PluginProbe
WCPOS – Point of Sale (POS) plugin for WooCommerce / 1.10.18
WCPOS – Point of Sale (POS) plugin for WooCommerce v1.10.18
1.10.19 1.10.18 1.10.17 1.10.16 1.10.15 1.10.13 1.10.14 1.10.12 1.10.11 1.10.10 1.10.9 1.10.8 untagged-3d9b7ccddc54df87c672 1.10.7 1.10.6 1.10.5 1.10.3 1.10.4 1.10.2 1.10.1 1.10.0 1.9.17 1.9.15 1.9.16 1.9.14 All 163 releases
← All changes | includes/API/V1/Orders_Controller.php +109 -207 1.10.11.10.18 View file →
@@ -12,13 +12,15 @@
12 12 if ( ! class_exists( 'WC_REST_Orders_Controller' ) ) {
13 13 return;
14 14 }
15 15
16 +use WCPOS\WooCommercePOS\Services\Permission_Rules;
16 17 use Automattic\WooCommerce\Utilities\OrderUtil;
17 18 use Exception;
18 19 use WC_Abstract_Order;
19 20 use WC_Data;
20 21 use WC_Email_Customer_Invoice;
22 +use WC_Order;
21 23 use WC_Order_Item;
22 24 use WC_Order_Item_Fee;
23 25 use WC_Order_Item_Product;
24 26 use WC_REST_Orders_Controller;
@@ -23,16 +25,17 @@
23 25 use WC_Order_Item_Product;
24 26 use WC_REST_Orders_Controller;
25 27 use WC_Tax;
26 28 use WCPOS\WooCommercePOS\Logger;
29 +use WCPOS\WooCommercePOS\Services\Order_Write_Intent;
27 30 use WCPOS\WooCommercePOS\Services\Pos_Order_Audit;
28 31 use WCPOS\WooCommercePOS\Services\Settings as SettingsService;
32 +use WCPOS\WooCommercePOS\Services\Stock_Validator;
29 33 use WCPOS\WooCommercePOS\Services\Tax_Id_Reader;
30 -use WCPOS\WooCommercePOS\Services\Tax_Id_Types;
31 -use WCPOS\WooCommercePOS\Services\Tax_Id_Writer;
32 34 use WCPOS\WooCommercePOS\Sync\Collection_Rules;
33 35 use WCPOS\WooCommercePOS\Sync\Collection_Rules_Plan;
34 36 use WCPOS\WooCommercePOS\Sync\Order_Serializer;
37 +use WCPOS\WooCommercePOS\Sync\Order_Write_Payload;
35 38 use const WCPOS\WooCommercePOS\PLUGIN_NAME;
36 39 use const WCPOS\WooCommercePOS\VERSION;
37 40 use WP_Error;
38 41 use WP_REST_Request;
@@ -82,25 +85,26 @@
82 85 */
83 86 protected $wcpos_request;
84 87
85 88 /**
86 - * The order object being created by the current request.
89 + * Whether High Performance Orders is enabled.
87 90 *
88 - * @var WC_Abstract_Order|null
91 + * @var bool
89 92 */
90 - private $creating_order;
93 + private $hpos_enabled = false;
91 94
92 95 /**
93 - * Whether High Performance Orders is enabled.
96 + * Shared date validation and tax-ID persistence for the order write lanes.
94 97 *
95 - * @var bool
98 + * @var Order_Write_Payload
96 99 */
97 - private $hpos_enabled = false;
100 + private $order_payload;
98 101
99 102 /**
100 103 * Constructor.
101 104 */
102 105 public function __construct() {
106 + $this->order_payload = new Order_Write_Payload();
103 107 $this->hpos_enabled = class_exists( OrderUtil::class ) && OrderUtil::custom_orders_table_usage_is_enabled();
104 108
105 109 if ( method_exists( parent::class, '__construct' ) ) {
106 110 parent::__construct();
@@ -107,71 +111,58 @@
107 111 }
108 112 }
109 113
110 114 /**
111 - * Check if the current user can update an order.
115 + * Persist new checkout orders as pending until stock is reserved atomically.
