# storeengine/2.2.0/includes/api/product.php StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More, version 2.2.0. 1,239 lines. - Page: https://pluginprobe.com/plugins/storeengine/2.2.0/code/includes/api/product.php - Raw: https://pluginprobe.com/plugins/storeengine/2.2.0/raw/includes/api/product.php - Modified: 2026-07-30T16:04:46+00:00 Line numbers below start at 1. Link to a line or a range by appending a fragment to the page URL, for example `https://pluginprobe.com/plugins/storeengine/2.2.0/code/includes/api/product.php#L10-L20`. ```php \d+)/stock-adjust', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_stock_adjust' ], 'permission_callback' => [ $this, 'rest_stock_permission' ], 'args' => [ 'variation_id' => [ 'type' => 'integer', 'default' => 0 ], 'action' => [ 'type' => 'string', 'required' => true, 'enum' => [ 'add', 'remove', 'set' ] ], 'quantity' => [ 'type' => 'integer', 'required' => true, 'minimum' => 0 ], 'reason' => [ 'type' => 'string', 'default' => 'manual' ], 'note' => [ 'type' => 'string', 'default' => '' ], ], ] ); register_rest_route( 'storeengine/v1', '/products/(?P\d+)/stock-movements', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_stock_movements' ], 'permission_callback' => [ $this, 'rest_stock_permission' ], 'args' => [ 'variation_id' => [ 'type' => 'integer', 'default' => 0 ], 'per_page' => [ 'type' => 'integer', 'default' => 25, 'minimum' => 1, 'maximum' => 100 ], 'page' => [ 'type' => 'integer', 'default' => 1, 'minimum' => 1 ], ], ] ); // Public: rendered Quick View (mini single-product) markup for the shop // archive modal. register_rest_route( 'storeengine/v1', '/products/(?P\d+)/quick-view', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_quick_view' ], 'permission_callback' => '__return_true', 'args' => [ 'id' => [ 'type' => 'integer' ], ], ] ); // Recently-viewed cards for a client-supplied list of product ids (order // preserved). The list lives in the shopper's browser (localStorage); this // only renders the cards. register_rest_route( 'storeengine/v1', '/products/recently-viewed', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_recently_viewed' ], 'permission_callback' => '__return_true', 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], 'exclude' => [ 'type' => 'integer', 'default' => 0 ], ], ] ); // Wishlist. Toggle/merge persist to user meta (logged-in only); guests // keep their list in the browser. Cards renders for a given id list. register_rest_route( 'storeengine/v1', '/wishlist/toggle', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_wishlist_toggle' ], 'permission_callback' => fn() => is_user_logged_in(), 'args' => [ 'product_id' => [ 'type' => 'integer', 'required' => true ], ], ] ); register_rest_route( 'storeengine/v1', '/wishlist/merge', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_wishlist_merge' ], 'permission_callback' => fn() => is_user_logged_in(), 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], ], ] ); register_rest_route( 'storeengine/v1', '/wishlist/cards', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_wishlist_cards' ], 'permission_callback' => '__return_true', 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], ], ] ); // Product compare. Same split as the wishlist: toggle/merge persist to // user meta for logged-in shoppers, guests keep the list in the browser, // and table renders the comparison for a given id list. register_rest_route( 'storeengine/v1', '/compare/toggle', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_compare_toggle' ], 'permission_callback' => fn() => is_user_logged_in(), 'args' => [ 'product_id' => [ 'type' => 'integer', 'required' => true ], ], ] ); register_rest_route( 'storeengine/v1', '/compare/clear', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_compare_clear' ], 'permission_callback' => fn() => is_user_logged_in(), ] ); register_rest_route( 'storeengine/v1', '/compare/merge', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_compare_merge' ], 'permission_callback' => fn() => is_user_logged_in(), 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], ], ] ); register_rest_route( 'storeengine/v1', '/compare/table', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_compare_table' ], 'permission_callback' => '__return_true', 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], ], ] ); // Minimal id/title/thumb for the docked tray — the full table would be // far too much payload just to draw a row of thumbnails. register_rest_route( 'storeengine/v1', '/compare/items', [ 'methods' => 'GET', 'callback' => [ $this, 'rest_compare_items' ], 'permission_callback' => '__return_true', 'args' => [ 'ids' => [ 'type' => 'string', 'default' => '' ], ], ] ); // On-demand SKU / barcode generation for the "Generate" buttons in the // product editor. Uses the same engine + pattern as auto-on-save. register_rest_route( 'storeengine/v1', '/inventory/generate-code', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_generate_code' ], 'permission_callback' => fn() => current_user_can( 'edit_storeengine_products' ), 'args' => [ 'type' => [ 'type' => 'string', 'required' => true, 'enum' => [ 'sku', 'barcode' ] ], 'name' => [ 'type' => 'string', 'default' => '' ], 'category_id' => [ 'type' => 'integer', 