CheckoutRestServiceProvider.php — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 4.6.3

surecart / app / src / Rest / CheckoutRestServiceProvider.php

surecart / app / src / Rest Last commit date

CheckoutRestServiceProvider.php

372 lines

1	<?php
2
3	namespace SureCart\Rest;
4
5	use SureCart\Rest\RestServiceInterface;
6	use SureCart\Controllers\Rest\CheckoutsController;
7	use SureCart\Form\FormValidationService;
8	use SureCart\Models\User;
9	use SureCart\Support\PublicCatalogData;
10
11	/**
12	* Service provider for Price Rest Requests
13	*/
14	class CheckoutRestServiceProvider extends RestServiceProvider implements RestServiceInterface {
15	/**
16	* Endpoint.
17	*
18	* @var string
19	*/
20	protected $endpoint = 'checkouts';
21
22	/**
23	* Rest Controller
24	*
25	* @var string
26	*/
27	protected $controller = CheckoutsController::class;
28
29	/**
30	* Whether the rest service provider converts currency.
31	*
32	* @var boolean
33	*/
34	protected $converts_currency = true;
35
36	/**
37	* Filter each index item by schema context, so the edit-only customer
38	* fields are not emitted on view-context lists.
39	*
40	* @var boolean
41	*/
42	protected $filters_list_items = true;
43
44	/**
45	* Methods allowed for the model.
46	*
47	* @var array
48	*/
49	protected $methods = array( 'index', 'create', 'find', 'edit' );
50
51	/**
52	* Register Additional REST Routes
53	*
54	* @return void
55	*/
56	public function registerRoutes() {
57	register_rest_route(
58	"$this->name/v$this->version",
59	$this->endpoint . '/(?P<id>\S+)/finalize/',
60	array(
61	array(
62	'methods' => \WP_REST_Server::EDITABLE,
63	'callback' => $this->callback( $this->controller, 'finalize' ),
64	'permission_callback' => array( $this, 'finalize_permissions_check' ),
65	),
66	// Register our schema callback.
67	'schema' => array( $this, 'get_item_schema' ),
68	)
69	);
70	register_rest_route(
71	"$this->name/v$this->version",
72	$this->endpoint . '/(?P<id>\S+)/confirm/',
73	array(
74	array(
75	'methods' => \WP_REST_Server::EDITABLE,
76	'callback' => $this->callback( $this->controller, 'confirm' ),
77	'permission_callback' => array( $this, 'confirm_permissions_check' ),
78	),
79	// Register our schema callback.
80	'schema' => array( $this, 'get_item_schema' ),
81	)
82	);
83	register_rest_route(
84	"$this->name/v$this->version",
85	$this->endpoint . '/(?P<id>\S+)/manually_pay/',
86	array(
87	array(
88	'methods' => \WP_REST_Server::EDITABLE,
89	'callback' => $this->callback( $this->controller, 'manuallyPay' ),
90	'permission_callback' => array( $this, 'manually_pay_permissions_check' ),
91	),
92	// Register our schema callback.
93	'schema' => array( $this, 'get_item_schema' ),
94	)
95	);
96	register_rest_route(
97	"$this->name/v$this->version",
98	$this->endpoint . '/(?P<id>\S+)/cancel/',
99	array(
100	array(
101	'methods' => \WP_REST_Server::EDITABLE,
102	'callback' => $this->callback( $this->controller, 'cancel' ),
103	'permission_callback' => array( $this, 'cancel_item_permissions_check' ),
104	),
105	// Register our schema callback.
106	'schema' => array( $this, 'get_item_schema' ),
107	)
108	);
109	register_rest_route(
110	"$this->name/v$this->version",
111	$this->endpoint . '/(?P<id>\S+)/offer_bump/(?P<bump_id>\S+)',
112	array(
113	array(
114	'methods' => \WP_REST_Server::EDITABLE,
115	'callback' => $this->callback( $this->controller, 'offerBump' ),
116	'permission_callback' => array( $this, 'update_item_permissions_check' ),
117	),
118	// Register our schema callback.
119	'schema' => array( $this, 'get_item_schema' ),
120	)
121	);
122	register_rest_route(
123	"$this->name/v$this->version",
124	$this->endpoint . '/(?P<id>\S+)/offer_upsell/(?P<upsell_id>\S+)',
125	array(
126	array(
127	'methods' => \WP_REST_Server::EDITABLE,
128	'callback' => $this->callback( $this->controller, 'offerUpsell' ),
129	'permission_callback' => array( $this, 'update_item_permissions_check' ),
130	),
131	// Register our schema callback.
132	'schema' => array( $this, 'get_item_schema' ),
133	)
