| 1 |
<?php |
| 2 |
/** |
| 3 |
* WCPOS sync read surface. |
| 4 |
* |
| 5 |
* @package WCPOS\WooCommercePOS\Sync |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WCPOS\WooCommercePOS\Sync; |
| 9 |
|
| 10 |
use WP_Error; |
| 11 |
use WP_REST_Request; |
| 12 |
|
| 13 |
// phpcs:disable Squiz.Commenting, Generic.Commenting -- Ported lab documentation is preserved verbatim. |
| 14 |
|
| 15 |
/** |
| 16 |
* The two-tier permission model shared by the sync REST controllers (D2): |
| 17 |
* |
| 18 |
* - `permissions_check` is the client tier. It requires |
| 19 |
* `access_woocommerce_pos`, then applies the F13 install-health gate. Every |
| 20 |
* sync read and push route uses this tier; /status opts out of the health gate |
| 21 |
* so it can report an unhealthy install. |
| 22 |
* - `admin_permissions_check` is the out-of-band operations tier. It requires |
| 23 |
* `manage_woocommerce`, then applies the same health gate. Only |
| 24 |
* /uuid/backfill, /orders/index/backfill, and /integrity/rebuild use it. |
| 25 |
* |
| 26 |
* Order matters: capability FIRST, so an unauthenticated caller still gets |
| 27 |
* 401/403 rather than a peek at server install state; only an authorized caller |
| 28 |
* learns the store is unhealthy (Health::unhealthy_error, 503). |
| 29 |
* |
| 30 |
* The write path layers more on top of this: /push/{collection} forwards via |
| 31 |
* rest_do_request. Write_Controller scopes the client-tier grant around raw |
| 32 |
* product, variation, and coupon mutation checks; other collections keep their |
| 33 |
* native wc/v3 capabilities. |
| 34 |
* |
| 35 |
* `health_gated()` lets /status report a broken install and is the reserved |
| 36 |
* opt-out seam for a future repair endpoint that can actually cure one. The |
| 37 |
* current out-of-band operations endpoints (/uuid/backfill, |
| 38 |
* /orders/index/backfill, /integrity/rebuild) cannot create the gated tables, |
| 39 |
* so they stay gated and fail against an unhealthy store. |
| 40 |
* |
| 41 |
* NOT for the fixtures controller: its check is deliberately different |
| 42 |
* (manage_options + the lab-mode guard, and the routes are lab-gated at |
| 43 |
* registration). |
| 44 |
*/ |
| 45 |
trait Endpoint_Permissions { |
| 46 |
/** |
| 47 |
* Check the POS client capability and sync-store health. |
| 48 |
* |
| 49 |
* @return bool|WP_Error |
| 50 |
*/ |
| 51 |
public function permissions_check( WP_REST_Request $request ) { |
| 52 |
if ( ! current_user_can( 'access_woocommerce_pos' ) ) { |
| 53 |
return false; |
| 54 |
} |
| 55 |
// F13: refuse to serve/persist against a broken or still-installing store — 503, |
| 56 |
// not a stale read or a silently-swallowed write. |
| 57 |
if ( $this->health_gated() && ! Health::is_healthy() ) { |
| 58 |
return Health::unhealthy_error(); |
| 59 |
} |
| 60 |
|
| 61 |
return true; |
| 62 |
} |
| 63 |
|
| 64 |
/** |
| 65 |
* Check the WooCommerce admin capability and sync-store health. |
| 66 |
* |
| 67 |
* @return bool|WP_Error |
| 68 |
*/ |
| 69 |
public function admin_permissions_check( WP_REST_Request $request ) { |
| 70 |
if ( ! current_user_can( 'manage_woocommerce' ) ) { |
| 71 |
return false; |
| 72 |
} |
| 73 |
if ( $this->health_gated() && ! Health::is_healthy() ) { |
| 74 |
return Health::unhealthy_error(); |
| 75 |
} |
| 76 |
|
| 77 |
return true; |
| 78 |
} |
| 79 |
|
| 80 |
/** |
| 81 |
* Whether this controller's endpoints refuse to run on a broken/half-installed |
| 82 |
* store (F13). Default yes. Override to false ONLY for an admin/repair endpoint |
| 83 |
* that neither reads nor writes the gated tables and that an operator |
| 84 |
* legitimately needs while the sync store is broken, or for the status |
| 85 |
* endpoint that reports whether those tables exist. |
| 86 |
*/ |
| 87 |
protected function health_gated(): bool { |
| 88 |
return true; |
| 89 |
} |
| 90 |
} |
| 91 |
|
