CheckoutRestServiceProvider.php — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 4.5.0

surecart / app / src / Rest / CheckoutRestServiceProvider.php

surecart / app / src / Rest Last commit date

CheckoutRestServiceProvider.php

358 lines

1	<?php
2
3	namespace SureCart\Rest;
4
5	use SureCart\Rest\RestServiceInterface;
6	use SureCart\Controllers\Rest\CheckoutsController;
7	use SureCart\Form\FormValidationService;
8	use SureCart\Models\User;
9
10	/**
11	* Service provider for Price Rest Requests
12	*/
13	class CheckoutRestServiceProvider extends RestServiceProvider implements RestServiceInterface {
14	/**
15	* Endpoint.
16	*
17	* @var string
18	*/
19	protected $endpoint = 'checkouts';
20
21	/**
22	* Rest Controller
23	*
24	* @var string
25	*/
26	protected $controller = CheckoutsController::class;
27
28	/**
29	* Whether the rest service provider converts currency.
30	*
31	* @var boolean
32	*/
33	protected $converts_currency = true;
34
35	/**
36	* Methods allowed for the model.
37	*
38	* @var array
39	*/
40	protected $methods = array( 'index', 'create', 'find', 'edit' );
41
42	/**
43	* Register Additional REST Routes
44	*
45	* @return void
46	*/
47	public function registerRoutes() {
48	register_rest_route(
49	"$this->name/v$this->version",
50	$this->endpoint . '/(?P<id>\S+)/finalize/',
51	array(
52	array(
53	'methods' => \WP_REST_Server::EDITABLE,
54	'callback' => $this->callback( $this->controller, 'finalize' ),
55	'permission_callback' => array( $this, 'finalize_permissions_check' ),
56	),
57	// Register our schema callback.
58	'schema' => array( $this, 'get_item_schema' ),
59	)
60	);
61	register_rest_route(
62	"$this->name/v$this->version",
63	$this->endpoint . '/(?P<id>\S+)/confirm/',
64	array(
65	array(
66	'methods' => \WP_REST_Server::EDITABLE,
67	'callback' => $this->callback( $this->controller, 'confirm' ),
68	'permission_callback' => array( $this, 'confirm_permissions_check' ),
69	),
70	// Register our schema callback.
71	'schema' => array( $this, 'get_item_schema' ),
72	)
73	);
74	register_rest_route(
75	"$this->name/v$this->version",
76	$this->endpoint . '/(?P<id>\S+)/manually_pay/',
77	array(
78	array(
79	'methods' => \WP_REST_Server::EDITABLE,
80	'callback' => $this->callback( $this->controller, 'manuallyPay' ),
81	'permission_callback' => array( $this, 'manually_pay_permissions_check' ),
82	),
83	// Register our schema callback.
84	'schema' => array( $this, 'get_item_schema' ),
85	)
86	);
87	register_rest_route(
88	"$this->name/v$this->version",
89	$this->endpoint . '/(?P<id>\S+)/cancel/',
90	array(
91	array(
92	'methods' => \WP_REST_Server::EDITABLE,
93	'callback' => $this->callback( $this->controller, 'cancel' ),
94	'permission_callback' => array( $this, 'cancel_item_permissions_check' ),
95	),
96	// Register our schema callback.
97	'schema' => array( $this, 'get_item_schema' ),
98	)
99	);
100	register_rest_route(
101	"$this->name/v$this->version",
102	$this->endpoint . '/(?P<id>\S+)/offer_bump/(?P<bump_id>\S+)',
103	array(
104	array(
105	'methods' => \WP_REST_Server::EDITABLE,
106	'callback' => $this->callback( $this->controller, 'offerBump' ),
107	'permission_callback' => array( $this, 'update_item_permissions_check' ),
108	),
109	// Register our schema callback.
110	'schema' => array( $this, 'get_item_schema' ),
111	)
112	);
113	register_rest_route(
114	"$this->name/v$this->version",
115	$this->endpoint . '/(?P<id>\S+)/offer_upsell/(?P<upsell_id>\S+)',
116	array(
117	array(
118	'methods' => \WP_REST_Server::EDITABLE,
119	'callback' => $this->callback( $this->controller, 'offerUpsell' ),
120	'permission_callback' => array( $this, 'update_item_permissions_check' ),
121	),
122	// Register our schema callback.
123	'schema' => array( $this, 'get_item_schema' ),
124	)
125	);
126	register_rest_route(
127	"$this->name/v$this->version",
