← All changes | includes/API/V2/Write_Controller.php +33 -107 1.10.0 → 1.10.18 View file →

		@@ -7,8 +7,9 @@
7	7
8	8	namespace WCPOS\WooCommercePOS\API\V2;
9	9
10	10	use WCPOS\WooCommercePOS\API\V2\Writers\Collection_Writer_Resolver;
	11	+use WCPOS\WooCommercePOS\Services\Permission_Rules;
11	12	use WCPOS\WooCommercePOS\Services\Tax_Id_Types;
12	13	use WCPOS\WooCommercePOS\Sync\Api;
13	14	use WCPOS\WooCommercePOS\Sync\Collections;
14	15	use WCPOS\WooCommercePOS\Sync\Endpoint_Permissions;
		@@ -43,8 +44,9 @@
43	44	* live in an injected mutation store, so the apply logic is unit-testable with a
44	45	* fake store + a stubbed `rest_do_request`.
45	46	*/
46	47	class Write_Controller extends WP_REST_Controller {
	48	+
47	49	// Our gate (capability + F13 health); forwarded writes scope the client-tier grant below.
48	50	use Endpoint_Permissions;
49	51
50	52
		@@ -433,53 +435,8 @@
433	435	return $this->envelope_document( $this->document_for( $meta, $new_id ), $m['recordId'], $meta, $new_id, $response->get_status(), $writer );
434	436	}
435	437
436	438	/**
437		- * The grace comparer (#423 step 2, option `woo_rxdb_sync_legacy_revision_grace`,
438		- * default on until retirement): on a canonical mismatch, accept a baseRevision
439		- * that matches the CURRENT document under a PRE-CUTOVER form —
440		- * - the legacy order sha256 (no ksort, volatiles included): same content,
441		- * old algorithm ⇒ the precondition is genuinely current;
442		- * - a pre-taxonomy-sort sha256 for non-orders: same content, previous
443		- * canonicalizer ⇒ queued writes survive the revision transition;
444		- * - a pre-1b lane synthesis (non-sha256 values the client fetchers stored
445		- * as sync.revision before the proxy revision stamp): date_modified_gmt
446		- * for order/post/user collections, String(id) for term collections
447		- * (deliberately vacuous — that lane never had optimistic concurrency;
448		- * grace honours the contract the record was written under).
449		- * A real conflict mismatches every form → 409 exactly as before. The ack
450		- * always returns the CANONICAL currentRevision, re-anchoring the client.
451		- */
452		- private function revision_matches_with_grace( $base, string $current_revision, array $meta, int $id, array $bare, bool $allow_term_grace = true ): bool {
453		- if ( $base === $current_revision ) {
454		- return true;
455		- }
456		- if ( ! is_string( $base ) || 'yes' !== get_option( 'woocommerce_pos_sync_legacy_revision_grace', 'yes' ) ) {
457		- return false;
458		- }
459		- if ( 0 === strpos( $base, 'sha256:' ) ) {
460		- if ( 'order' === ( $meta['id_type'] ?? '' ) && $id > 0 ) {
461		- if ( Order_Serializer::pre_augmentation_canonical_revision( $bare ) === $base
462		- || Order_Serializer::pre_item_uuid_canonical_revision( $bare ) === $base ) {
463		- return true;
464		- }
465		- $payload = ( new Order_Serializer() )->serialize_order( $id, new WP_REST_Request() );
466		- return Order_Serializer::legacy_revision( $payload ) === $base;
467		- }
468		- return Revision::pre_taxonomy_sort_revision( $bare ) === $base;
469		- }
470		- $id_type = $meta['id_type'] ?? '';
471		- if ( in_array( $id_type, array( 'order', 'post', 'user' ), true ) ) {
472		- $date = (string) ( $bare['date_modified_gmt'] ?? '' );
473		- return '' !== $date && $base === $date;
474		- }
475		- if ( 'term' === $id_type && $allow_term_grace ) {
476		- return (string) ( $bare['id'] ?? '' ) === $base;
477		- }
478		- return false;
479		- }
480		-
481		- /**
482	439	* The pre-CAS post-type capability gate shared by the update and delete paths.
