| @@ -61,8 +61,11 @@ | ||
| 61 | 61 | $params = $request->get_query_params(); |
| 62 | 62 | |
| 63 | 63 | return new WP_REST_Response( |
| 64 | 64 | array( |
| 65 | + // Stays 1: shipped clients hard-gate on `v === 1` and read a | |
| 66 | + // mismatch as "not the echo route" (hydration-steps.ts), so an | |
| 67 | + // additive field must not bump it. | |
| 65 | 68 | 'v' => 1, |
| 66 | 69 | 'headers' => $headers, |
| 67 | 70 | 'params' => array( |
| 68 | 71 | 'authorization' => isset( $params['authorization'] ) && '' !== $params['authorization'], |
| @@ -67,9 +70,18 @@ | ||
| 67 | 70 | 'params' => array( |
| 68 | 71 | 'authorization' => isset( $params['authorization'] ) && '' !== $params['authorization'], |
| 69 | 72 | 'wcpos' => isset( $params['wcpos'] ) && '' !== $params['wcpos'], |
| 70 | 73 | 'store_id' => isset( $params['store_id'] ) && '' !== $params['store_id'], |
| 74 | + 'wcpos_protocol' => isset( $params['wcpos_protocol'] ) && '' !== $params['wcpos_protocol'], | |
| 75 | + 'wcpos_client' => isset( $params['wcpos_client'] ) && '' !== $params['wcpos_client'], | |
| 71 | 76 | ), |
| 77 | + // Means: this SERVER reflects announced x-wcpos-* names at | |
| 78 | + // preflight ({@see \WCPOS\WooCommercePOS\Rest_Cors}). It does | |
| 79 | + // NOT prove this store's preflights reach PHP — an edge that | |
| 80 | + // answers OPTIONS itself still blocks new headers, so a client | |
| 81 | + // must confirm the path with one cross-origin request carrying | |
| 82 | + // a throwaway x-wcpos-* header before trusting header transport. | |
| 83 | + 'cors' => array( 'reflects_request_headers' => true ), | |
| 72 | 84 | ), |
| 73 | 85 | 200 |
| 74 | 86 | ); |
| 75 | 87 | } |
