← All changes | includes/API/V1/Orders_Controller.php +212 -49 1.10.18 → 1.10.17 View file →

		@@ -12,9 +12,8 @@
12	12	if ( ! class_exists( 'WC_REST_Orders_Controller' ) ) {
13	13	return;
14	14	}
15	15
16		-use WCPOS\WooCommercePOS\Services\Permission_Rules;
17	16	use Automattic\WooCommerce\Utilities\OrderUtil;
18	17	use Exception;
19	18	use WC_Abstract_Order;
20	19	use WC_Data;
		@@ -25,17 +24,17 @@
25	24	use WC_Order_Item_Product;
26	25	use WC_REST_Orders_Controller;
27	26	use WC_Tax;
28	27	use WCPOS\WooCommercePOS\Logger;
29		-use WCPOS\WooCommercePOS\Services\Order_Write_Intent;
30	28	use WCPOS\WooCommercePOS\Services\Pos_Order_Audit;
31	29	use WCPOS\WooCommercePOS\Services\Settings as SettingsService;
32	30	use WCPOS\WooCommercePOS\Services\Stock_Validator;
33	31	use WCPOS\WooCommercePOS\Services\Tax_Id_Reader;
	32	+use WCPOS\WooCommercePOS\Services\Tax_Id_Types;
	33	+use WCPOS\WooCommercePOS\Services\Tax_Id_Writer;
34	34	use WCPOS\WooCommercePOS\Sync\Collection_Rules;
35	35	use WCPOS\WooCommercePOS\Sync\Collection_Rules_Plan;
36	36	use WCPOS\WooCommercePOS\Sync\Order_Serializer;
37		-use WCPOS\WooCommercePOS\Sync\Order_Write_Payload;
38	37	use const WCPOS\WooCommercePOS\PLUGIN_NAME;
39	38	use const WCPOS\WooCommercePOS\VERSION;
40	39	use WP_Error;
41	40	use WP_REST_Request;
		@@ -85,26 +84,25 @@
85	84	*/
86	85	protected $wcpos_request;
87	86
88	87	/**
89		- * Whether High Performance Orders is enabled.
	88	+ * The order object being created by the current request.
90	89	*
91		- * @var bool
	90	+ * @var WC_Abstract_Order|null
92	91	*/
93		- private $hpos_enabled = false;
	92	+ private $creating_order;
94	93
95	94	/**
96		- * Shared date validation and tax-ID persistence for the order write lanes.
	95	+ * Whether High Performance Orders is enabled.
97	96	*
98		- * @var Order_Write_Payload
	97	+ * @var bool
99	98	*/
100		- private $order_payload;
	99	+ private $hpos_enabled = false;
101	100
102	101	/**
103	102	* Constructor.
104	103	*/
105	104	public function __construct() {
106		- $this->order_payload = new Order_Write_Payload();
107	105	$this->hpos_enabled = class_exists( OrderUtil::class ) && OrderUtil::custom_orders_table_usage_is_enabled();
108	106
109	107	if ( method_exists( parent::class, '__construct' ) ) {
110	108	parent::__construct();
		@@ -147,22 +145,72 @@
147	145	$request->set_param( 'set_paid', $set_paid );
148	146	}
149	147	}
150	148
151		- /** Delegate the edit decision, preserving WooCommerce's request-dependent checks.
	149	+ /**
	150	+ * Check if the current user can update an order.
152	151	*
153		- * @param \WP_REST_Request $request Full request details.
	152	+ * Overrides the parent to fix HPOS compatibility. When HPOS is enabled with
	153	+ * sync disabled, get_post() returns a shop_order_placehold post type that has
	154	+ * map_meta_cap = false and no capability_type, causing WordPress to check the
	155	+ * generic 'edit_post' capability instead of 'edit_shop_order'. Non-admin roles
	156	+ * like cashier have 'edit_shop_orders' but not the generic 'edit_posts', so the
	157	+ * permission check fails.
	158	+ *
	159	+ * @param WP_REST_Request $request Full details about the request.
	160	+ *
	161	+ * @return bool|WP_Error
154	162	*/
155	163	public function update_item_permissions_check( $request ) {
156		- return Permission_Rules::verdict( 'orders', 'edit', (int) $request['id'], 0, 'v1', $request->get_params() );
	164	+ $result = parent::update_item_permissions_check( $request );
	165	+
	166	+ if ( ! is_wp_error( $result ) ) {
	167	+ return $result;
	168	+ }
	169	+
	170	+ // Parent check failed - try direct capability check for HPOS compatibility.