'default' => 0 ], ], ] ); // Batch resolve pasted SKUs / barcodes to product name + price for the // Barcode Labels page. The standard product collection `search` only // matches title/content, so it can't auto-fill a label from a raw code. register_rest_route( 'storeengine/v1', '/inventory/resolve-codes', [ 'methods' => 'POST', 'callback' => [ $this, 'rest_resolve_codes' ], 'permission_callback' => fn() => current_user_can( 'edit_storeengine_products' ), 'args' => [ 'codes' => [ 'type' => 'array', 'required' => true, 'items' => [ 'type' => 'string' ], ], ], ] ); } public function rest_generate_code( WP_REST_Request $request ) { $type = (string) $request['type']; if ( 'barcode' === $type ) { return rest_ensure_response( [ 'value' => SkuGenerator::generate_barcode() ] ); } $category = ''; $cat_id = (int) ( $request['category_id'] ?? 0 ); if ( $cat_id > 0 ) { $term = get_term( $cat_id, Helper::PRODUCT_CATEGORY_TAXONOMY ); if ( $term && ! is_wp_error( $term ) ) { $category = (string) $term->slug; } } return rest_ensure_response( [ 'value' => SkuGenerator::generate_sku( [ 'name' => sanitize_text_field( (string) ( $request['name'] ?? '' ) ), 'category' => $category, ] ), ] ); } /** * Resolve a batch of SKUs / barcodes to printable label data * (name, sku, barcode, selling price). Exact match only — keyed by the * original code so the Barcode Labels page can auto-fill pasted entries. * Codes with no match are simply omitted from the response map. */ public function rest_resolve_codes( WP_REST_Request $request ) { global $wpdb; $codes = $request->get_param( 'codes' ); $codes = is_array( $codes ) ? $codes : []; $codes = array_values( array_unique( array_filter( array_map( static fn( $c ) => trim( sanitize_text_field( (string) $c ) ), $codes ), static fn( $c ) => '' !== $c ) ) ); $codes = array_slice( $codes, 0, 200 ); $out = []; if ( empty( $codes ) ) { return rest_ensure_response( (object) $out ); } $variations_table = $wpdb->prefix . 'storeengine_product_variations'; foreach ( $codes as $code ) { // Variant exact match (barcode or SKU). Variations store a price // increment; the selling price is base + increment (mirrors the // POS lookup controller). // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- %i identifier + %s values bound via prepare() on a custom StoreEngine table joined to core posts; per-code barcode/SKU lookup, not cacheable. $row = $wpdb->get_row( $wpdb->prepare( "SELECT v.id, v.product_id, v.sku, v.barcode, v.price, p.post_title AS product_title FROM %i v LEFT JOIN {$wpdb->posts} p ON p.ID = v.product_id WHERE ( v.barcode = %s OR v.sku = %s ) AND p.post_status <> 'trash' LIMIT 1", $variations_table, $code, $code ) ); // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter if ( $row ) { // Object-level scope: never disclose a product the caller can't edit. if ( ! $this->can_resolve_product( (int) $row->product_id ) ) { continue; } $name = (string) ( $row->product_title ?? '' ); $vlabel = $this->resolve_variant_label( (int) $row->id ); if ( '' !== $vlabel ) { $name = '' !== $name ? $name . ' – ' . $vlabel : $vlabel; } $extra = null === $row->price ? 0.0 : (float) $row->price; $out[ $code ] = [ 'name' => $name, 'sku' => (string) $row->sku, 'barcode' => $row->barcode ? (string) $row->barcode : '', 'price' => $this->resolve_base_price( (int) $row->product_id ) + $extra, ]; continue; } // Simple-product exact match by SKU / barcode postmeta. // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared $simple = $wpdb->get_row( $wpdb->prepare( "SELECT p.ID AS product_id, p.post_title AS product_title, sku.meta_value AS sku, bc.meta_value AS barcode FROM {$wpdb->posts} p LEFT JOIN {$wpdb->postmeta} sku ON sku.post_id = p.ID AND sku.meta_key = '_storeengine_sku' LEFT JOIN {$wpdb->postmeta} bc ON bc.post_id = p.ID AND bc.meta_key = '_storeengine_barcode' WHERE p.post_type = %s AND p.post_status <> 'trash' AND ( sku.meta_value = %s OR bc.meta_value = %s ) LIMIT 1", Helper::PRODUCT_POST_TYPE, $code, $code ) ); // phpcs:enable if ( $simple ) { // Object-level scope: never disclose a product the caller can't edit. if ( ! $this->can_resolve_product( (int) $simple->product_id ) ) { continue; } $prices = Helper::get_prices_array_by_product_id( (int) $simple->product_id ); $out[ $code ] = [ 'name' => (string) ( $simple->product_title ?? '' ), 'sku' => (string) ( $simple->sku ?? '' ), 'barcode' => $simple->barcode ? (string) $simple->barcode : '', 'price' => isset( $prices[0]['price'] ) ? (float) $prices[0]['price'] : null, ]; } } return rest_ensure_response( (object) $out ); } /** * Default (lowest-order) base price for a product, from the price table. */ protected function resolve_base_price( int $product_id ): float { if ( ! $product_id ) { return 0.0; } global $wpdb; // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared $base = $wpdb->get_var( $wpdb->prepare( "SELECT price FROM {$wpdb->prefix}storeengine_product_price WHERE product_id = %d ORDER BY `order` ASC LIMIT 1", $product_id ) ); // phpcs:enable return null === $base ? 