CheckoutRestServiceProvider.php — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 3.0.3

surecart / app / src / Rest / CheckoutRestServiceProvider.php

surecart / app / src / Rest Last commit date

CheckoutRestServiceProvider.php

351 lines

1	<?php
2
3	namespace SureCart\Rest;
4
5	use SureCart\Rest\RestServiceInterface;
6	use SureCart\Controllers\Rest\CheckoutsController;
7	use SureCart\Form\FormValidationService;
8	use SureCart\Models\User;
9
10	/**
11	* Service provider for Price Rest Requests
12	*/
13	class CheckoutRestServiceProvider extends RestServiceProvider implements RestServiceInterface {
14	/**
15	* Endpoint.
16	*
17	* @var string
18	*/
19	protected $endpoint = 'checkouts';
20
21	/**
22	* Rest Controller
23	*
24	* @var string
25	*/
26	protected $controller = CheckoutsController::class;
27
28	/**
29	* Methods allowed for the model.
30	*
31	* @var array
32	*/
33	protected $methods = array( 'index', 'create', 'find', 'edit' );
34
35	/**
36	* Register Additional REST Routes
37	*
38	* @return void
39	*/
40	public function registerRoutes() {
41	register_rest_route(
42	"$this->name/v$this->version",
43	$this->endpoint . '/(?P<id>\S+)/finalize/',
44	array(
45	array(
46	'methods' => \WP_REST_Server::EDITABLE,
47	'callback' => $this->callback( $this->controller, 'finalize' ),
48	'permission_callback' => array( $this, 'finalize_permissions_check' ),
49	),
50	// Register our schema callback.
51	'schema' => array( $this, 'get_item_schema' ),
52	)
53	);
54	register_rest_route(
55	"$this->name/v$this->version",
56	$this->endpoint . '/(?P<id>\S+)/confirm/',
57	array(
58	array(
59	'methods' => \WP_REST_Server::EDITABLE,
60	'callback' => $this->callback( $this->controller, 'confirm' ),
61	'permission_callback' => array( $this, 'confirm_permissions_check' ),
62	),
63	// Register our schema callback.
64	'schema' => array( $this, 'get_item_schema' ),
65	)
66	);
67	register_rest_route(
68	"$this->name/v$this->version",
69	$this->endpoint . '/(?P<id>\S+)/manually_pay/',
70	array(
71	array(
72	'methods' => \WP_REST_Server::EDITABLE,
73	'callback' => $this->callback( $this->controller, 'manuallyPay' ),
74	'permission_callback' => array( $this, 'manually_pay_permissions_check' ),
75	),
76	// Register our schema callback.
77	'schema' => array( $this, 'get_item_schema' ),
78	)
79	);
80	register_rest_route(
81	"$this->name/v$this->version",
82	$this->endpoint . '/(?P<id>\S+)/cancel/',
83	array(
84	array(
85	'methods' => \WP_REST_Server::EDITABLE,
86	'callback' => $this->callback( $this->controller, 'cancel' ),
87	'permission_callback' => array( $this, 'cancel_item_permissions_check' ),
88	),
89	// Register our schema callback.
90	'schema' => array( $this, 'get_item_schema' ),
91	)
92	);
93	register_rest_route(
94	"$this->name/v$this->version",
95	$this->endpoint . '/(?P<id>\S+)/offer_bump/(?P<bump_id>\S+)',
96	array(
97	array(
98	'methods' => \WP_REST_Server::EDITABLE,
99	'callback' => $this->callback( $this->controller, 'offerBump' ),
100	'permission_callback' => array( $this, 'update_item_permissions_check' ),
101	),
102	// Register our schema callback.
103	'schema' => array( $this, 'get_item_schema' ),
104	)
105	);
106	register_rest_route(
107	"$this->name/v$this->version",
108	$this->endpoint . '/(?P<id>\S+)/offer_upsell/(?P<upsell_id>\S+)',
109	array(
110	array(
111	'methods' => \WP_REST_Server::EDITABLE,
112	'callback' => $this->callback( $this->controller, 'offerUpsell' ),
113	'permission_callback' => array( $this, 'update_item_permissions_check' ),
114	),
115	// Register our schema callback.
116	'schema' => array( $this, 'get_item_schema' ),
117	)
118	);
119	register_rest_route(
120	"$this->name/v$this->version",
121	$this->endpoint . '/(?P<id>\S+)/decline_upsell/(?P<upsell_id>\S+)',
122	array(
123	array(
124	'methods' => \WP_REST_Server::EDITABLE,
