BatchesRestServiceProvider.php — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 4.5.0

surecart / app / src / Rest / BatchesRestServiceProvider.php

surecart / app / src / Rest Last commit date

BatchesRestServiceProvider.php

226 lines

1	<?php
2
3	namespace SureCart\Rest;
4
5	use SureCart\Rest\RestServiceInterface;
6	use SureCart\Controllers\Rest\BatchesController;
7
8	/**
9	* Batches REST service provider.
10	*/
11	class BatchesRestServiceProvider extends RestServiceProvider implements RestServiceInterface {
12	/**
13	* Endpoint.
14	*
15	* @var string
16	*/
17	protected $endpoint = 'batches';
18
19	/**
20	* Rest Controller.
21	*
22	* @var string
23	*/
24	protected $controller = BatchesController::class;
25
26	/**
27	* Batches are append-only — submit, then poll for status.
28	*
29	* @var array
30	*/
31	protected $methods = [ 'index', 'create', 'find' ];
32
33	/**
34	* Schema callback.
35	*
36	* @return array
37	*/
38	public function get_item_schema() {
39	if ( $this->schema ) {
40	return $this->schema;
41	}
42
43	$this->schema = [
44	'$schema' => 'http://json-schema.org/draft-04/schema#',
45	'title' => $this->endpoint,
46	'type' => 'object',
47	'properties' => [
48	'id' => [
49	'description' => __( 'UUID of the batch.', 'surecart' ),
50	'type' => 'string',
51	'context' => [ 'view', 'edit', 'embed' ],
52	'readonly' => true,
53	],
54	'status' => [
55	'description' => __( 'pending \| in_progress \| completed', 'surecart' ),
56	'type' => 'string',
57	'readonly' => true,
58	],
59	'batch_operations_count' => [
60	'description' => __( 'Total operations in this batch.', 'surecart' ),
61	'type' => 'integer',
62	'readonly' => true,
63	],
64	'finished_batch_operations_count' => [
65	'description' => __( 'Operations that have finished (completed, failed, or timed out).', 'surecart' ),
66	'type' => 'integer',
67	'readonly' => true,
68	],
69	'batch_operations' => [
70	'description' => __( 'Operations to execute as part of this batch.', 'surecart' ),
71	'type' => 'array',
72	'items' => [
73	'type' => 'object',
74	'properties' => [
75	'http_method' => [ 'type' => 'string' ],
76	'path' => [ 'type' => 'string' ],
77	'body' => [ 'type' => 'object' ],
78	],
79	],
80	],
81	],
82	];
83
84	return $this->schema;
85	}
86
87	/**
88	* Collection params.
89	*
90	* @return array
91	*/
92	public function get_collection_params() {
93	return [
94	'page' => [
95	'description' => __( 'Page of items returned.', 'surecart' ),
96	'type' => 'integer',
97	],
98	'per_page' => [
99	'description' => __( 'Items per page (1-100).', 'surecart' ),
100	'type' => 'integer',
101	],
102	];
103	}
104
105	/**
106	* Resource segment → capability suffix. New resources must be listed here
107	* before they can be batched; unknown paths are rejected.
108	*
109	* @var array<string, string>
110	*/
111	private const RESOURCE_CAP_SUFFIX = [
112	'products' => 'sc_products',
113	'product_collections' => 'sc_products',
114	'product_groups' => 'sc_products',
115	'prices' => 'sc_prices',
116	'reviews' => 'sc_reviews',
117	'orders' => 'sc_orders',
118	'customers' => 'sc_customers',
119	'subscriptions' => 'sc_subscriptions',
120	'invoices' => 'sc_invoices',
121	'coupons' => 'sc_coupons',
122	'promotions' => 'sc_promotions',
123	'affiliations' => 'sc_affiliates',
124	'licenses' => 'sc_licenses',
125	'webhooks' => 'sc_webhooks',
126	'medias' => 'sc_medias',
127	];
128
129	public function get_items_permissions_check( $request ) {
130	return $this->userCanUseBatches();
131	}
132
133	public function get_item_permissions_check( $request ) {
134	return $this->userCanUseBatches();
135	}
136
137	/**
138	* Validates every operation against the cap the caller would have needed
139	* to perform it directly — otherwise a user with `edit_sc_products` could
140	* smuggle `DELETE /v1/customers/{id}` through the batch proxy.
141	*/
142	public function create_item_permissions_check( $request ) {
143	if ( ! $this->userCanUseBatches() ) {
144	return new \WP_Error(
145	'rest_forbidden',
146	__( 'You are not allowed to use the batch endpoint.', 'surecart' ),
147	[ 'status' => 403 ]
148	);
149	}
150
151	$operations = $request->get_param( 'batch_operations' );
152	if ( empty( $operations ) \|\| ! is_array( $operations ) ) {
153	return new \WP_Error(
154	'rest_invalid_param',
155	__( 'A batch must contain at least one operation.', 'surecart' ),
156	[ 'status' => 400 ]
157	);
158	}
159
160	foreach ( $operations as $op ) {
161	$cap = $this->requiredCapabilityFor(
162	$op['http_method'] ?? '',
163	$op['path'] ?? ''
164	);
165	if ( ! $cap ) {
166	return new \WP_Error(
167	'rest_forbidden',
168	__( 'Unsupported operation in batch.', 'surecart' ),
169	[ 'status' => 403 ]
170	);
171	}
172	if ( ! current_user_can( $cap ) ) {
173	return new \WP_Error(
174	'rest_forbidden',
175	__( 'You are not allowed to perform one or more operations in this batch.', 'surecart' ),
176	[ 'status' => 403 ]
177	);
178	}
179	}
180
181	return true;
182	}
183
184	/**
185	* Coarse gate for read-side endpoints; create_item enforces per-op auth.
186	*
187	* @return bool
188	*/
189	private function userCanUseBatches(): bool {
190	foreach ( self::RESOURCE_CAP_SUFFIX as $suffix ) {
191	if ( current_user_can( 'edit_' . $suffix ) ) {
192	return true;
193	}
194	}
195	return false;
196	}
197
198	/**
199	* Returns null for unknown paths — callers treat null as deny.
200	*
201	* @param string $http_method GET, POST, PATCH, PUT, DELETE.
202	* @param string $path e.g. `/v1/products/abc`.
203	* @return string\|null
204	*/
205	private function requiredCapabilityFor( string $http_method, string $path ): ?string {
206	if ( ! preg_match( '#^/v1/([a-z_]+)#i', $path, $matches ) ) {
207	return null;
208	}
209	$resource = strtolower( $matches[1] );
210	$suffix = self::RESOURCE_CAP_SUFFIX[ $resource ] ?? null;
211	if ( ! $suffix ) {
212	return null;
213	}
214
215	$verb = strtoupper( $http_method );
216	if ( 'GET' === $verb ) {
217	return 'read_' . $suffix;
218	}
219	if ( 'DELETE' === $verb ) {
220	return 'delete_' . $suffix;
221	}
222
223	return 'edit_' . $suffix;
224	}
225	}
226