112 116 *
113 - * Overrides the parent to fix HPOS compatibility. When HPOS is enabled with
114 - * sync disabled, get_post() returns a shop_order_placehold post type that has
115 - * map_meta_cap = false and no capability_type, causing WordPress to check the
116 - * generic 'edit_post' capability instead of 'edit_shop_order'. Non-admin roles
117 - * like cashier have 'edit_shop_orders' but not the generic 'edit_posts', so the
118 - * permission check fails.
119 - *
120 - * @param WP_REST_Request $request Full details about the request.
121 - *
122 - * @return bool|WP_Error
117 + * @param WP_REST_Request $request Full request details.
118 + * @param bool $creating Whether a new order is being created.
119 + * @return WC_Data|WP_Error
120 + * @throws \Throwable If checkout stock validation cannot be completed.
123 121 */
124 - public function update_item_permissions_check( $request ) {
125 - $result = parent::update_item_permissions_check( $request );
126 -
127 - if ( ! is_wp_error( $result ) ) {
128 - return $result;
122 + protected function save_object( $request, $creating = false ) {
123 + $validator = Stock_Validator::instance();
124 + if ( ! $creating || ! \wcpos_request() || ! SettingsService::instance()->prevent_overselling_enabled() || ! $validator->should_validate_create_request( $request ) ) {
125 + return parent::save_object( $request, $creating );
129 126 }
130 127
131 - // Parent check failed - try direct capability check for HPOS compatibility.
132 - $id = (int) $request['id'];
133 - $order = wc_get_order( $id );
128 + $target_status = $request->get_param( 'status' );
129 + $set_paid = $request->get_param( 'set_paid' );
134 130
135 - if ( ! $order ) {
136 - return $result;
137 - }
131 + try {
132 + return $validator->around_paid_create(
133 + array(
134 + 'status' => $target_status,
135 + 'set_paid' => rest_sanitize_boolean( $set_paid ),
136 + 'transaction_id' => $request->get_param( 'transaction_id' ),
137 + ),
138 + function ( array $neutralised ) use ( $request, $creating ) {
139 + $request->set_param( 'status', $neutralised['status'] );
140 + $request->set_param( 'set_paid', $neutralised['set_paid'] );
138 141
139 - if ( ! current_user_can( 'edit_shop_orders' ) ) {
140 - return $result;
142 + return parent::save_object( $request, $creating );
143 + }
144 + );
145 + } finally {
146 + $request->set_param( 'status', $target_status );
147 + $request->set_param( 'set_paid', $set_paid );
141 148 }
149 + }
142 150
143 - return true;
151 + /** Delegate the edit decision, preserving WooCommerce's request-dependent checks.
152 + *
153 + * @param \WP_REST_Request $request Full request details.
154 + */
155 + public function update_item_permissions_check( $request ) {
156 + return Permission_Rules::verdict( 'orders', 'edit', (int) $request['id'], 0, 'v1', $request->get_params() );
144 157 }
145 158
146 - /**
147 - * Check if the current user can delete an order.
159 + /** Delegate the delete decision, preserving WooCommerce's request-dependent checks.
148 160 *
149 - * Same HPOS fix as update_item_permissions_check.
150 - *
151 - * @param WP_REST_Request $request Full details about the request.
152 - *
153 - * @return bool|WP_Error
161 + * @param \WP_REST_Request $request Full request details.
154 162 */
155 163 public function delete_item_permissions_check( $request ) {
156 - $result = parent::delete_item_permissions_check( $request );
157 -
158 - if ( ! is_wp_error( $result ) ) {
159 - return $result;
160 - }
161 -
162 - $id = (int) $request['id'];
163 - $order = wc_get_order( $id );
164 -
165 - if ( ! $order ) {
166 - return $result;
167 - }
168 -
169 - if ( ! current_user_can( 'delete_shop_orders' ) ) {
170 - return $result;
171 - }
172 -
173 - return true;
164 + return Permission_Rules::verdict( 'orders', 'delete', (int) $request['id'], 0, 'v1', $request->get_params() );
174 165 }
175 166
176 167 /**
177 168 * Delete a single order.