	171	+ $id = (int) $request['id'];
	172	+ $order = wc_get_order( $id );
	173	+
	174	+ if ( ! $order ) {
	175	+ return $result;
	176	+ }
	177	+
	178	+ if ( ! current_user_can( 'edit_shop_orders' ) ) {
	179	+ return $result;
	180	+ }
	181	+
	182	+ return true;
157	183	}
158	184
159		- /** Delegate the delete decision, preserving WooCommerce's request-dependent checks.
	185	+ /**
	186	+ * Check if the current user can delete an order.
160	187	*
161		- * @param \WP_REST_Request $request Full request details.
	188	+ * Same HPOS fix as update_item_permissions_check.
	189	+ *
	190	+ * @param WP_REST_Request $request Full details about the request.
	191	+ *
	192	+ * @return bool|WP_Error
162	193	*/
163	194	public function delete_item_permissions_check( $request ) {
164		- return Permission_Rules::verdict( 'orders', 'delete', (int) $request['id'], 0, 'v1', $request->get_params() );
	195	+ $result = parent::delete_item_permissions_check( $request );
	196	+
	197	+ if ( ! is_wp_error( $result ) ) {
	198	+ return $result;
	199	+ }
	200	+
	201	+ $id = (int) $request['id'];
	202	+ $order = wc_get_order( $id );
	203	+
	204	+ if ( ! $order ) {
	205	+ return $result;
	206	+ }
	207	+
	208	+ if ( ! current_user_can( 'delete_shop_orders' ) ) {
	209	+ return $result;
	210	+ }
	211	+
	212	+ return true;
165	213	}
166	214
167	215	/**
168	216	* Delete a single order.
		@@ -318,9 +366,30 @@
318	366	$schema['properties']['tax_ids'] = array(
319	367	'description' => __( 'Customer tax IDs snapshotted at sale time.', 'woocommerce-pos' ),
320	368	'type' => 'array',
321	369	'context' => array( 'view', 'edit' ),
322		- 'items' => array( 'type' => 'object' ),
	370	+ 'items' => array(
	371	+ 'type' => 'object',
	372	+ 'properties' => array(
	373	+ 'type' => array(
	374	+ 'type' => 'string',
	375	+ 'enum' => Tax_Id_Types::all_types(),
	376	+ 'description' => /* translators: REST API schema field label or error message. */ __( 'Tax ID type.', 'woocommerce-pos' ),
	377	+ ),
	378	+ 'value' => array(
	379	+ 'type' => 'string',
	380	+ 'description' => /* translators: REST API schema field label or error message. */ __( 'Tax ID value.', 'woocommerce-pos' ),
	381	+ ),
	382	+ 'country' => array(
	383	+ 'type' => array( 'string', 'null' ),
	384	+ 'description' => __( 'ISO 3166-1 alpha-2 country code.', 'woocommerce-pos' ),
	385	+ ),
	386	+ 'label' => array(
	387	+ 'type' => array( 'string', 'null' ),
	388	+ 'description' => /* translators: REST API schema field label or error message. */ __( 'Optional human-readable label.', 'woocommerce-pos' ),
	389	+ ),
	390	+ ),
	391	+ ),
323	392	);
324	393
325	394	// Check and remove email format validation from the billing property.
326	395	if ( isset( $schema['properties']['billing']['properties']['email']['format'] ) ) {
		@@ -413,48 +482,122 @@
413	482	if ( isset( $request['meta_data'] ) && \is_array( $request['meta_data'] ) ) {
414	483	$request->set_param( 'meta_data', Pos_Order_Audit::sanitize_create_meta( $request['meta_data'] ) );
415	484	}
416	485
417		- $response = Order_Write_Intent::open(
418		- array(
419		- 'operation' => 'create',
420		- 'requested_status' => (string) $request->get_param( 'status' ),
421		- 'set_paid' => $request->has_param( 'set_paid' ) && rest_sanitize_boolean( $request->get_param( 'set_paid' ) ),
422		- ),
423		- function () use ( $request ) {
424		- add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10, 3 );
425		- try {
426		- // Proceed with the parent method to handle the creation.