483	440	*
484	441	* Only the WP-post-backed collections carry a Woo capability check of their own;
485	442	* every other collection is gated by the endpoint permission callback alone, so
		@@ -537,9 +494,9 @@
537	494	return $current;
538	495	}
539	496	$current_bare = is_array( $current->get_data() ) ? $current->get_data() : array();
540	497	$current_revision = $this->revision_for( $meta, $id, $current_bare );
541		- if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare ) ) {
	498	+ if ( $m['baseRevision'] !== $current_revision ) {
542	499	return new WP_REST_Response(
543	500	array(
544	501	'code' => 'woo_rxdb_sync_conflict',
545	502	'message' => 'baseRevision is stale.',
		@@ -602,9 +559,9 @@
602	559	return $current;
603	560	}
604	561	$current_bare = is_array( $current->get_data() ) ? $current->get_data() : array();
605	562	$current_revision = $this->revision_for( $meta, $id, $current_bare );
606		- if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare, false ) ) {
	563	+ if ( $m['baseRevision'] !== $current_revision ) {
607	564	return new WP_REST_Response(
608	565	array(
609	566	'code' => 'woo_rxdb_sync_conflict',
610	567	'message' => 'baseRevision is stale.',
		@@ -636,13 +593,13 @@
636	593	*
637	594	* @param int $id The order id.
638	595	*/
639	596	private function can_forward_delete( int $id ): bool {
640		- add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 );
	597	+ Permission_Rules::install_wc_filter();
641	598	try {
642	599	return (bool) wc_rest_check_post_permissions( 'shop_order', 'delete', $id );
643	600	} finally {
644		- remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 );
	601	+ Permission_Rules::uninstall_wc_filter();
645	602	}
646	603	}
647	604
648	605	private function checkpoint_and_finalize( string $mutation_id, int $remote_id, int $response_status ) {
		@@ -788,9 +745,9 @@
788	745	*/
789	746	private function dispatch_write( WP_REST_Request $request ) {
790	747	// Stamp here so direct callers (notably deletes) carry the scope too.
791	748	Store_Scope::stamp( $request );
792		- add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 );
	749	+ Permission_Rules::install_wc_filter();
793	750	try {
794	751	// Marked as OUR traffic for the duration of the forward, so a consumer
795	752	// keyed on store scope can act on a till write without also claiming
796	753	// every stock wc/v3 product write on the site (pro#425 review).
		@@ -799,65 +756,15 @@
799	756	return rest_do_request( $request );
800	757	}
801	758	);
802	759	} finally {
803		- remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 );
	760	+ Permission_Rules::uninstall_wc_filter();
804	761	}
805	762	}
806	763
807		- /**
808		- * Authorize proxied catalog mutations for POS users.
809		- *
810		- * This filter is attached only while a sync push is forwarded to wc/v3, so
811		- * direct WooCommerce requests keep their normal permission checks.
812		- *
813		- * @param bool $permission The current permission.
814		- * @param string $context The request context.
815		- * @param int $object_id The object ID.
816		- * @param string $post_type The object type passed by WooCommerce.
817		- *
818		- * @return bool
819		- */
	764	+ /** @deprecated Use Permission_Rules::wc_filter(). */
820	765	public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) {
821		- // Catalog and coupon WRITES require the user's real WooCommerce
822		- // capabilities — no POS-tier widening. The cashier role is deliberately
823		- // read-only on catalog (Activator), and a blanket grant here handed
824		- // every POS user product deletion and coupon minting. Product decision
825		- // 2026-08-06: strict wc/v3 parity for catalog mutations; only the
826		- // HPOS placeholder remap below (orders) adjusts anything, and it never
827		- // grants beyond the user's own role caps.
