| @@ -38,15 +38,8 @@ | ||
| 38 | 38 | */ |
| 39 | 39 | public function __construct() { |
| 40 | 40 | register_activation_hook( PLUGIN_FILE, array( $this, 'activate' ) ); |
| 41 | 41 | add_action( 'wpmu_new_blog', array( $this, 'activate_new_site' ) ); |
| 42 | - // The staff-account rule (#1918, #2104) must hold even when WooCommerce is | |
| 43 | - // inactive and Init never starts; it depends on nothing from WooCommerce. | |
| 44 | - add_filter( 'map_meta_cap', array( Services\Permission_Rules::class, 'map_user_meta_caps' ), 10, 4 ); | |
| 45 | - // So must the role fence: a cashier may hand out no role above customer. Last, | |
| 46 | - // so a role-editor plugin adding roles back at a later priority cannot widen it. | |
| 47 | - add_filter( 'editable_roles', array( Services\Permission_Rules::class, 'filter_editable_roles' ), PHP_INT_MAX ); | |
| 48 | - add_action( 'invite_user', array( Services\Permission_Rules::class, 'refuse_unfenced_invite' ), 10, 3 ); | |
| 49 | 42 | add_action( 'plugins_loaded', array( $this, 'init' ) ); |
| 50 | 43 | } |
| 51 | 44 | |
| 52 | 45 | /** |
| @@ -105,28 +98,11 @@ | ||
| 105 | 98 | /** |
| 106 | 99 | * Fired when the plugin is activated. |
| 107 | 100 | * |
| 108 | 101 | * @param bool $install_sync_schema Whether to install the sync schema. |
| 109 | - * @param bool $full_role_sync Whether to repair all default role capabilities. | |
| 110 | 102 | */ |
| 111 | - public function single_activate( bool $install_sync_schema = true, bool $full_role_sync = true ): void { | |
| 112 | - $role_capabilities = self::role_capability_definition(); | |
| 113 | - $capability_names = $role_capabilities; | |
| 114 | - $capability_names['cashier'] = array_merge( array( 'access_woocommerce_pos' ), array_keys( $role_capabilities['cashier'] ) ); | |
| 115 | - $synced = get_option( 'woocommerce_pos_role_caps_synced', false ); | |
| 116 | - if ( ! $full_role_sync && false === $synced && get_option( 'woocommerce_pos_role_caps_fingerprint' ) === $this->role_caps_fingerprint() ) { | |
| 117 | - $synced = $capability_names; | |
| 118 | - } | |
| 119 | - // An upgrade grants only capabilities new to the definition since the | |
| 120 | - // last sync, so a capability the merchant removed on the Access screen | |
| 121 | - // stays removed. Explicit activation still repairs every default. | |
| 122 | - $granted = $capability_names; | |
| 123 | - if ( ! $full_role_sync && \is_array( $synced ) ) { | |
| 124 | - foreach ( $granted as $slug => $capabilities ) { | |
| 125 | - $already = isset( $synced[ $slug ] ) && \is_array( $synced[ $slug ] ) ? $synced[ $slug ] : array(); | |
| 126 | - $granted[ $slug ] = array_values( array_diff( $capabilities, $already ) ); | |
| 127 | - } | |
| 128 | - } | |
| 103 | + public function single_activate( bool $install_sync_schema = true ): void { | |
| 104 | + $role_capabilities = self::role_capability_definition(); | |
| 129 | 105 | |
| 130 | 106 | // Reseed the default template terms on the next request: (re)activation |
| 131 | 107 | // is the repair a merchant reaches for after deleting a term by hand. |
| 132 | 108 | // This also runs once per upgrade (version_check re-activates to sync |
| @@ -139,15 +115,15 @@ | ||
| 139 | 115 | self::autoload_request_latches(); |
| 140 | 116 | Admin\Permalink::ensure_default(); |
| 141 | 117 | |
| 142 | 118 | // create POS specific roles. |
| 143 | - $this->create_pos_roles( $granted['cashier'] ); | |
| 119 | + $this->create_pos_roles(); | |
| 144 | 120 | |
| 145 | 121 | // add pos capabilities to non POS roles. |
| 146 | 122 | $this->add_pos_capability( |
| 147 | 123 | array( |
| 148 | - 'administrator' => $granted['administrator'], | |
| 149 | - 'shop_manager' => $granted['shop_manager'], | |
| 124 | + 'administrator' => $role_capabilities['administrator'], | |
| 125 | + 'shop_manager' => $role_capabilities['shop_manager'], | |
| 150 | 126 | ) |
| 151 | 127 | ); |
| 152 | 128 | |
| 153 | 129 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| @@ -152,14 +128,13 @@ | ||
| 152 | 128 | |
| 153 | 129 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| 154 | 130 | $roles_are_persisted = is_array( $stored_roles ); |
| 155 | 131 | if ( $roles_are_persisted ) { |
| 156 | - foreach ( $granted as $slug => $capabilities ) { | |
| 157 | - if ( ! isset( $stored_roles[ $slug ] ) ) { | |
| 158 | - $roles_are_persisted = false; | |
| 159 | - break; | |
| 160 | - } | |
| 161 | - foreach ( $capabilities as $capability ) { | |
| 132 | + foreach ( $role_capabilities as $slug => $capabilities ) { | |
| 133 | + $required_capabilities = 'cashier' === $slug | |
| 134 | + ? array_merge( array( 'access_woocommerce_pos' ), array_keys( $capabilities ) ) | |
| 135 | + : $capabilities; | |
| 136 | + foreach ( $required_capabilities as $capability ) { | |