427		- return parent::create_item( $request );
428		- } finally {
429		- remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10 );
430		- }
431		- }
432		- );
	486	+ $this->creating_order = null;
433	487
434		- $this->wcpos_refresh_tax_ids_response( $response, $request, true );
	488	+ add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_track_creating_order' ), 9, 3 );
	489	+ add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10, 3 );
435	490
	491	+ try {
	492	+ // Proceed with the parent method to handle the creation.
	493	+ $response = parent::create_item( $request );
	494	+ } finally {
	495	+ remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10 );
	496	+ remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_track_creating_order' ), 9 );
	497	+ $this->creating_order = null;
	498	+ }
	499	+
	500	+ $this->wcpos_snapshot_tax_ids_to_order( $response, $request, true );
	501	+
436	502	return $response;
437	503	}
438	504
439	505	/**
440		- * Preserve the client creation time using the shared payload validator.
	506	+ * Record the exact order object prepared for this create request.
441	507	*
442		- * @param WC_Data|WP_Error $order Prepared order.
	508	+ * @param WC_Data|WP_Error $order Order object prepared by WooCommerce.
443	509	* @param WP_REST_Request $request Request object.
444		- * @param bool $creating Whether this is a create.
	510	+ * @param bool $creating Whether a new order is being created.
	511	+ *
445	512	* @return WC_Data|WP_Error
446	513	*/
	514	+ public function wcpos_track_creating_order( $order, WP_REST_Request $request, bool $creating ) {
	515	+ if ( $creating && $order instanceof WC_Abstract_Order ) {
	516	+ $this->creating_order = $order;
	517	+ }
	518	+
	519	+ return $order;
	520	+ }
	521	+
	522	+ /**
	523	+ * Preserve client-provided order creation time for offline-created orders.
	524	+ *
	525	+ * WooCommerce marks date_created/date_created_gmt as read-only in the REST
	526	+ * schema, so those fields are removed before the parent controller prepares
	527	+ * the order. WCPOS clients can create orders offline and later sync the full
	528	+ * local document; read the raw JSON payload here so the server keeps the
	529	+ * transaction time instead of the sync time.
	530	+ *
	531	+ * @param WC_Data|WP_Error $order Order object prepared by WooCommerce.
	532	+ * @param WP_REST_Request $request Request object.
	533	+ * @param bool $creating Whether a new order is being created.
	534	+ *
	535	+ * @return WC_Data|WP_Error
	536	+ */
447	537	public function wcpos_preserve_client_created_date_gmt( $order, WP_REST_Request $request, bool $creating ) {
448	538	if ( ! $creating || ! ( $order instanceof WC_Abstract_Order ) ) {
449	539	return $order;
450	540	}
	541	+ $this->creating_order = $order;
	542	+
451	543	$body = $request->get_json_params();
452		- $timestamp = $this->order_payload->validate_client_created_gmt( is_array( $body ) ? $body : array() );
453		- if ( is_wp_error( $timestamp ) || null === $timestamp ) {
454		- return is_wp_error( $timestamp ) ? $timestamp : $order;
	544	+
	545	+ if ( ! isset( $body['date_created_gmt'] ) ) {
	546	+ return $order;
455	547	}
	548	+
	549	+ if ( ! is_scalar( $body['date_created_gmt'] ) ) {
	550	+ return new WP_Error(
	551	+ 'woocommerce_pos_rest_invalid_date_created_gmt',
	552	+ __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
	553	+ array( 'status' => 400 )
	554	+ );
	555	+ }
	556	+
	557	+ $client_date_gmt = wc_clean( wp_unslash( (string) $body['date_created_gmt'] ) );
	558	+
	559	+ if ( '' === $client_date_gmt ) {
	560	+ return $order;
	561	+ }
	562	+
	563	+ if ( 1 !== preg_match( '/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?$/i', $client_date_gmt ) ) {
	564	+ return new WP_Error(
	565	+ 'woocommerce_pos_rest_invalid_date_created_gmt',
	566	+ __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
	567	+ array( 'status' => 400 )
	568	+ );
	569	+ }
	570	+
	571	+ // WooCommerce serializes *_gmt fields without a timezone suffix; treat bare values as UTC.