128	$this->endpoint . '/(?P<id>\S+)/decline_upsell/(?P<upsell_id>\S+)',
129	array(
130	array(
131	'methods' => \WP_REST_Server::EDITABLE,
132	'callback' => $this->callback( $this->controller, 'declineUpsell' ),
133	'permission_callback' => array( $this, 'update_item_permissions_check' ),
134	),
135	// Register our schema callback.
136	'schema' => array( $this, 'get_item_schema' ),
137	)
138	);
139	}
140
141	/**
142	* Get our sample schema for a post.
143	*
144	* @return array The sample schema for a post
145	*/
146	public function get_item_schema() {
147	if ( $this->schema ) {
148	// Since WordPress 5.3, the schema can be cached in the $schema property.
149	return $this->schema;
150	}
151
152	$this->schema = array(
153	// This tells the spec of JSON Schema we are using which is draft 4.
154	'$schema' => 'http://json-schema.org/draft-04/schema#',
155	// The title property marks the identity of the resource.
156	'title' => $this->endpoint,
157	'type' => 'object',
158	// In JSON Schema you can specify object properties in the properties attribute.
159	'properties' => array(
160	'id' => array(
161	'description' => esc_html__( 'Unique identifier for the object.', 'surecart' ),
162	'type' => 'string',
163	'context' => array( 'view', 'edit', 'embed' ),
164	'readonly' => true,
165	),
166	'currency' => array(
167	'description' => esc_html__( 'The currency for the session.', 'surecart' ),
168	'type' => 'string',
169	),
170	'metadata' => array(
171	'description' => esc_html__( 'Metadata for the order.', 'surecart' ),
172	'type' => 'object',
173	// 'context' => [ 'edit' ],
174	),
175	'customer_id' => array(
176	'description' => esc_html__( 'The customer id for the order.', 'surecart' ),
177	'type' => 'string',
178	'context' => array( 'edit' ),
179	),
180	'customer' => array(
181	'description' => esc_html__( 'The customer for the session.', 'surecart' ),
182	'type' => 'object',
183	'context' => array( 'edit' ),
184	),
185	'line_items' => array(
186	'description' => esc_html__( 'The line items for the session.', 'surecart' ),
187	'type' => 'object',
188	),
189	'discount' => array(
190	'description' => esc_html__( 'The discount for the session.', 'surecart' ),
191	'type' => 'object',
192	),
193	),
194	);
195
196	return $this->schema;
197	}
198
199	/**
200	* Finalizing an order requires some server side form validation.
201	*
202	* @param \WP_REST_Request $request Full details about the request.
203	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
204	*/
205	public function finalize_permissions_check( \WP_REST_Request $request ) {
206	if ( empty( $request['live_mode'] ) ) {
207	if ( current_user_can( 'edit_sc_checkouts' ) ) {
208	return true;
209	}
210	if ( empty( \SureCart::settings()->get( 'unrestricted_test_mode' ) ) ) {
211	$errors = new \WP_Error( 'test_mode_restricted', esc_html__( 'Test order successful, but not processed.', 'surecart' ), [ 'status' => 403 ] );
212	$errors->add( 'test_mode_restricted', esc_html__( 'This is a test checkout. No orders were processed. Please contact the store administrator for more information.', 'surecart' ), [ 'status' => 403 ] );
213	return $errors;
214	}
215	}
216
217	// form id or a product id is required.
218	if ( empty( $request['form_id'] ) && empty( $request['product_id'] ) ) {
219	return new \WP_Error( 'form_id_required', esc_html__( 'Form ID is required.', 'surecart' ), array( 'status' => 400 ) );
220	}
221
222	// get form.
223	if ( ! empty( $request['form_id'] ) ) {
224	$form = get_post( $request['form_id'] );
225	if ( ! $form \|\| 'sc_form' !== $form->post_type ) {
226	return new \WP_Error( 'form_id_invalid', esc_html__( 'Form ID is invalid.', 'surecart' ), array( 'status' => 400 ) );
227	}
228	// validate form input based on saved form content.
229	$validator = new FormValidationService( $form->post_content, $request->get_body_params() );
230	$validated = $validator->validate();