0.0 : (float) $base; } /** * Human-readable variant attribute label, e.g. "Black / M". */ protected function resolve_variant_label( int $variation_id ): string { if ( ! $variation_id ) { return ''; } try { $variation = ( new Variation( $variation_id ) )->get(); } catch ( Throwable $e ) { return ''; } if ( ! $variation ) { return ''; } $parts = []; foreach ( $variation->get_attributes() as $attribute ) { if ( ! empty( $attribute->name ) ) { $parts[] = $attribute->name; } } return implode( ' / ', $parts ); } /** * Permission gate for the per-product stock routes. The old gate just * checked the plural `edit_storeengine_products` cap, which the multi- * vendor addon grants to EVERY vendor — so any vendor could POST to any * other vendor's product id and adjust their stock (or read their * movement history). Now we also verify the caller owns the product * being targeted. * * Uses the inventory addon's Authorization helper when available (same * helper the sibling /inventory/adjust route uses, so behavior stays * consistent across endpoints). When the addon isn't loaded the IDOR * surface doesn't exist either — multi-vendor needs inventory — but we * fall back to a direct post_author check to be safe. */ /** * Render the Quick View (mini single-product) markup for the archive modal. */ public function rest_quick_view( \WP_REST_Request $request ) { $product_id = absint( $request['id'] ); $product = Helper::get_product( $product_id ); if ( ! $product || 'publish' !== get_post_status( $product_id ) ) { return new \WP_Error( 'storeengine_not_found', __( 'Product not found.', 'storeengine' ), [ 'status' => 404 ] ); } global $post; $post = get_post( $product_id ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited $GLOBALS['product'] = $product; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound setup_postdata( $post ); ob_start(); Helper::get_template( 'single-product/quick-view.php', [ 'product' => $product ] ); $html = ob_get_clean(); wp_reset_postdata(); $response = [ 'id' => $product_id, 'permalink' => get_permalink( $product_id ), 'html' => $html, ]; // Variable products need their variation matrix client-side to wire the // picker + variation-aware price placeholder. On a full product page this // is localized as `StoreEngineProductVariations`, but the archive page // (which hosts Quick View) never localizes it, so ship it in the payload. if ( $product instanceof \StoreEngine\Classes\Product\VariableProduct && 'variable' === $product->get_type() ) { $response['variations'] = \StoreEngine\Assets::get_product_variations( $product ); } return rest_ensure_response( $response ); } /** * Render "recently viewed" product cards for a client-supplied id list. * Order follows the given ids (most-recent first); the current product is * excluded. Returns rendered loop-card HTML. */ public function rest_recently_viewed( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_recently_viewed', true ) ) { return rest_ensure_response( [ 'html' => '' ] ); } $ids = array_values( array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ) ); $exclude = absint( $request->get_param( 'exclude' ) ); if ( $exclude ) { $ids = array_values( array_diff( $ids, [ $exclude ] ) ); } $ids = array_slice( array_unique( $ids ), 0, 12 ); return rest_ensure_response( [ 'html' => $this->render_product_cards( $ids ) ] ); } /** * Render loop-card HTML for the given product ids, in the order given. * Shared by Recently Viewed and Wishlist. * * @param int[] $ids */ private function render_product_cards( array $ids ): string { $ids = array_values( array_filter( array_map( 'absint', $ids ) ) ); if ( empty( $ids ) ) { return ''; } $products_per_row = Helper::get_settings( 'product_archive_products_per_row', (object) [ 'desktop' => 3, 'tablet' => 2, 'mobile' => 1, ] ); $grid_class = Helper::get_responsive_column( [ 'desktop' => (int) ( $products_per_row->desktop ?? 3 ), 'tablet' => (int) ( $products_per_row->tablet ?? 2 ), 'mobile' => (int) ( $products_per_row->mobile ?? 1 ), ] ); $query = new \WP_Query( [ 'post_type' => Helper::PRODUCT_POST_TYPE, 'post_status' => 'publish', 'post__in' => $ids, 'orderby' => 'post__in', 'posts_per_page' => count( $ids ), 'no_found_rows' => true, 'ignore_sticky_posts' => true, ] ); ob_start(); if ( $query->have_posts() ) { while ( $query->have_posts() ) { $query->the_post(); Helper::get_template( 'content-product.php', [ 'grid_class' => $grid_class ] ); } } wp_reset_postdata(); return (string) ob_get_clean(); } /** Toggle a product in the logged-in user's wishlist (user meta). */ public function rest_wishlist_toggle( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_wishlist', false ) ) { return new \WP_Error( 'storeengine_wishlist_disabled', __( 'Wishlist is disabled.', 'storeengine' ), [ 'status' => 403 ] ); } $product_id = absint( $request->get_param( 'product_id' ) ); if ( ! $product_id || Helper::PRODUCT_POST_TYPE !