| 162 | 137 | if ( empty( $stored_roles[ $slug ]['capabilities'][ $capability ] ) ) { |
| 163 | 138 | $roles_are_persisted = false; |
| 164 | 139 | break 2; |
| 165 | 140 | } |
| @@ -168,11 +143,8 @@ | ||
| 168 | 143 | } |
| 169 | 144 | |
| 170 | 145 | $obsolete_customer_create_cap = isset( $role_capabilities['cashier']['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 171 | 146 | if ( $roles_are_persisted && empty( $stored_roles['cashier']['capabilities'][ $obsolete_customer_create_cap ] ) ) { |
| 172 | - // Snapshot first: a fingerprint that advanced past a failed snapshot | |
| 173 | - // write would never retry it. | |
| 174 | - update_option( 'woocommerce_pos_role_caps_synced', $capability_names, true ); | |
| 175 | 147 | update_option( 'woocommerce_pos_role_caps_fingerprint', $this->role_caps_fingerprint(), true ); |
| 176 | 148 | } |
| 177 | 149 | |
| 178 | 150 | // Flag the consent pop-up for the next admin page load. Done here |
| @@ -340,10 +312,9 @@ | ||
| 340 | 312 | $plugin_needs_upgrade = version_compare( $old, VERSION, '<' ); |
| 341 | 313 | $sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 342 | 314 | |
| 343 | 315 | $role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 344 | - $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint | |
| 345 | - || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 316 | + $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint; | |
| 346 | 317 | if ( ! $plugin_needs_upgrade && ! $sync_needs_upgrade && ! $role_caps_need_sync ) { |
| 347 | 318 | return; |
| 348 | 319 | } |
| 349 | 320 | |
| @@ -355,10 +326,9 @@ | ||
| 355 | 326 | $locked_plugin_needs_upgrade = version_compare( $locked_old, VERSION, '<' ); |
| 356 | 327 | $locked_sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 357 | 328 | |
| 358 | 329 | $locked_role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 359 | - $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint | |
| 360 | - || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 330 | + $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint; | |
| 361 | 331 | if ( ! $locked_plugin_needs_upgrade && ! $locked_sync_needs_upgrade && ! $locked_role_caps_need_sync ) { |
| 362 | 332 | $this->release_db_upgrade_lock(); |
| 363 | 333 | return; |
| 364 | 334 | } |
| @@ -376,9 +346,9 @@ | ||
| 376 | 346 | // requires translations to be loaded (WordPress 6.7+). |
| 377 | 347 | add_action( |
| 378 | 348 | 'init', |
| 379 | 349 | function () { |
| 380 | - $this->single_activate( false, false ); | |
| 350 | + $this->single_activate( false ); | |
| 381 | 351 | } |
| 382 | 352 | ); |
| 383 | 353 | } |
| 384 | 354 | |
| @@ -543,13 +513,10 @@ | ||
| 543 | 513 | } |
| 544 | 514 | |
| 545 | 515 | /** |
| 546 | 516 | * Add POS specific roles. |
| 547 | - * | |
| 548 | - * @param string[]|null $capabilities Capability names to sync onto an existing role, or null for | |
| 549 | - * every default. A missing role is always created with the full set. | |
| 550 | 517 | */ |
| 551 | - private function create_pos_roles( ?array $capabilities = null ): void { | |
| 518 | + private function create_pos_roles(): void { | |
| 552 | 519 | $role_capabilities = self::role_capability_definition(); |
| 553 | 520 | $cashier_capabilities = $role_capabilities['cashier']; |
| 554 | 521 | |
| 555 | 522 | add_role( |
| @@ -555,11 +522,9 @@ | ||
| 555 | 522 | add_role( |
| 556 | 523 | 'cashier', |
| 557 | 524 | /* translators: Plugin activation notice label. */ |
| 558 | 525 | __( 'Cashier', 'woocommerce-pos' ), |
| 559 | - // A missing role is created whole, access gate included, whatever | |
| 560 | - // subset an incremental upgrade asked to sync. | |
| 561 | - array_merge( array( 'access_woocommerce_pos' => true ), $cashier_capabilities ) | |
| 526 | + $cashier_capabilities | |
| 562 | 527 | ); |
| 563 | 528 | |
| 564 | 529 | $obsolete_customer_create_cap = isset( $cashier_capabilities['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 565 | 530 | $cashier = get_role( 'cashier' ); |
| @@ -566,14 +531,14 @@ | ||
| 566 | 531 | if ( $cashier ) { |
| 567 | 532 | $cashier->remove_cap( $obsolete_customer_create_cap ); |
| 568 | 533 | } |
| 569 | 534 | |
| 570 | - // Sync the requested capabilities to the role. add_role() is a no-op when | |
| 535 | + // Sync all capabilities to the existing role. add_role() is a no-op when | |
| 571 | 536 | // the role already exists, so capabilities added in newer versions would |
| 572 | 537 | // never reach existing installs without this. |
| 573 | 538 | $this->add_pos_capability( |
| 574 | 539 | array( |
| 575 | - 'cashier' => $capabilities ?? array_merge( | |
| 540 | + 'cashier' => array_merge( | |
| 576 | 541 | array( 'access_woocommerce_pos' ), |
| 577 | 542 | array_keys( $cashier_capabilities ) |
| 578 | 543 | ), |
| 579 | 544 | ) |