134	);
135	register_rest_route(
136	"$this->name/v$this->version",
137	$this->endpoint . '/(?P<id>\S+)/decline_upsell/(?P<upsell_id>\S+)',
138	array(
139	array(
140	'methods' => \WP_REST_Server::EDITABLE,
141	'callback' => $this->callback( $this->controller, 'declineUpsell' ),
142	'permission_callback' => array( $this, 'update_item_permissions_check' ),
143	),
144	// Register our schema callback.
145	'schema' => array( $this, 'get_item_schema' ),
146	)
147	);
148	}
149
150	/**
151	* Get our sample schema for a post.
152	*
153	* @return array The sample schema for a post
154	*/
155	public function get_item_schema() {
156	if ( $this->schema ) {
157	// Since WordPress 5.3, the schema can be cached in the $schema property.
158	return $this->schema;
159	}
160
161	$this->schema = array(
162	// This tells the spec of JSON Schema we are using which is draft 4.
163	'$schema' => 'http://json-schema.org/draft-04/schema#',
164	// The title property marks the identity of the resource.
165	'title' => $this->endpoint,
166	'type' => 'object',
167	// In JSON Schema you can specify object properties in the properties attribute.
168	'properties' => array(
169	'id' => array(
170	'description' => esc_html__( 'Unique identifier for the object.', 'surecart' ),
171	'type' => 'string',
172	'context' => array( 'view', 'edit', 'embed' ),
173	'readonly' => true,
174	),
175	'currency' => array(
176	'description' => esc_html__( 'The currency for the session.', 'surecart' ),
177	'type' => 'string',
178	),
179	'metadata' => array(
180	'description' => esc_html__( 'Metadata for the order.', 'surecart' ),
181	'type' => 'object',
182	// 'context' => [ 'edit' ],
183	),
184	'customer_id' => array(
185	'description' => esc_html__( 'The customer id for the order.', 'surecart' ),
186	'type' => 'string',
187	'context' => array( 'edit' ),
188	),
189	'customer' => array(
190	'description' => esc_html__( 'The customer for the session.', 'surecart' ),
191	'type' => 'object',
192	'context' => array( 'edit' ),
193	),
194	'line_items' => array(
195	'description' => esc_html__( 'The line items for the session.', 'surecart' ),
196	'type' => 'object',
197	),
198	'discount' => array(
199	'description' => esc_html__( 'The discount for the session.', 'surecart' ),
200	'type' => 'object',
201	),
202	),
203	);
204
205	return $this->schema;
206	}
207
208	/**
209	* Finalizing an order requires some server side form validation.
210	*
211	* @param \WP_REST_Request $request Full details about the request.
212	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
213	*/
214	public function finalize_permissions_check( \WP_REST_Request $request ) {
215	if ( empty( $request['live_mode'] ) ) {
216	if ( current_user_can( 'edit_sc_checkouts' ) ) {
217	return true;
218	}
219	if ( empty( \SureCart::settings()->get( 'unrestricted_test_mode' ) ) ) {
220	$errors = new \WP_Error( 'test_mode_restricted', esc_html__( 'Test order successful, but not processed.', 'surecart' ), [ 'status' => 403 ] );
221	$errors->add( 'test_mode_restricted', esc_html__( 'This is a test checkout. No orders were processed. Please contact the store administrator for more information.', 'surecart' ), [ 'status' => 403 ] );
222	return $errors;
223	}
224	}
225
226	// form id or a product id is required.
227	if ( empty( $request['form_id'] ) && empty( $request['product_id'] ) ) {
228	return new \WP_Error( 'form_id_required', esc_html__( 'Form ID is required.', 'surecart' ), array( 'status' => 400 ) );
229	}
230
231	// get form.
232	if ( ! empty( $request['form_id'] ) ) {
233	$form = get_post( $request['form_id'] );
234	if ( ! $form \|\| 'sc_form' !== $form->post_type ) {
235	return new \WP_Error( 'form_id_invalid', esc_html__( 'Form ID is invalid.', 'surecart' ), array( 'status' => 400 ) );
236	}
237	// validate form input based on saved form content.
238	$validator = new FormValidationService( $form->post_content, $request->get_body_params() );
239	$validated = $validator->validate();
240	if ( is_wp_error( $validated ) ) {
241	return $validated;