	572	+ $parse_date_gmt = 'Z' === strtoupper( substr( $client_date_gmt, -1 ) )
	573	+ ? $client_date_gmt
	574	+ : $client_date_gmt . 'Z';
	575	+ $timestamp = rest_parse_date(
	576	+ $parse_date_gmt,
	577	+ true
	578	+ );
	579	+
	580	+ if ( false === $timestamp ) {
	581	+ return new WP_Error(
	582	+ 'woocommerce_pos_rest_invalid_date_created_gmt',
	583	+ __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
	584	+ array( 'status' => 400 )
	585	+ );
	586	+ }
	587	+
	588	+ $maximum_future_timestamp = time() + DAY_IN_SECONDS;
	589	+
	590	+ if ( $timestamp > $maximum_future_timestamp ) {
	591	+ return new WP_Error(
	592	+ 'woocommerce_pos_rest_future_date_created_gmt',
	593	+ __( 'date_created_gmt cannot be more than 24 hours in the future.', 'woocommerce-pos' ),
	594	+ array( 'status' => 400 )
	595	+ );
	596	+ }
	597	+
456	598	$order->set_date_created( $timestamp );
	599	+
457	600	return $order;
458	601	}
459	602
460	603	/**
		@@ -490,21 +633,28 @@
490	633	}
491	634
492	635	// Proceed with the parent method to handle the update.
493	636	$response = parent::update_item( $request );
494		- $this->wcpos_refresh_tax_ids_response( $response, $request, false );
	637	+ $this->wcpos_snapshot_tax_ids_to_order( $response, $request, false );
495	638
496	639	return $response;
497	640	}
498	641
499	642	/**
500		- * Adapt the parent response to the shared snapshot and refresh its tax_ids.
	643	+ * Persist tax_ids onto the order.
501	644	*
	645	+ * On create: if the request did not provide `tax_ids`, snapshot from the
	646	+ * resolved customer record so the order is self-contained. If the request
	647	+ * provided `tax_ids`, write those (cashier-entered tax IDs override).
	648	+ *
	649	+ * On update: only write what the request explicitly provided; never
	650	+ * re-snapshot, since editing a customer must not mutate historical orders.
	651	+ *
502	652	* @param mixed $response Response from parent controller.
503	653	* @param WP_REST_Request $request Original request.
504	654	* @param bool $is_create True for create, false for update.
505	655	*/
506		- private function wcpos_refresh_tax_ids_response( $response, WP_REST_Request $request, bool $is_create ): void {
	656	+ protected function wcpos_snapshot_tax_ids_to_order( $response, WP_REST_Request $request, bool $is_create ): void {
507	657	if ( ! ( $response instanceof WP_REST_Response ) ) {
508	658	return;
509	659	}
510	660
		@@ -512,13 +662,27 @@
512	662	$order_id = isset( $data['id'] ) ? (int) $data['id'] : 0;
513	663	if ( $order_id <= 0 ) {
514	664	return;
515	665	}
516		- $tax_ids = $this->order_payload->persist_tax_ids( $order_id, $request->get_params(), $is_create );
517		- if ( null !== $tax_ids ) {
518		- $data['tax_ids'] = $tax_ids;
519		- $response->set_data( $data );
	666	+ $order = \wc_get_order( $order_id );
	667	+ if ( ! $order ) {
	668	+ return;
520	669	}
	670	+
	671	+ $tax_ids = $request->get_param( 'tax_ids' );
	672	+ $writer = new Tax_Id_Writer();
	673	+
	674	+ if ( \is_array( $tax_ids ) ) {
	675	+ $writer->write_for_order( $order, $tax_ids );
	676	+ } elseif ( $is_create ) {
	677	+ $customer_id = (int) $order->get_customer_id();
	678	+ if ( $customer_id > 0 ) {
	679	+ $writer->snapshot_from_user_to_order( $order, $customer_id );
	680	+ }
	681	+ }
	682	+
	683	+ $data['tax_ids'] = ( new Tax_Id_Reader() )->read_for_order( $order );
	684	+ $response->set_data( $data );
521	685	}
522	686
523	687	/**
524	688	* Create or update a line item.
		@@ -1012,10 +1176,9 @@
1012	1176	*
1013	1177	* @throws \WC_Data_Exception If order data is invalid.
1014	1178	*/
1015	1179	public function wcpos_before_order_object_save( WC_Abstract_Order $order ): void {
1016		- $intent = Order_Write_Intent::current();
1017		- $is_creating_order = null !== $intent && $intent->is_create() && $intent->is_subject( $order );
	1180	+ $is_creating_order = $order === $this->creating_order;
1018	1181
1019	1182	if ( $is_creating_order && method_exists( $order, 'set_created_via' ) ) {
1020	1183	$order->set_created_via( PLUGIN_NAME );
1021	1184	// Record provenance only; receipt calculations continue to infer historical