@@ -297,9 +288,9 @@
297 288 ),
298 289 )
299 290 ),
300 291 ),
301 - 'schema' => array(),
292 + 'schema' => array( $this, 'wcpos_get_public_send_email_schema' ),
302 293 )
303 294 );
304 295
305 296 register_rest_route(
@@ -327,30 +318,9 @@
327 318 $schema['properties']['tax_ids'] = array(
328 319 'description' => __( 'Customer tax IDs snapshotted at sale time.', 'woocommerce-pos' ),
329 320 'type' => 'array',
330 321 'context' => array( 'view', 'edit' ),
331 - 'items' => array(
332 - 'type' => 'object',
333 - 'properties' => array(
334 - 'type' => array(
335 - 'type' => 'string',
336 - 'enum' => Tax_Id_Types::all_types(),
337 - 'description' => /* translators: REST API schema field label or error message. */ __( 'Tax ID type.', 'woocommerce-pos' ),
338 - ),
339 - 'value' => array(
340 - 'type' => 'string',
341 - 'description' => /* translators: REST API schema field label or error message. */ __( 'Tax ID value.', 'woocommerce-pos' ),
342 - ),
343 - 'country' => array(
344 - 'type' => array( 'string', 'null' ),
345 - 'description' => __( 'ISO 3166-1 alpha-2 country code.', 'woocommerce-pos' ),
346 - ),
347 - 'label' => array(
348 - 'type' => array( 'string', 'null' ),
349 - 'description' => /* translators: REST API schema field label or error message. */ __( 'Optional human-readable label.', 'woocommerce-pos' ),
350 - ),
351 - ),
352 - ),
322 + 'items' => array( 'type' => 'object' ),
353 323 );
354 324
355 325 // Check and remove email format validation from the billing property.
356 326 if ( isset( $schema['properties']['billing']['properties']['email']['format'] ) ) {
@@ -443,122 +413,48 @@
443 413 if ( isset( $request['meta_data'] ) && \is_array( $request['meta_data'] ) ) {
444 414 $request->set_param( 'meta_data', Pos_Order_Audit::sanitize_create_meta( $request['meta_data'] ) );
445 415 }
446 416
447 - $this->creating_order = null;
417 + $response = Order_Write_Intent::open(
418 + array(
419 + 'operation' => 'create',
420 + 'requested_status' => (string) $request->get_param( 'status' ),
421 + 'set_paid' => $request->has_param( 'set_paid' ) && rest_sanitize_boolean( $request->get_param( 'set_paid' ) ),
422 + ),
423 + function () use ( $request ) {
424 + add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10, 3 );
425 + try {
426 + // Proceed with the parent method to handle the creation.
427 + return parent::create_item( $request );
428 + } finally {
429 + remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10 );
430 + }
431 + }
432 + );
448 433
449 - add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_track_creating_order' ), 9, 3 );
450 - add_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10, 3 );
434 + $this->wcpos_refresh_tax_ids_response( $response, $request, true );
451 435
452 - try {
453 - // Proceed with the parent method to handle the creation.
454 - $response = parent::create_item( $request );
455 - } finally {
456 - remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_preserve_client_created_date_gmt' ), 10 );
457 - remove_filter( 'woocommerce_rest_pre_insert_shop_order_object', array( $this, 'wcpos_track_creating_order' ), 9 );
458 - $this->creating_order = null;
459 - }
460 -
461 - $this->wcpos_snapshot_tax_ids_to_order( $response, $request, true );
462 -
463 436 return $response;
464 437 }
465 438
466 439 /**
467 - * Record the exact order object prepared for this create request.
440 + * Preserve the client creation time using the shared payload validator.
468 441 *
469 - * @param WC_Data|WP_Error $order Order object prepared by WooCommerce.
442 + * @param WC_Data|WP_Error $order Prepared order.
470 443 * @param WP_REST_Request $request Request object.
471 - * @param bool $creating Whether a new order is being created.
472 - *
444 + * @param bool $creating Whether this is a create.
473 445 * @return WC_Data|WP_Error
474 446 */
475 - public function wcpos_track_creating_order( $order, WP_REST_Request $request, bool $creating ) {
476 - if ( $creating && $order instanceof WC_Abstract_Order ) {
477 - $this->creating_order = $order;
478 - }
479 -
480 - return $order;
481 - }
482 -
483 - /**
484 - * Preserve client-provided order creation time for offline-created orders.