== get_post_type( $product_id ) ) { return new \WP_Error( 'storeengine_not_found', __( 'Product not found.', 'storeengine' ), [ 'status' => 404 ] ); } $ids = storeengine_get_user_wishlist(); $in = in_array( $product_id, $ids, true ); $ids = $in ? array_values( array_diff( $ids, [ $product_id ] ) ) : array_merge( $ids, [ $product_id ] ); $ids = storeengine_set_user_wishlist( $ids ); return rest_ensure_response( [ 'ids' => array_map( 'strval', $ids ), 'count' => count( $ids ), 'in_wishlist' => ! $in, ] ); } /** Merge a guest's browser wishlist into the account on login. */ public function rest_wishlist_merge( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_wishlist', false ) ) { return new \WP_Error( 'storeengine_wishlist_disabled', __( 'Wishlist is disabled.', 'storeengine' ), [ 'status' => 403 ] ); } $incoming = array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ); $ids = storeengine_set_user_wishlist( array_merge( storeengine_get_user_wishlist(), $incoming ) ); return rest_ensure_response( [ 'ids' => array_map( 'strval', $ids ), 'count' => count( $ids ), ] ); } /** Toggle a product in the logged-in user's compare list (user meta). */ public function rest_compare_toggle( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_product_compare', false ) ) { return new \WP_Error( 'storeengine_compare_disabled', __( 'Product compare is disabled.', 'storeengine' ), [ 'status' => 403 ] ); } $product_id = absint( $request->get_param( 'product_id' ) ); if ( ! $product_id || Helper::PRODUCT_POST_TYPE !== get_post_type( $product_id ) ) { return new \WP_Error( 'storeengine_not_found', __( 'Product not found.', 'storeengine' ), [ 'status' => 404 ] ); } $ids = storeengine_get_user_compare(); $in = in_array( $product_id, $ids, true ); $ids = $in ? array_values( array_diff( $ids, [ $product_id ] ) ) : array_merge( $ids, [ $product_id ] ); // set_user_compare() applies the cap, so the response is authoritative // even when the shopper just pushed past the limit. $ids = storeengine_set_user_compare( $ids ); return rest_ensure_response( [ 'ids' => array_map( 'strval', $ids ), 'count' => count( $ids ), 'in_compare' => in_array( $product_id, $ids, true ), 'max' => \StoreEngine\Classes\ProductCompare::max(), ] ); } /** Empty the logged-in user's compare list. */ public function rest_compare_clear() { if ( ! Helper::get_settings( 'enable_product_compare', false ) ) { return new \WP_Error( 'storeengine_compare_disabled', __( 'Product compare is disabled.', 'storeengine' ), [ 'status' => 403 ] ); } storeengine_set_user_compare( [] ); return rest_ensure_response( [ 'ids' => [], 'count' => 0 ] ); } /** Merge a guest's browser compare list into the account on login. */ public function rest_compare_merge( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_product_compare', false ) ) { return new \WP_Error( 'storeengine_compare_disabled', __( 'Product compare is disabled.', 'storeengine' ), [ 'status' => 403 ] ); } $incoming = array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ); $ids = storeengine_set_user_compare( array_merge( storeengine_get_user_compare(), $incoming ) ); return rest_ensure_response( [ 'ids' => array_map( 'strval', $ids ), 'count' => count( $ids ), ] ); } /** Render the comparison table for a client-supplied id list. */ public function rest_compare_table( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_product_compare', false ) ) { return rest_ensure_response( [ 'html' => '' ] ); } $ids = array_values( array_unique( array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ) ) ); return rest_ensure_response( [ 'html' => \StoreEngine\Classes\ProductCompare::get_table_html( $ids ), ] ); } /** Minimal product info for the docked compare tray. */ public function rest_compare_items( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_product_compare', false ) ) { return rest_ensure_response( [ 'items' => [] ] ); } $ids = array_slice( array_values( array_unique( array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ) ) ), 0, \StoreEngine\Classes\ProductCompare::max() ); $items = []; foreach ( $ids as $id ) { if ( Helper::PRODUCT_POST_TYPE !== get_post_type( $id ) || 'publish' !== get_post_status( $id ) ) { continue; } $thumb = get_the_post_thumbnail_url( $id, 'thumbnail' ); $items[] = [ 'id' => (string) $id, 'title' => get_the_title( $id ), 'url' => get_permalink( $id ), 'thumb' => $thumb ?: storeengine_placeholder_image_src(), ]; } return rest_ensure_response( [ 'items' => $items ] ); } /** Render wishlist product cards for a client-supplied id list. */ public function rest_wishlist_cards( \WP_REST_Request $request ) { if ( ! Helper::get_settings( 'enable_wishlist', false ) ) { return rest_ensure_response( [ 'html' => '' ] ); } $ids = array_slice( array_values( array_unique( array_filter( array_map( 'absint', explode( ',', (string) $request->get_param( 'ids' ) ) ) ) ) ), 0, 100 ); return rest_ensure_response( [ 'html' => $this->render_product_cards( $ids ) ] ); } public function rest_stock_permission( WP_REST_Request $request ): bool { if ( ! current_user_can( 'edit_storeengine_products' ) ) { return false; } $product_id = (int) $request['id']; if ( $product_id <= 0 ) { return false; } if ( class_exists( '\\StoreEngine\\Addons\\Inventory\\Classes\\Authorization' ) ) { return \StoreEngine\Addons\Inventory\Classes\Authorization::can_modify_product( $product_id ); } // Fallback: privileged roles bypass; everyone else must own the product. if ( current_user_can( 'manage_options' ) ) { return true; } return (int) get_post_field( 'post_author', $product_id ) === (int) get_current_user_id(); } /** * Object-level gate for cross-product code lookups (Barcode Labels resolve). * * The route only checks the broad `edit_storeengine_products` cap, which the * multi-vendor addon grants to EVERY vendor — so on its own it is not a * tenancy boundary. Without this check a vendor could resolve another * seller's product (name / SKU / barcode / price) by guessing a code. Mirror * rest_stock_permission's ownership logic so resolution is scoped to products * the caller may actually edit. */ protected function can_resolve_product( int $product_id ): bool { if ( $product_id <= 0 ) { return false; } if ( class_exists( '\\StoreEngine\\Addons\\Inventory\\Classes\\Authorization' ) ) { return \StoreEngine\Addons\Inventory\Classes\Authorization::can_modify_product( $product_id ); } // Fallback: privileged roles bypass; everyone else must own the product. if ( current_user_can( 'manage_options' ) ) { return true; } return (int) get_post_field( 'post_author', $product_id ) === (int) get_current_user_id(); } public function rest_stock_adjust( \WP_REST_Request $request ) { $product_id = (int) $request['id']; $variation_id = (int) ( $request['variation_id'] ?? 0 ); $action = (string) $request['action']; $quantity = (int) $request['quantity']; $reason = sanitize_text_field( (string) ( $request['reason'] ?? 'manual' ) ); $note = sanitize_textarea_field( (string) ( $request['note'] ?? '' ) ); $result = \StoreEngine\Classes\StockManager::adjust_stock( $product_id, $variation_id, $action, $quantity, $reason, $note ); if ( ! $result['ok'] ) { return new \WP_Error( 'stock_adjust_failed', $result['message'] ?? 'Failed to adjust stock', [ 'status' => 400 ] ); } return new \WP_REST_Response( $result, 200 ); } public function rest_stock_movements( \WP_REST_Request $request ) { $product_id = (int) $request['id']; $variation_id = (int) ( $request['variation_id'] ?? 0 ); $per_page = max( 1, min( 100, (int) ( $request['per_page'] ?? 25 ) ) ); $page = max( 1, (int) ( $request['page'] ?? 1 ) ); $offset = ( $page - 1 ) * $per_page; $rows = \StoreEngine\Classes\StockManager::get_movements( $product_id, $variation_id, $per_page, $offset ); return new \WP_REST_Response( [ 'items' => $rows ], 200 ); } public function extend_product_rest_response( $item, $post, $request ) { $context = $request->get_param( 'context' ); // Defence-in-depth: never expose downloadable-file URLs / attachment ids // in public (view / embed) REST responses. The meta is registered // edit-only (see Database::register_product_meta), so core normally // strips it here already — this guarantees it even if that context filter // is ever bypassed. Files are delivered through a permission-checked // download handler, never this product object. if ( 'edit' !== $context && isset( $item->data['meta']['_storeengine_product_downloadable_files'] ) ) { unset( $item->data['meta']['_storeengine_product_downloadable_files'] ); } $product = Helper::get_product( $item->data['id'] ); $item->data['product_type'] = $product->get_type(); // Admin edit context (product editor, coupon price picker, etc.) must // see frontend-hidden prices so they remain selectable/manageable. $item->data['prices'] = Helper::get_prices_array_by_product_id( $item->data['id'], $context, 'edit' === $context ); $can_see_inventory = current_user_can( 'edit_storeengine_products' ); $item->data['stock'] = self::build_stock_payload( $product, $can_see_inventory ); // Simple-product SKU / barcode. Variable products carry these per- // variant in the `variants` array further down; simple products read // from postmeta (legacy convention also used by inventory queries // and SkuGenerator). if ( 'simple' === $item->data['product_type'] ) { $item->data['sku'] = (string) get_post_meta( $item->data['id'], '_storeengine_sku', true ); $item->data['barcode'] = (string) get_post_meta( $item->data['id'], '_storeengine_barcode', true ); } $item->data['integrations'] = array_map( fn( $integration ) => [ 'id' => $integration->integration->get_id(), 'product_id' => $integration->price->get_product_id(), 'price_id' => $integration->price->get_id(), 'integration_id' => $integration->integration->get_integration_id(), 'provider' => $integration->integration->get_provider(), 'course_ids' => 'storeengine/course-bundle' === $integration->integration->get_provider() ? get_post_meta( $integration->integration->get_integration_id(), 'academy_course_bundle_courses_ids', true ) ?? [] : [], ], Helper::get_integrations_by_product_id( $item->data['id'] ) ); $attributes = []; foreach ( $product->get_attributes() as $taxonomy => $terms ) { $taxonomyKey = Helper::strip_attribute_taxonomy_name( $taxonomy ); $attributes[] = [ 'label' => $taxonomyKey, 'ids' => array_map( fn( $term ) => $term->term_id, $terms ), ]; } $item->data['attributes'] = $attributes; if ( 'bundled' === $item->data['product_type'] ) { $item->data['bundles'] = $product->get_bundles(); } if ( 'variable' === $item->data['product_type'] ) { $item->data['variants'] = array_map( function ( $variant ) use ( $can_see_inventory ) { $data = []; $taxonomies = []; foreach ( $variant->get_attributes() as $attribute ) { if ( ! taxonomy_exists( $attribute->taxonomy ) ) { continue; } $data[] = [ 'label' => get_taxonomy( $attribute->taxonomy )->label, 'value' => $attribute->name, ]; $taxonomies[ Helper::strip_attribute_taxonomy_name( $attribute->taxonomy ) ] = $attribute->term_id; } return [ 'id' => $variant->get_id(), 'taxonomies' => $taxonomies, 'data' => $data, 