125	'callback' => $this->callback( $this->controller, 'declineUpsell' ),
126	'permission_callback' => array( $this, 'update_item_permissions_check' ),
127	),
128	// Register our schema callback.
129	'schema' => array( $this, 'get_item_schema' ),
130	)
131	);
132	}
133
134	/**
135	* Get our sample schema for a post.
136	*
137	* @return array The sample schema for a post
138	*/
139	public function get_item_schema() {
140	if ( $this->schema ) {
141	// Since WordPress 5.3, the schema can be cached in the $schema property.
142	return $this->schema;
143	}
144
145	$this->schema = array(
146	// This tells the spec of JSON Schema we are using which is draft 4.
147	'$schema' => 'http://json-schema.org/draft-04/schema#',
148	// The title property marks the identity of the resource.
149	'title' => $this->endpoint,
150	'type' => 'object',
151	// In JSON Schema you can specify object properties in the properties attribute.
152	'properties' => array(
153	'id' => array(
154	'description' => esc_html__( 'Unique identifier for the object.', 'surecart' ),
155	'type' => 'string',
156	'context' => array( 'view', 'edit', 'embed' ),
157	'readonly' => true,
158	),
159	'currency' => array(
160	'description' => esc_html__( 'The currency for the session.', 'surecart' ),
161	'type' => 'string',
162	),
163	'metadata' => array(
164	'description' => esc_html__( 'Metadata for the order.', 'surecart' ),
165	'type' => 'object',
166	// 'context' => [ 'edit' ],
167	),
168	'customer_id' => array(
169	'description' => esc_html__( 'The customer id for the order.', 'surecart' ),
170	'type' => 'string',
171	'context' => array( 'edit' ),
172	),
173	'customer' => array(
174	'description' => esc_html__( 'The customer for the session.', 'surecart' ),
175	'type' => 'object',
176	'context' => array( 'edit' ),
177	),
178	'line_items' => array(
179	'description' => esc_html__( 'The line items for the session.', 'surecart' ),
180	'type' => 'object',
181	),
182	'discount' => array(
183	'description' => esc_html__( 'The discount for the session.', 'surecart' ),
184	'type' => 'object',
185	),
186	),
187	);
188
189	return $this->schema;
190	}
191
192	/**
193	* Finalizing an order requires some server side form validation.
194	*
195	* @param \WP_REST_Request $request Full details about the request.
196	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
197	*/
198	public function finalize_permissions_check( \WP_REST_Request $request ) {
199	if ( empty( $request['live_mode'] ) ) {
200	if ( current_user_can( 'edit_sc_checkouts' ) ) {
201	return true;
202	}
203	if ( empty( \SureCart::settings()->get( 'unrestricted_test_mode' ) ) ) {
204	$errors = new \WP_Error( 'test_mode_restricted', esc_html__( 'Test order successful, but not processed.', 'surecart' ), [ 'status' => 403 ] );
205	$errors->add( 'test_mode_restricted', esc_html__( 'This is a test checkout. No orders were processed. Please contact the store administrator for more information.', 'surecart' ), [ 'status' => 403 ] );
206	return $errors;
207	}
208	}
209
210	// form id or a product id is required.
211	if ( empty( $request['form_id'] ) && empty( $request['product_id'] ) ) {
212	return new \WP_Error( 'form_id_required', esc_html__( 'Form ID is required.', 'surecart' ), array( 'status' => 400 ) );
213	}
214
215	// get form.
216	if ( ! empty( $request['form_id'] ) ) {
217	$form = get_post( $request['form_id'] );
218	if ( ! $form \|\| 'sc_form' !== $form->post_type ) {
219	return new \WP_Error( 'form_id_invalid', esc_html__( 'Form ID is invalid.', 'surecart' ), array( 'status' => 400 ) );
220	}
221	// validate form input based on saved form content.
222	$validator = new FormValidationService( $form->post_content, $request->get_body_params() );
223	$validated = $validator->validate();
224	if ( is_wp_error( $validated ) ) {