828		-
829		- // Orders: with HPOS enabled (sync off), get_post() yields shop_order_placehold
830		- // (map_meta_cap = false, no capability_type), so WooCommerce's REST check maps
831		- // to the generic edit_post/delete_post caps that cashier-tier roles lack —
832		- // even though they hold the real shop_orders caps. Re-check the capability the
833		- // mapping SHOULD have produced, mirroring V1\Orders_Controller's
834		- // update_item_permissions_check fix. No grant beyond the user's own role caps.
835		- if ( ! $permission && 'shop_order' === $post_type ) {
836		- $order_caps = array(
837		- 'read' => 'read_private_shop_orders',
838		- 'create' => 'publish_shop_orders',
839		- 'delete' => 'delete_shop_orders',
840		- );
841		- $order_cap = $order_caps[ $context ] ?? null;
842		- // edit and delete are ownership-sensitive: the base *_shop_orders cap only
843		- // authorizes acting on the user's OWN orders. Touching another user's order
844		- // additionally requires the *_others_shop_orders cap, mirroring WooCommerce's
845		- // own meta-cap map. Without this, a cashier with delete_shop_orders (but not
846		- // delete_others_shop_orders) could delete/void orders they do not own.
847		- if ( \in_array( $context, array( 'edit', 'delete' ), true ) ) {
848		- $order_post = get_post( $object_id );
849		- if ( $order_post ) {
850		- $owns_order = get_current_user_id() === (int) $order_post->post_author;
851		- $order_cap = $owns_order ? "{$context}_shop_orders" : "{$context}_others_shop_orders";
852		- }
853		- }
854		- if ( $order_cap && current_user_can( $order_cap ) ) {
855		- $permission = true;
856		- }
857		- }
858		-
859		- return $permission;
	766	+ return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'writes' );
860	767	}
861	768
862	769	/**
863	770	* Read this collection's document for one record, through its writer.
		@@ -951,13 +858,32 @@
951	858	}
952	859
953	860	private function revision_for( array $meta, int $id, array $bare ): string {
954	861	if ( 'product_variation' === ( $meta['post_type'] ?? '' ) ) {
955		- // The targeted variation pull stores exactly this source as
956		- // sync.revision (apps/web/src/db/variationIncludePull.ts): modified
957		- // timestamp, falling back to the wrapper id.
	862	+ /*
	863	+ * A variation's revision is its `date_modified_gmt`, deliberately: the client's targeted
	864	+ * pull synthesizes exactly that as `sync.revision`, so both sides agree without the
	865	+ * variations lane needing a stamped `_rxdb_revision`.
	866	+ *
	867	+ * Read the date from WHEREVER it is — nested under `payload` in today's
	868	+ * `{ id, parent_id, payload }` wrapper, or top level once that wrapper is dropped.
	869	+ *
	870	+ * This used to read `$bare['payload']['date_modified_gmt']` only, with `$bare['id']` as
	871	+ * the fallback. Against a FLAT document that silently degrades to the variation's own
	872	+ * ID — a value that never changes again. The failure would be total and invisible:
	873	+ * the ack would hand the client the id as `currentRevision`, and from then on every
	874	+ * stale baseRevision would equal every recomputed one — the strict revision
	875	+ * comparison would pass every queued write. Two tills editing the same
	876	+ * variation hours apart would both pass the precondition; the per-record lock would
	877	+ * serialize them, so there would be no error — just a lost update, every time.
	878	+ *
	879	+ * The `$bare['id']` fallback is kept ONLY for a document carrying no date at all, and is
	880	+ * now unreachable for any real variation serialization.
	881	+ */
958	882	$payload = isset( $bare['payload'] ) && is_array( $bare['payload'] ) ? $bare['payload'] : array();
959		- return (string) ( $payload['date_modified_gmt'] ?? $bare['id'] ?? $id );
	883	+ $date = $payload['date_modified_gmt'] ?? $bare['date_modified_gmt'] ?? null;
	884	+
	885	+ return (string) ( $date ?? $bare['id'] ?? $id );
960	886	}
961	887	if ( 'order' === ( $meta['id_type'] ?? '' ) && $id > 0 ) {
962	888	return Order_Serializer::canonical_revision( $bare );
963	889	}