'featured_image_id' => $variant->get_featured_image(), 'pricing_id' => $variant->get_pricing_id(), 'price' => $variant->get_price(), 'cost_price' => method_exists( $variant, 'get_cost_price' ) ? $variant->get_cost_price() : null, 'sku' => $variant->get_sku(), 'barcode' => method_exists( $variant, 'get_barcode' ) ? $variant->get_barcode() : null, 'stock' => self::build_stock_payload( $variant, $can_see_inventory ), ]; }, $product->get_variants() ); } return $item; } public static function build_stock_payload( $entity, bool $expose_inventory = false ): array { $payload = [ 'manages_stock' => false, 'stock_status' => 'instock', 'is_in_stock' => true, 'low_stock' => false, 'backorders' => 'no', ]; if ( ! is_object( $entity ) ) { return $payload; } if ( method_exists( $entity, 'manages_stock' ) ) { $payload['manages_stock'] = (bool) $entity->manages_stock(); } if ( method_exists( $entity, 'get_stock_status' ) ) { $payload['stock_status'] = $entity->get_stock_status(); } if ( method_exists( $entity, 'is_in_stock' ) ) { $payload['is_in_stock'] = (bool) $entity->is_in_stock(); } if ( method_exists( $entity, 'is_low_stock' ) ) { $payload['low_stock'] = (bool) $entity->is_low_stock(); } if ( method_exists( $entity, 'get_backorders' ) ) { $payload['backorders'] = $entity->get_backorders(); } if ( $expose_inventory ) { if ( method_exists( $entity, 'get_stock_quantity' ) ) { $payload['stock_quantity'] = $entity->get_stock_quantity(); } if ( method_exists( $entity, 'get_low_stock_threshold' ) ) { $payload['low_stock_threshold'] = $entity->get_low_stock_threshold(); } if ( method_exists( $entity, 'is_sold_individually' ) ) { $payload['sold_individually'] = (bool) $entity->is_sold_individually(); } } return $payload; } public function save_product_data( WP_Post $post, WP_REST_Request $request, bool $creating ) { $this->save_attributes( $post, $request ); $this->save_stock_fields( $post, $request ); // @TODO Update price props, this will reduces extra ajax endpoint for saving/creating price // Also, improve ux as adding price will no longer need product id. // Updating custom sort-order. if ( ! $creating ) { $prices = $request->get_param( 'prices' ); if ( ! empty( $prices ) && is_array( $prices ) ) { foreach ( $prices as $index => [ 'id' => $id, 'price_name' => $price_name ] ) { $price = new Price( $id ); $price->set_name( $price_name ); $price->set_order( $index ); $price->save(); } } } } public function save_attributes( WP_Post $post, WP_REST_Request $request ) { // Can be simple, variable, bundled, etc. $old_type = get_post_meta( $post->ID, '_storeengine_product_type', true ); $product_type = $request->get_param( 'product_type' ) ?? 'simple'; $variants = $request->get_param( 'variants' ); $bundles = $request->get_param( 'bundles' ); // Handle variable/variations. if ( 'variable' === $old_type && ( $old_type !== $product_type || empty( $variants ) || ! is_array( $variants ) ) ) { $variants = []; $product_type = 'simple'; $product = new VariableProduct( $post->ID ); foreach ( $product->get_variants() as $variation ) { $variation->delete(); } } if ( $variants && is_array( $variants ) ) { $product_type = 'variable'; $product = new VariableProduct( $post->ID ); $new_variations_data = []; $edit_variations_data = []; foreach ( $variants as $variant ) { if ( ! isset( $variant['taxonomies'] ) || ! is_array( $variant['taxonomies'] ) ) { continue; } if ( isset( $variant['id'] ) ) { $edit_variations_data[ $variant['id'] ] = $variant; } else { $new_variations_data[] = $variant; } } foreach ( $product->get_variants() as $variation ) { if ( isset( $edit_variations_data[ $variation->get_id() ] ) ) { $this->save_variation_data( $variation, $product->get_id(), $edit_variations_data[ $variation->get_id() ] ); } else { $variation->delete(); } } if ( ! empty( $new_variations_data ) ) { foreach ( $new_variations_data as $new_variation_data ) { $this->save_variation_data( new Variation(), $product->get_id(), $new_variation_data ); } } } // Handle product bundles. if ( 'bundled' === $old_type && ( $old_type !== $product_type || empty( $bundles ) || ! is_array( $bundles ) ) ) { $bundles = []; delete_post_meta( $post->ID, '_storeengine_product_bundles' ); $product_type = 'simple'; } if ( $bundles && is_array( $bundles ) ) { $data = []; $prices = []; foreach ( $bundles as $bundle ) { $product_id = absint( $bundle['product_id'] ?? 0 ); $price_id = absint( $bundle['price_id'] ?? 0 ); $quantity = absint( $bundle['quantity'] ?? 1 ); if ( ! $product_id || ! $price_id || ! $quantity ) { continue; } try { $price = new Price( $price_id ); $prices[] = $price->get_price(); $data[] = [ 'product_id' => $price->get_product_id(), 'price_id' => $price->get_id(), 'quantity' => $quantity, ]; } catch ( Throwable $e ) { Helper::log_error( $e ); } } if ( ! empty( $data ) ) { $min_max = array_unique( [ min( $prices ), max( $prices ) ] ); update_post_meta( $post->ID, '_storeengine_product_bundle_max_min_prices', $min_max ); update_post_meta( $post->ID, '_storeengine_product_bundles', $data ); $product_type = 'bundled'; } } if ( $product_type ) { update_post_meta( $post->ID, '_storeengine_product_type', $product_type ); } // Simple-product SKU + barcode. Variable products store these per- // variant inside the variations save loop above; for