485 - *
486 - * WooCommerce marks date_created/date_created_gmt as read-only in the REST
487 - * schema, so those fields are removed before the parent controller prepares
488 - * the order. WCPOS clients can create orders offline and later sync the full
489 - * local document; read the raw JSON payload here so the server keeps the
490 - * transaction time instead of the sync time.
491 - *
492 - * @param WC_Data|WP_Error $order Order object prepared by WooCommerce.
493 - * @param WP_REST_Request $request Request object.
494 - * @param bool $creating Whether a new order is being created.
495 - *
496 - * @return WC_Data|WP_Error
497 - */
498 447 public function wcpos_preserve_client_created_date_gmt( $order, WP_REST_Request $request, bool $creating ) {
499 448 if ( ! $creating || ! ( $order instanceof WC_Abstract_Order ) ) {
500 449 return $order;
501 450 }
502 - $this->creating_order = $order;
503 -
504 451 $body = $request->get_json_params();
505 -
506 - if ( ! isset( $body['date_created_gmt'] ) ) {
507 - return $order;
452 + $timestamp = $this->order_payload->validate_client_created_gmt( is_array( $body ) ? $body : array() );
453 + if ( is_wp_error( $timestamp ) || null === $timestamp ) {
454 + return is_wp_error( $timestamp ) ? $timestamp : $order;
508 455 }
509 -
510 - if ( ! is_scalar( $body['date_created_gmt'] ) ) {
511 - return new WP_Error(
512 - 'woocommerce_pos_rest_invalid_date_created_gmt',
513 - __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
514 - array( 'status' => 400 )
515 - );
516 - }
517 -
518 - $client_date_gmt = wc_clean( wp_unslash( (string) $body['date_created_gmt'] ) );
519 -
520 - if ( '' === $client_date_gmt ) {
521 - return $order;
522 - }
523 -
524 - if ( 1 !== preg_match( '/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?$/i', $client_date_gmt ) ) {
525 - return new WP_Error(
526 - 'woocommerce_pos_rest_invalid_date_created_gmt',
527 - __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
528 - array( 'status' => 400 )
529 - );
530 - }
531 -
532 - // WooCommerce serializes *_gmt fields without a timezone suffix; treat bare values as UTC.
533 - $parse_date_gmt = 'Z' === strtoupper( substr( $client_date_gmt, -1 ) )
534 - ? $client_date_gmt
535 - : $client_date_gmt . 'Z';
536 - $timestamp = rest_parse_date(
537 - $parse_date_gmt,
538 - true
539 - );
540 -
541 - if ( false === $timestamp ) {
542 - return new WP_Error(
543 - 'woocommerce_pos_rest_invalid_date_created_gmt',
544 - __( 'date_created_gmt must be a valid ISO 8601 UTC date.', 'woocommerce-pos' ),
545 - array( 'status' => 400 )
546 - );
547 - }
548 -
549 - $maximum_future_timestamp = time() + DAY_IN_SECONDS;
550 -
551 - if ( $timestamp > $maximum_future_timestamp ) {
552 - return new WP_Error(
553 - 'woocommerce_pos_rest_future_date_created_gmt',
554 - __( 'date_created_gmt cannot be more than 24 hours in the future.', 'woocommerce-pos' ),
555 - array( 'status' => 400 )
556 - );
557 - }
558 -
559 456 $order->set_date_created( $timestamp );
560 -
561 457 return $order;
562 458 }
563 459
564 460 /**
@@ -594,28 +490,21 @@
594 490 }
595 491
596 492 // Proceed with the parent method to handle the update.
597 493 $response = parent::update_item( $request );
598 - $this->wcpos_snapshot_tax_ids_to_order( $response, $request, false );
494 + $this->wcpos_refresh_tax_ids_response( $response, $request, false );
599 495
600 496 return $response;
601 497 }
602 498
603 499 /**
604 - * Persist tax_ids onto the order.
500 + * Adapt the parent response to the shared snapshot and refresh its tax_ids.