231	if ( is_wp_error( $validated ) ) {
232	return $validated;
233	}
234	}
235
236	return true;
237	}
238
239	/**
240	* Confirming an order was paid for.
241	*
242	* @param \WP_REST_Request $request Full details about the request.
243	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
244	*/
245	public function confirm_permissions_check( \WP_REST_Request $request ) {
246	return $this->get_item_permissions_check( $request );
247	}
248
249	/**
250	* Filters a response based on the context defined in the schema.
251	*
252	* @since 4.7.0
253	*
254	* @param array\|\WP_REST_Response $data Response data to filter.
255	* @param string $context Context defined in the schema.
256	* @return array Filtered response.
257	*/
258	public function filter_response_by_context( $data, $context ) {
259	$schema = $this->get_item_schema();
260
261	// if the user can edit customers, show the edit context.
262	if ( current_user_can( 'edit_sc_customers' ) ) {
263	return rest_filter_response_by_context( $data, $schema, 'edit' );
264	}
265
266	$data = is_a( $data, 'WP_REST_Response' ) ? $data->get_data() : $data;
267
268	// if the user is logged in, and we have customer data.
269	// if it matches the current customer, then we can show the edit context.
270	if ( is_user_logged_in() && ! empty( $data['customer'] ) ) {
271	$customer_id = ! empty( $data['customer']['id'] ) ? $data['customer']['id'] : $data['customer'];
272	if ( User::current()->customerId() === $customer_id ) {
273	return rest_filter_response_by_context( $data, $schema, 'edit' );
274	}
275	}
276
277	return rest_filter_response_by_context( $data, $schema, 'view' );
278	}
279
280
281	/**
282	* Anyone can get a specific order if they have the unique order id.
283	*
284	* @param \WP_REST_Request $request Full details about the request.
285	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
286	*/
287	public function get_item_permissions_check( $request ) {
288	return true;
289	}
290
291	/**
292	* Listing
293	*
294	* @param \WP_REST_Request $request Full details about the request.
295	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
296	*/
297	public function get_items_permissions_check( $request ) {
298	return current_user_can( 'read_sc_checkouts', $request->get_params() );
299	}
300
301	/**
302	* Anyone can create.
303	*
304	* @param \WP_REST_Request $request Full details about the request.
305	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
306	*/
307	public function create_item_permissions_check( $request ) {
308	if ( ! empty( $request['tax_behavior'] ) ) {
309	return current_user_can( 'edit_sc_checkouts' );
310	}
311	return true;
312	}
313
314	/**
315	* Update permissions.
316	*
317	* @param \WP_REST_Request $request Full details about the request.
318	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
319	*/
320	public function update_item_permissions_check( $request ) {
321	if ( ! empty( $request['tax_behavior'] ) ) {
322	return current_user_can( 'edit_sc_checkouts' );
323	}
324	return true;
325	}
326
327	/**
328	* Nobody can delete.
329	*
330	* @param \WP_REST_Request $request Full details about the request.
331	* @return false
332	*/
333	public function delete_item_permissions_check( $request ) {
334	return false;
335	}
336
337	/**
338	* Can the user manually mark the checkout as paid?
339	*
340	* @param \WP_REST_Request $request Full details about the request.
341	*
342	* @return boolean
343	*/
344	public function manually_pay_permissions_check( $request ) {
345	return current_user_can( 'edit_sc_checkouts' );
346	}
347
348	/**
349	* Cancelling orders.
350	*
351	* @param \WP_REST_Request $request Full details about the request.
352	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
353	*/
354	public function cancel_item_permissions_check( $request ) {
355	return current_user_can( 'edit_sc_orders' );
356	}
357	}
358