simple products // we mirror the legacy convention used by inventory queries and the // POS lookup-controller — postmeta keys _storeengine_sku / // _storeengine_barcode. if ( 'simple' === $product_type ) { if ( $request->has_param( 'sku' ) ) { $sku = sanitize_text_field( (string) $request->get_param( 'sku' ) ); if ( '' === $sku ) { delete_post_meta( $post->ID, '_storeengine_sku' ); } else { update_post_meta( $post->ID, '_storeengine_sku', $sku ); } } if ( $request->has_param( 'barcode' ) ) { $barcode = sanitize_text_field( (string) $request->get_param( 'barcode' ) ); if ( '' === $barcode ) { delete_post_meta( $post->ID, '_storeengine_barcode' ); } else { update_post_meta( $post->ID, '_storeengine_barcode', $barcode ); } } // Auto-generate when enabled and the field is still empty. if ( Helper::get_settings( 'auto_generate_sku' ) && '' === (string) get_post_meta( $post->ID, '_storeengine_sku', true ) ) { update_post_meta( $post->ID, '_storeengine_sku', SkuGenerator::generate_sku( [ 'name' => $post->post_title, 'category' => SkuGenerator::product_category_slug( $post->ID ), ] ) ); } if ( Helper::get_settings( 'auto_generate_barcode' ) && '' === (string) get_post_meta( $post->ID, '_storeengine_barcode', true ) ) { update_post_meta( $post->ID, '_storeengine_barcode', SkuGenerator::generate_barcode() ); } } $product = Helper::get_product( $post->ID ); $prices = []; foreach ( $product->get_prices() as $price ) { $prices[] = $price->get_price(); }; if ( $prices ) { $min_max = array_unique( [ min( $prices ), max( $prices ) ] ); update_post_meta( $post->ID, '_storeengine_product_max_min_prices', $min_max ); } $unformatted_attributes = $request->get_param( 'attributes' ); if ( ! is_array( $unformatted_attributes ) ) { return; } $attributes = []; foreach ( $unformatted_attributes as $unformatted_attribute ) { $attributes[ $unformatted_attribute['label'] ] = $unformatted_attribute['ids']; } $unformatted_existence_attributes = $product->get_attributes(); $existence_attributes = []; foreach ( $unformatted_existence_attributes as $taxonomy => $terms ) { $taxonomyKey = Helper::strip_attribute_taxonomy_name( $taxonomy ); $existence_attributes[ $taxonomyKey ] = array_map( fn( $term ) => $term->term_id, $terms ); } if ( $attributes !== $existence_attributes ) { $product->set_attributes_order( array_map( fn( $taxonomy ) => Helper::get_attribute_taxonomy_name( $taxonomy ), array_keys( $attributes ) ) ); foreach ( $attributes as $key => $value ) { wp_set_object_terms( $post->ID, array_map( fn( $val ) => (int) sanitize_text_field( $val ), $value ), Helper::get_attribute_taxonomy_name( sanitize_text_field( $key ) ) ); } // Update the order. $update_values = []; $update_cases = []; foreach ( $attributes as $taxonomy => $terms ) { foreach ( $terms as $order => $term_id ) { $update_cases[] = "WHEN tr.term_taxonomy_id = $term_id THEN $order"; $update_values[] = $term_id; } } // Execute bulk UPDATE if there are items to update if ( ! empty( $update_cases ) ) { global $wpdb; $update_query = "UPDATE {$wpdb->term_relationships} tr INNER JOIN {$wpdb->term_taxonomy} tt ON tr.term_taxonomy_id = tt.term_taxonomy_id SET tr.term_order = CASE " . implode( ' ', $update_cases ) . ' END WHERE tr.object_id = %d AND tr.term_taxonomy_id IN (' . implode( ',', array_fill( 0, count( $update_values ), '%d' ) ) . ')'; // phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared $wpdb->query( $wpdb->prepare( $update_query, $post->ID, ...$update_values ) ); // phpcs:enable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared } wp_cache_flush_group( AbstractProduct::CACHE_GROUP ); } } private function save_stock_fields( WP_Post $post, WP_REST_Request $request ) { $stock = $request->get_param( 'stock' ); if ( ! is_array( $stock ) ) { return; } $old_status = get_post_meta( $post->ID, '_storeengine_stock_status', true ); if ( array_key_exists( 'manages_stock', $stock ) ) { update_post_meta( $post->ID, '_storeengine_manage_stock', (bool) $stock['manages_stock'] ); } if ( array_key_exists( 'stock_quantity', $stock ) ) { $qty = $stock['stock_quantity']; if ( '' === $qty || null === $qty ) { delete_post_meta( $post->ID, '_storeengine_stock_quantity' ); } else { update_post_meta( $post->ID, '_storeengine_stock_quantity', (int) $qty ); } } if ( array_key_exists( 'stock_status', $stock ) ) { $status = sanitize_text_field( $stock['stock_status'] ); if ( in_array( $status, [ 'instock', 'outofstock', 'onbackorder' ], true ) ) { update_post_meta( $post->ID, '_storeengine_stock_status', $status ); } } if ( array_key_exists( 'backorders', $stock ) ) { $backorders = sanitize_text_field( $stock['backorders'] ); if ( in_array( $backorders, [ 'no', 'notify', 'yes' ], true ) ) { update_post_meta( $post->ID, '_storeengine_backorders', $backorders ); } } if ( array_key_exists( 'low_stock_threshold', $stock ) ) { $threshold = $stock['low_stock_threshold']; if ( '' === $threshold || null === $threshold ) { delete_post_meta( $post->ID, '_storeengine_low_stock_threshold' ); } else { update_post_meta( $post->ID, '_storeengine_low_stock_threshold', (int) $threshold ); } } if ( array_key_exists( 'sold_individually', $stock ) ) { update_post_meta( $post->ID, '_storeengine_sold_individually', (bool) $stock['sold_individually'] ); } // Sync stock_status from stock_quantity when manage_stock=true. $manage_stock = (bool) get_post_meta( $post->ID, '_storeengine_manage_stock', true ); if ( $manage_stock ) { $qty = (int) get_post_meta( $post->ID, '_storeengine_stock_quantity', true ); $backorders = get_post_meta( $post->ID, '_storeengine_backorders', true ) ?: 'no'; $allowed = in_array( $backorders, [ 'yes', 'notify' ], true ); if ( $qty <= 0 && ! $allowed ) { $new_status = 'outofstock'; } elseif ( $qty <= 0 && $allowed ) { $new_status = 'onbackorder'; } else { $new_status = 'instock'; } update_post_meta( $post->ID, '_storeengine_stock_status', $new_status ); if ( $old_status && $old_status !