242	}
243	}
244
245	return true;
246	}
247
248	/**
249	* Confirming an order was paid for.
250	*
251	* @param \WP_REST_Request $request Full details about the request.
252	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
253	*/
254	public function confirm_permissions_check( \WP_REST_Request $request ) {
255	return $this->get_item_permissions_check( $request );
256	}
257
258	/**
259	* Filters a response based on the context defined in the schema.
260	*
261	* @since 4.7.0
262	*
263	* @param array\|\WP_REST_Response $data Response data to filter.
264	* @param string $context Context defined in the schema.
265	* @return array Filtered response.
266	*/
267	public function filter_response_by_context( $data, $context ) {
268	$schema = $this->get_item_schema();
269
270	// if the user can edit customers, show the edit context.
271	if ( current_user_can( 'edit_sc_customers' ) ) {
272	return rest_filter_response_by_context( $data, $schema, 'edit' );
273	}
274
275	$data = is_a( $data, 'WP_REST_Response' ) ? $data->get_data() : $data;
276
277	// if the user is logged in, and we have customer data.
278	// if it matches the current customer, then we can show the edit context.
279	if ( is_user_logged_in() && ! empty( $data['customer'] ) ) {
280	$customer_id = ! empty( $data['customer']['id'] ) ? $data['customer']['id'] : $data['customer'];
281	if ( User::current()->customerId() === $customer_id ) {
282	return rest_filter_response_by_context( $data, $schema, 'edit' );
283	}
284	}
285
286	return rest_filter_response_by_context( PublicCatalogData::lineItems( $data ), $schema, 'view' );
287	}
288
289
290	/**
291	* Anyone can get a specific order if they have the unique order id.
292	*
293	* @param \WP_REST_Request $request Full details about the request.
294	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
295	*/
296	public function get_item_permissions_check( $request ) {
297	return true;
298	}
299
300	/**
301	* Listing
302	*
303	* @param \WP_REST_Request $request Full details about the request.
304	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
305	*/
306	public function get_items_permissions_check( $request ) {
307	$check = $this->forbidEditContextWithout( $request, 'edit_sc_checkouts' );
308	if ( is_wp_error( $check ) ) {
309	return $check;
310	}
311
312	return current_user_can( 'read_sc_checkouts', $request->get_params() );
313	}
314
315	/**
316	* Anyone can create.
317	*
318	* @param \WP_REST_Request $request Full details about the request.
319	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
320	*/
321	public function create_item_permissions_check( $request ) {
322	if ( ! empty( $request['tax_behavior'] ) ) {
323	return current_user_can( 'edit_sc_checkouts' );
324	}
325	return true;
326	}
327
328	/**
329	* Update permissions.
330	*
331	* @param \WP_REST_Request $request Full details about the request.
332	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
333	*/
334	public function update_item_permissions_check( $request ) {
335	if ( ! empty( $request['tax_behavior'] ) ) {
336	return current_user_can( 'edit_sc_checkouts' );
337	}
338	return true;
339	}
340
341	/**
342	* Nobody can delete.
343	*
344	* @param \WP_REST_Request $request Full details about the request.
345	* @return false
346	*/
347	public function delete_item_permissions_check( $request ) {
348	return false;
349	}
350
351	/**
352	* Can the user manually mark the checkout as paid?
353	*
354	* @param \WP_REST_Request $request Full details about the request.
355	*
356	* @return boolean
357	*/
358	public function manually_pay_permissions_check( $request ) {
359	return current_user_can( 'edit_sc_checkouts' );
360	}
361
362	/**
363	* Cancelling orders.
364	*
365	* @param \WP_REST_Request $request Full details about the request.
366	* @return true\|\WP_Error True if the request has access to create items, WP_Error object otherwise.
367	*/
368	public function cancel_item_permissions_check( $request ) {
369	return current_user_can( 'edit_sc_orders' );
370	}
371	}
372