225	return $validated;
226	}
227	}
228
229	return true;
230	}
231
232	/**
233	* Confirming an order was paid for.
234	*
235	* @param \WP_REST_Request $request Full details about the request.
236	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
237	*/
238	public function confirm_permissions_check( \WP_REST_Request $request ) {
239	return $this->get_item_permissions_check( $request );
240	}
241
242	/**
243	* Filters a response based on the context defined in the schema.
244	*
245	* @since 4.7.0
246	*
247	* @param array\|\WP_REST_Response $data Response data to filter.
248	* @param string $context Context defined in the schema.
249	* @return array Filtered response.
250	*/
251	public function filter_response_by_context( $data, $context ) {
252	$schema = $this->get_item_schema();
253
254	// if the user can edit customers, show the edit context.
255	if ( current_user_can( 'edit_sc_customers' ) ) {
256	return rest_filter_response_by_context( $data, $schema, 'edit' );
257	}
258
259	$data = is_a( $data, 'WP_REST_Response' ) ? $data->get_data() : $data;
260
261	// if the user is logged in, and we have customer data.
262	// if it matches the current customer, then we can show the edit context.
263	if ( is_user_logged_in() && ! empty( $data['customer'] ) ) {
264	$customer_id = ! empty( $data['customer']['id'] ) ? $data['customer']['id'] : $data['customer'];
265	if ( User::current()->customerId() === $customer_id ) {
266	return rest_filter_response_by_context( $data, $schema, 'edit' );
267	}
268	}
269
270	return rest_filter_response_by_context( $data, $schema, 'view' );
271	}
272
273
274	/**
275	* Anyone can get a specific order if they have the unique order id.
276	*
277	* @param \WP_REST_Request $request Full details about the request.
278	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
279	*/
280	public function get_item_permissions_check( $request ) {
281	return true;
282	}
283
284	/**
285	* Listing
286	*
287	* @param \WP_REST_Request $request Full details about the request.
288	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
289	*/
290	public function get_items_permissions_check( $request ) {
291	return current_user_can( 'read_sc_checkouts', $request->get_params() );
292	}
293
294	/**
295	* Anyone can create.
296	*
297	* @param \WP_REST_Request $request Full details about the request.
298	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
299	*/
300	public function create_item_permissions_check( $request ) {
301	if ( ! empty( $request['tax_behavior'] ) ) {
302	return current_user_can( 'edit_sc_checkouts' );
303	}
304	return true;
305	}
306
307	/**
308	* Update permissions.
309	*
310	* @param \WP_REST_Request $request Full details about the request.
311	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
312	*/
313	public function update_item_permissions_check( $request ) {
314	if ( ! empty( $request['tax_behavior'] ) ) {
315	return current_user_can( 'edit_sc_checkouts' );
316	}
317	return true;
318	}
319
320	/**
321	* Nobody can delete.
322	*
323	* @param \WP_REST_Request $request Full details about the request.
324	* @return false
325	*/
326	public function delete_item_permissions_check( $request ) {
327	return false;
328	}
329
330	/**
331	* Can the user manually mark the checkout as paid?
332	*
333	* @param \WP_REST_Request $request Full details about the request.
334	*
335	* @return boolean
336	*/
337	public function manually_pay_permissions_check( $request ) {
338	return current_user_can( 'edit_sc_checkouts' );
339	}
340
341	/**
342	* Cancelling orders.
343	*
344	* @param \WP_REST_Request $request Full details about the request.
345	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
346	*/
347	public function cancel_item_permissions_check( $request ) {
348	return current_user_can( 'edit_sc_orders' );
349	}
350	}
351