== $new_status ) { do_action( 'storeengine/stock_status_changed', $post->ID, 0, $old_status, $new_status ); } } elseif ( $old_status ) { $current_status = get_post_meta( $post->ID, '_storeengine_stock_status', true ); if ( $current_status && $current_status !== $old_status ) { do_action( 'storeengine/stock_status_changed', $post->ID, 0, $old_status, $current_status ); } } // Mirror simple-product aggregate qty into per-location stock at the // default location when the inventory-pro addon is on. Listener: // `storeengine/inventory/stock_quantity_set` action. if ( $manage_stock ) { $qty_for_mirror = (int) get_post_meta( $post->ID, '_storeengine_stock_quantity', true ); /** * @see Variation::save() — same hook fires from variation saves. */ do_action( 'storeengine/inventory/stock_quantity_set', (int) $post->ID, 0, $qty_for_mirror, 'editor' ); } } private function save_variation_data( Variation $variation, int $product_id, array $data ) { $variation->set_product_id( $product_id ); $price = isset( $data['price'] ) && is_numeric( $data['price'] ) ? (float) sanitize_text_field( $data['price'] ) : null; $variation->set_price( $price ); $pricing_id = (int) sanitize_text_field( $data['pricing_id'] ?? 0 ); $variation->set_price_id( $pricing_id > 0 ? $pricing_id : null ); $featured_image_id = (int) sanitize_text_field( $data['featured_image_id'] ?? 0 ); $variation->set_featured_image( $featured_image_id > 0 ? $featured_image_id : null ); $variation->set_sku( sanitize_text_field( $data['sku'] ) ); if ( array_key_exists( 'barcode', $data ) ) { $barcode = $data['barcode']; $variation->set_barcode( ( null === $barcode || '' === $barcode ) ? null : sanitize_text_field( (string) $barcode ) ); } if ( array_key_exists( 'cost_price', $data ) ) { $cost = $data['cost_price']; $variation->set_cost_price( ( '' === $cost || null === $cost ) ? null : (float) $cost ); } $term_ids = array_map( fn( $term_id ) => (int) sanitize_text_field( $term_id ), $data['taxonomies'] ); $term_ids = array_values( $term_ids ); $variation->set_attributes( $term_ids ); $stock = $data['stock'] ?? []; $old_status = method_exists( $variation, 'get_stock_status' ) ? $variation->get_stock_status() : null; if ( is_array( $stock ) ) { if ( array_key_exists( 'manages_stock', $stock ) ) { $variation->set_manage_stock( (bool) $stock['manages_stock'] ); } if ( array_key_exists( 'stock_quantity', $stock ) ) { $qty = $stock['stock_quantity']; $variation->set_stock_quantity( ( '' === $qty || null === $qty ) ? null : (int) $qty ); } if ( array_key_exists( 'backorders', $stock ) ) { $variation->set_backorders( sanitize_text_field( $stock['backorders'] ) ); } if ( array_key_exists( 'low_stock_threshold', $stock ) ) { $threshold = $stock['low_stock_threshold']; $variation->set_low_stock_threshold( ( '' === $threshold || null === $threshold ) ? null : (int) $threshold ); } $manage_stock_now = isset( $stock['manages_stock'] ) ? (bool) $stock['manages_stock'] : $variation->manages_stock(); if ( $manage_stock_now ) { $qty_now = isset( $stock['stock_quantity'] ) ? (int) $stock['stock_quantity'] : (int) $variation->get_stock_quantity(); $backorders = isset( $stock['backorders'] ) ? sanitize_text_field( $stock['backorders'] ) : $variation->get_backorders(); $allowed = in_array( $backorders, [ 'yes', 'notify' ], true ); if ( $qty_now <= 0 && ! $allowed ) { $new_status = 'outofstock'; } elseif ( $qty_now <= 0 && $allowed ) { $new_status = 'onbackorder'; } else { $new_status = 'instock'; } $variation->new_data_set_stock_status( $new_status ); } elseif ( array_key_exists( 'stock_status', $stock ) ) { $status = sanitize_text_field( $stock['stock_status'] ); if ( in_array( $status, [ 'instock', 'outofstock', 'onbackorder' ], true ) ) { $variation->new_data_set_stock_status( $status ); } } } // Auto-generate SKU/barcode for this variation when enabled and empty. if ( '' === (string) $variation->get_sku() && Helper::get_settings( 'auto_generate_sku' ) ) { $variation->set_sku( SkuGenerator::generate_sku( [ 'name' => get_the_title( $product_id ), 'category' => SkuGenerator::product_category_slug( $product_id ), ] ) ); } if ( ! $variation->get_barcode() && Helper::get_settings( 'auto_generate_barcode' ) ) { $variation->set_barcode( SkuGenerator::generate_barcode() ); } $variation->save(); if ( $old_status && method_exists( $variation, 'get_stock_status' ) ) { $new_status_after_save = $variation->get_stock_status(); if ( $new_status_after_save !== $old_status ) { do_action( 'storeengine/stock_status_changed', $product_id, $variation->get_id(), $old_status, $new_status_after_save ); } } } } ```