ShipmentRestServiceProvider.php — SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 4.7.0

surecart / app / src / Rest / ShipmentRestServiceProvider.php

surecart / app / src / Rest Last commit date

ShipmentRestServiceProvider.php

203 lines

1	<?php
2
3	namespace SureCart\Rest;
4
5	use SureCart\Rest\RestServiceInterface;
6	use SureCart\Controllers\Rest\ShipmentsController;
7
8	/**
9	* Service provider for Shipment Rest Requests
10	*/
11	class ShipmentRestServiceProvider extends RestServiceProvider implements RestServiceInterface {
12	/**
13	* Endpoint.
14	*
15	* @var string
16	*/
17	protected $endpoint = 'shipments';
18
19	/**
20	* Rest Controller
21	*
22	* @var string
23	*/
24	protected $controller = ShipmentsController::class;
25
26	/**
27	* Methods allowed for the model.
28	*
29	* @var array
30	*/
31	protected $methods = [ 'index', 'find', 'edit' ];
32
33	/**
34	* Register REST Routes
35	*
36	* @return void
37	*/
38	public function registerRoutes() {
39	register_rest_route(
40	"$this->name/v$this->version",
41	$this->endpoint . '/(?P<id>[^/]+)/purchase/',
42	[
43	[
44	'methods' => \WP_REST_Server::EDITABLE,
45	'callback' => $this->callback( $this->controller, 'purchaseLabel' ),
46	'permission_callback' => [ $this, 'purchase_label_permissions_check' ],
47	],
48	'schema' => [ $this, 'get_item_schema' ],
49	]
50	);
51
52	register_rest_route(
53	"$this->name/v$this->version",
54	$this->endpoint . '/(?P<id>[^/]+)/void/',
55	[
56	[
57	'methods' => \WP_REST_Server::EDITABLE,
58	'callback' => $this->callback( $this->controller, 'voidLabel' ),
59	'permission_callback' => [ $this, 'void_label_permissions_check' ],
60	],
61	'schema' => [ $this, 'get_item_schema' ],
62	]
63	);
64
65	register_rest_route(
66	"$this->name/v$this->version",
67	$this->endpoint . '/(?P<id>[^/]+)/quote/',
68	[
69	[
70	'methods' => \WP_REST_Server::EDITABLE,
71	'callback' => $this->callback( $this->controller, 'quoteRates' ),
72	'permission_callback' => [ $this, 'quote_rates_permissions_check' ],
73	],
74	'schema' => [ $this, 'get_item_schema' ],
75	]
76	);
77	}
78
79	/**
80	* Get our sample schema for a shipment.
81	*
82	* @return array The sample schema for a shipment
83	*/
84	public function get_item_schema() {
85	if ( $this->schema ) {
86	return $this->schema;
87	}
88
89	$this->schema = [
90	'$schema' => 'http://json-schema.org/draft-04/schema#',
91	'title' => $this->endpoint,
92	'type' => 'object',
93	'properties' => [
94	'id' => [
95	'description' => esc_html__( 'Unique identifier for the object.', 'surecart' ),
96	'type' => 'string',
97	'context' => [ 'view', 'edit', 'embed' ],
98	'readonly' => true,
99	],
100	],
101	];
102
103	return $this->schema;
104	}
105
106	/**
107	* Get the collection params.
108	*
109	* @return array
110	*/
111	public function get_collection_params() {
112	return [
113	'page' => [
114	'description' => esc_html__( 'The page of items you want returned.', 'surecart' ),
115	'type' => 'integer',
116	],
117	'per_page' => [
118	'description' => esc_html__( 'A limit on the number of items to be returned, between 1 and 100.', 'surecart' ),
119	'type' => 'integer',
120	],
121	'fulfillment_ids' => [
122	'description' => esc_html__( 'Filter by fulfillment IDs.', 'surecart' ),
123	'type' => 'array',
124	'items' => [
125	'type' => 'string',
126	],
127	],
128	'status' => [
129	'description' => esc_html__( 'Filter by shipment status.', 'surecart' ),
130	'type' => 'string',
131	],
132	];
133	}
134
135	/**
136	* Retrieve permissions.
137	*
138	* @param \WP_REST_Request $request Full details about the request.
139	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
140	*/
141	public function get_item_permissions_check( $request ) {
142	return current_user_can( 'read_sc_orders' );
143	}
144
145	/**
146	* List permissions.
147	*
148	* @param \WP_REST_Request $request Full details about the request.
149	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
150	*/
151	public function get_items_permissions_check( $request ) {
152	// Listing shipments — including with a fulfillment_ids filter — is an
153	// admin operation requiring the global read_sc_orders cap. The earlier
154	// per-fulfillment object-level branch passed a fulfillment ID to
155	// read_sc_order, but that cap's map (OrderPermissionsController) calls
156	// Order::find() with the ID and 404s for any fulfillment ID, so the
157	// branch was effectively a no-op for non-admins and redundant for
158	// admins (the global cap check inside read_sc_order short-circuits
159	// first). Customer-facing access should use a dedicated endpoint.
160	return current_user_can( 'read_sc_orders' );
161	}
162
163	/**
164	* Update permissions.
165	*
166	* @param \WP_REST_Request $request Full details about the request.
167	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
168	*/
169	public function update_item_permissions_check( $request ) {
170	return current_user_can( 'edit_sc_orders' );
171	}
172
173	/**
174	* Purchase label permissions.
175	*
176	* @param \WP_REST_Request $request Full details about the request.
177	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
178	*/
179	public function purchase_label_permissions_check( $request ) {
180	return current_user_can( 'edit_sc_orders' );
181	}
182
183	/**
184	* Void label permissions.
185	*
186	* @param \WP_REST_Request $request Full details about the request.
187	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
188	*/
189	public function void_label_permissions_check( $request ) {
190	return current_user_can( 'edit_sc_orders' );
191	}
192
193	/**
194	* Re-quote rates permissions.
195	*
196	* @param \WP_REST_Request $request Full details about the request.
197	* @return true\|\WP_Error True if the request has access, WP_Error object otherwise.
198	*/
199	public function quote_rates_permissions_check( $request ) {
200	return current_user_can( 'edit_sc_orders' );
201	}
202	}
203