99	]
86	100	);
87	101
		@@ -91,10 +105,11 @@
91	105	'/form/update/(?P<id>\d+)',
92	106	[
93	107	'methods' => WP_REST_Server::CREATABLE,
94	108	'callback' => $container->get(UpdateFormController::class),
95		- 'permission_callback' => function () {
96		- return current_user_can('manage_options');
	109	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	110	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	111	+ return $routePermissionService->canEditForms($formId);
97	112	}
98	113	]
99	114	);
100	115
		@@ -104,10 +119,11 @@
104	119	'/form/delete/(?P<id>\d+)',
105	120	[
106	121	'methods' => WP_REST_Server::CREATABLE,
107	122	'callback' => $container->get(DeleteFormController::class),
108		- 'permission_callback' => function () {
109		- return current_user_can('manage_options');
	123	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	124	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	125	+ return $routePermissionService->canDeleteForms($formId);
110	126	}
111	127	]
112	128	);
113	129
		@@ -117,10 +133,10 @@
117	133	'/forms/delete',
118	134	[
119	135	'methods' => WP_REST_Server::CREATABLE,
120	136	'callback' => $container->get(DeleteFormsController::class),
121		- 'permission_callback' => function () {
122		- return current_user_can('manage_options');
	137	+ 'permission_callback' => static function () use ($routePermissionService) {
	138	+ return $routePermissionService->canDeleteForms();
123	139	}
124	140	]
125	141	);
126	142	}
		@@ -132,8 +148,9 @@
132	148	* @throws NotFoundException
133	149	*/
134	150	private static function registerFormManagementRoutes(Container $container, string $routeNamespace): void
135	151	{
	152	+ $routePermissionService = $container->get(RoutePermissionService::class);
136	153	// Search forms
137	154	register_rest_route(
138	155	$routeNamespace,
139	156	'/forms/search',
		@@ -147,10 +164,10 @@
147	164	'orderBy' => ['type' => 'string'],
148	165	'order' => ['type' => 'string'],
149	166	'shouldGetCount' => ['type' => 'boolean'],
150	167	],
151		- 'permission_callback' => function () {
152		- return current_user_can('manage_options');
	168	+ 'permission_callback' => static function () use ($routePermissionService) {
	169	+ return $routePermissionService->canViewFormsInLists();
153	170	}
154	171	]
155	172	);
156	173
		@@ -160,10 +177,11 @@
160	177	'/form/update/starred/(?P<id>\d+)',
161	178	[
162	179	'methods' => WP_REST_Server::CREATABLE,
163	180	'callback' => $container->get(UpdateFormStarredController::class),
164		- 'permission_callback' => function () {
165		- return current_user_can('manage_options');
	181	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	182	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	183	+ return $routePermissionService->canEditForms($formId);
166	184	}
167	185	]
168	186	);
169	187
		@@ -173,10 +191,11 @@
173	191	'/form/update/status/(?P<id>\d+)',
174	192	[
175	193	'methods' => WP_REST_Server::CREATABLE,
176	194	'callback' => $container->get(UpdateFormStatusController::class),
177		- 'permission_callback' => function () {
178		- return current_user_can('manage_options');
	195	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	196	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	197	+ return $routePermissionService->canEditForms($formId);
179	198	}
180	199	]
181	200	);
182	201
		@@ -186,10 +205,11 @@
186	205	'/form/duplicate/(?P<id>\d+)',
187	206	[
188	207	'methods' => WP_REST_Server::CREATABLE,
189	208	'callback' => $container->get(DuplicateFormController::class),
190		- 'permission_callback' => function () {
191		- return current_user_can('manage_options');
	209	+ 'permission_callback' => static function ($request) use ($routePermissionService) {
	210	+ $formId = RestRouteParamReader::getPositiveIntParam($request);
	211	+ return $routePermissionService->canEditForms($formId);
192	212	}
193	213	]
194	214	);
195	215
		@@ -199,10 +219,10 @@
199	219	'/forms/batch-actions',
200	220	[
201	221	'methods' => WP_REST_Server::CREATABLE,
202	222	'callback' => [$container->get(BulkUpdateFormController::class), 'handle'],
203		- 'permission_callback' => function () {
204		- return current_user_can('manage_options');
	223	+ 'permission_callback' => static function () use ($routePermissionService) {
	224	+ return $routePermissionService->canEditForms();
205	225	}
206	226	]
207	227	);
208	228	}
		@@ -223,8 +243,55 @@
223	243	'methods' => WP_REST_Server::CREATABLE,
224	244	'callback' => $container->get(FormSubmissionController::class),
225	245	// TODO - Add IvyForms capability - Public use
226	246	'permission_callback' => '__return_true'
	247	+ ]
	248	+ );
	249	+
	250	+ register_rest_route(
	251	+ $routeNamespace,
	252	+ '/form/validate_before_submit/',
	253	+ [
	254	+ 'methods' => WP_REST_Server::CREATABLE,
	255	+ 'callback' => $container->get(ValidateBeforeSubmitController::class),
	256	+ 'permission_callback' => '__return_true',
	257	+ ]
	258	+ );
	259	+ }
	260	+
	261	+ /**
	262	+ * Register form import/export routes
	263	+ *
	264	+ * @throws DependencyException
	265	+ * @throws NotFoundException
	266	+ */
	267	+ private static function registerFormImportExportRoutes(Container $container, string $routeNamespace): void
	268	+ {
	269	+ $routePermissionService = $container->get(RoutePermissionService::class);
	270	+
	271	+ // Export forms
	272	+ register_rest_route(
	273	+ $routeNamespace,
	274	+ '/forms/export',
	275	+ [
	276	+ 'methods' => WP_REST_Server::CREATABLE,
	277	+ 'callback' => $container->get(ExportFormController::class),
	278	+ 'permission_callback' => static function () use ($routePermissionService) {
	279	+ return $routePermissionService->canExportForms();
	280	+ }
	281	+ ]
	282	+ );
	283	+
	284	+ // Import forms
	285	+ register_rest_route(
	286	+ $routeNamespace,
	287	+ '/forms/import',
	288	+ [
	289	+ 'methods' => WP_REST_Server::CREATABLE,
	290	+ 'callback' => $container->get(ImportFormController::class),
	291	+ 'permission_callback' => static function () use ($routePermissionService) {
	292	+ return $routePermissionService->canEditForms();
	293	+ }
227	294	]
228	295	);
229	296	}
230	297	}