| 1 |
<?php |
| 2 |
/** |
| 3 |
* Tax catalog proxy behavior. |
| 4 |
* |
| 5 |
* @package WCPOS\WooCommercePOS\API\V2\Proxy |
| 6 |
*/ |
| 7 |
|
| 8 |
namespace WCPOS\WooCommercePOS\API\V2\Proxy; |
| 9 |
|
| 10 |
use WP_REST_Request; |
| 11 |
|
| 12 |
/** |
| 13 |
* Applies tax ID narrowing and POS read permission without a v1 controller. |
| 14 |
*/ |
| 15 |
final class Taxes_Proxy_Behavior extends Scoped_Proxy_Behavior { |
| 16 |
/** |
| 17 |
* The Collection Rules plan for the request in flight. |
| 18 |
* |
| 19 |
* @var int[] |
| 20 |
*/ |
| 21 |
private $include = array(); |
| 22 |
|
| 23 |
/** |
| 24 |
* The Collection Rules plan for the request in flight. |
| 25 |
* |
| 26 |
* @var int[] |
| 27 |
*/ |
| 28 |
private $exclude = array(); |
| 29 |
|
| 30 |
/** |
| 31 |
* Adjust the params forwarded to wc/v3 for this resource. |
| 32 |
* |
| 33 |
* @param array $params Query parameters to forward. |
| 34 |
* @param WP_REST_Request $request Original proxy request. |
| 35 |
* |
| 36 |
* @return array |
| 37 |
*/ |
| 38 |
public function forwarded_params( array $params, WP_REST_Request $request ): array { |
| 39 |
foreach ( array( 'include', 'exclude' ) as $param ) { |
| 40 |
if ( isset( $params[ $param ] ) ) { |
| 41 |
$this->{$param} = wp_parse_id_list( $params[ $param ] ); |
| 42 |
$params[ 'wcpos_' . $param ] = $this->{$param}; |
| 43 |
unset( $params[ $param ] ); |
| 44 |
} |
| 45 |
} |
| 46 |
|
| 47 |
return $params; |
| 48 |
} |
| 49 |
|
| 50 |
/** |
| 51 |
* Install this resource's hooks and return their removal tuples. |
| 52 |
* |
| 53 |
* @return array<int, array{0: string, 1: callable, 2: int}> |
| 54 |
*/ |
| 55 |
protected function install(): array { |
| 56 |
$bindings = array(); |
| 57 |
$permission = static function ( $allowed, $context, $object_id, $post_type ) { |
| 58 |
if ( ! $allowed && 'settings' === $post_type && 'read' === $context ) { |
| 59 |
$allowed = current_user_can( 'access_woocommerce_pos' ); |
| 60 |
} |
| 61 |
|
| 62 |
return $allowed; |
| 63 |
}; |
| 64 |
add_filter( 'woocommerce_rest_check_permissions', $permission, 10, 4 ); |
| 65 |
$bindings[] = array( 'woocommerce_rest_check_permissions', $permission, 10 ); |
| 66 |
|
| 67 |
if ( array() === $this->include && array() === $this->exclude ) { |
| 68 |
return $bindings; |
| 69 |
} |
| 70 |
|
| 71 |
/* |
| 72 |
* Stays installed for the whole forward, and is unwound by around()'s |
| 73 |
* finally rather than by removing itself on first match. |
| 74 |
* |
| 75 |
* v1's method self-removes, but it removes the array callback |
| 76 |
* `array( $this, 'wcpos_tax_add_include_exclude_to_sql' )` — while the |
| 77 |
* proxy lane registered a CLOSURE wrapping that method, so the removal |
| 78 |
* never matched and the filter went on to narrow the pagination COUNT |
| 79 |
* query too. Self-removing here really does unhook, which left the |
| 80 |
* count unfiltered and the reported total too high. |
| 81 |
* `test_cashier_include_filter_limits_pagination_totals` pins this. |
| 82 |
* |
| 83 |
* Re-application is safe: each invocation receives a fresh query string, |
| 84 |
* and the strpos guard scopes it to tax-rate queries. |
| 85 |
*/ |
| 86 |
$query_filter = function ( string $query ): string { |
| 87 |
global $wpdb; |
| 88 |
|
| 89 |
if ( false === strpos( $query, "{$wpdb->prefix}woocommerce_tax_rates" ) ) { |
| 90 |
return $query; |
| 91 |
} |
| 92 |
if ( array() !== $this->include ) { |
| 93 |
$query = self::insert_where( $query, "{$wpdb->prefix}woocommerce_tax_rates.tax_rate_id IN (" . implode( ',', $this->include ) . ')' ); |
| 94 |
} |
| 95 |
if ( array() !== $this->exclude ) { |
| 96 |
$query = self::insert_where( $query, "{$wpdb->prefix}woocommerce_tax_rates.tax_rate_id NOT IN (" . implode( ',', $this->exclude ) . ')' ); |
| 97 |
} |
| 98 |
|
| 99 |
return $query; |
| 100 |
}; |
| 101 |
add_filter( 'query', $query_filter, 10, 1 ); |
| 102 |
$bindings[] = array( 'query', $query_filter, 10 ); |
| 103 |
|
| 104 |
return $bindings; |
| 105 |
} |
| 106 |
|
| 107 |
/** |
| 108 |
* Insert one condition into the WooCommerce tax-rate SQL. |
| 109 |
* |
| 110 |
* @param string $query SQL query. |
| 111 |
* @param string $condition WHERE condition. |
| 112 |
* |
| 113 |
* @return string |
| 114 |
*/ |
| 115 |
private static function insert_where( string $query, string $condition ): string { |
| 116 |
if ( false !== strpos( $query, 'WHERE' ) ) { |
| 117 |
return str_replace( 'WHERE', "WHERE $condition AND", $query ); |
| 118 |
} |
| 119 |
|
| 120 |
$position = strpos( $query, 'ORDER BY' ); |
| 121 |
return false !== $position |
| 122 |
? substr_replace( $query, " WHERE $condition ", $position, 0 ) |
| 123 |
: $query . " WHERE $condition"; |
| 124 |
} |
| 125 |
} |
| 126 |
|