605 501 *
606 - * On create: if the request did not provide `tax_ids`, snapshot from the
607 - * resolved customer record so the order is self-contained. If the request
608 - * provided `tax_ids`, write those (cashier-entered tax IDs override).
609 - *
610 - * On update: only write what the request explicitly provided; never
611 - * re-snapshot, since editing a customer must not mutate historical orders.
612 - *
613 502 * @param mixed $response Response from parent controller.
614 503 * @param WP_REST_Request $request Original request.
615 504 * @param bool $is_create True for create, false for update.
616 505 */
617 - protected function wcpos_snapshot_tax_ids_to_order( $response, WP_REST_Request $request, bool $is_create ): void {
506 + private function wcpos_refresh_tax_ids_response( $response, WP_REST_Request $request, bool $is_create ): void {
618 507 if ( ! ( $response instanceof WP_REST_Response ) ) {
619 508 return;
620 509 }
621 510
@@ -623,27 +512,13 @@
623 512 $order_id = isset( $data['id'] ) ? (int) $data['id'] : 0;
624 513 if ( $order_id <= 0 ) {
625 514 return;
626 515 }
627 - $order = \wc_get_order( $order_id );
628 - if ( ! $order ) {
629 - return;
516 + $tax_ids = $this->order_payload->persist_tax_ids( $order_id, $request->get_params(), $is_create );
517 + if ( null !== $tax_ids ) {
518 + $data['tax_ids'] = $tax_ids;
519 + $response->set_data( $data );
630 520 }
631 -
632 - $tax_ids = $request->get_param( 'tax_ids' );
633 - $writer = new Tax_Id_Writer();
634 -
635 - if ( \is_array( $tax_ids ) ) {
636 - $writer->write_for_order( $order, $tax_ids );
637 - } elseif ( $is_create ) {
638 - $customer_id = (int) $order->get_customer_id();
639 - if ( $customer_id > 0 ) {
640 - $writer->snapshot_from_user_to_order( $order, $customer_id );
641 - }
642 - }
643 -
644 - $data['tax_ids'] = ( new Tax_Id_Reader() )->read_for_order( $order );
645 - $response->set_data( $data );
646 521 }
647 522
648 523 /**
649 524 * Create or update a line item.
@@ -980,8 +855,34 @@
980 855 );
981 856 }
982 857
983 858 /**
859 + * Get the route schema for the send-email action.
860 + *
861 + * Registered as the route-level `schema` callback. WordPress invokes it with
862 + * `call_user_func()` whenever a namespace index is requested with
863 + * `context=help`, so it must be a real callable — an empty array there
864 + * passes `isset()` and then fatals with a TypeError.
865 + *
866 + * @return array
867 + */
868 + public function wcpos_get_public_send_email_schema() {
869 + return array(
870 + '$schema' => 'http://json-schema.org/draft-04/schema#',
871 + 'title' => 'order_email',
872 + 'type' => 'object',
873 + 'properties' => array(
874 + 'success' => array(
875 + 'description' => __( 'Whether the order email was sent.', 'woocommerce-pos' ),
876 + 'type' => 'boolean',
877 + 'context' => array( 'view', 'edit' ),
878 + 'readonly' => true,
879 + ),
880 + ),
881 + );
882 + }
883 +
884 + /**
984 885 * Modify the order response.
985 886 *
986 887 * @param WP_REST_Response $response The response object.
987 888 * @param WC_Abstract_Order $order Object data.
@@ -1111,9 +1012,10 @@
1111 1012 *
1112 1013 * @throws \WC_Data_Exception If order data is invalid.
1113 1014 */
1114 1015 public function wcpos_before_order_object_save( WC_Abstract_Order $order ): void {
1115 - $is_creating_order = $order === $this->creating_order;
1016 + $intent = Order_Write_Intent::current();
1017 + $is_creating_order = null !== $intent && $intent->is_create() && $intent->is_subject( $order );
1116 1018
1117 1019 if ( $is_creating_order && method_exists( $order, 'set_created_via' ) ) {
1118 1020 $order->set_created_via( PLUGIN_NAME );
1119 1021 // Record provenance only; receipt calculations continue to infer historical