| @@ -7,8 +7,9 @@ | ||
| 7 | 7 | |
| 8 | 8 | namespace WCPOS\WooCommercePOS\API\V2; |
| 9 | 9 | |
| 10 | 10 | use WCPOS\WooCommercePOS\API\V2\Writers\Collection_Writer_Resolver; |
| 11 | +use WCPOS\WooCommercePOS\Services\Permission_Rules; | |
| 11 | 12 | use WCPOS\WooCommercePOS\Services\Tax_Id_Types; |
| 12 | 13 | use WCPOS\WooCommercePOS\Sync\Api; |
| 13 | 14 | use WCPOS\WooCommercePOS\Sync\Collections; |
| 14 | 15 | use WCPOS\WooCommercePOS\Sync\Endpoint_Permissions; |
| @@ -43,8 +44,9 @@ | ||
| 43 | 44 | * live in an injected mutation store, so the apply logic is unit-testable with a |
| 44 | 45 | * fake store + a stubbed `rest_do_request`. |
| 45 | 46 | */ |
| 46 | 47 | class Write_Controller extends WP_REST_Controller { |
| 48 | + | |
| 47 | 49 | // Our gate (capability + F13 health); forwarded writes scope the client-tier grant below. |
| 48 | 50 | use Endpoint_Permissions; |
| 49 | 51 | |
| 50 | 52 | |
| @@ -433,58 +435,8 @@ | ||
| 433 | 435 | return $this->envelope_document( $this->document_for( $meta, $new_id ), $m['recordId'], $meta, $new_id, $response->get_status(), $writer ); |
| 434 | 436 | } |
| 435 | 437 | |
| 436 | 438 | /** |
| 437 | - * The grace comparer (#423 step 2, option `woo_rxdb_sync_legacy_revision_grace`, | |
| 438 | - * default on until retirement): on a canonical mismatch, accept a baseRevision | |
| 439 | - * that matches the CURRENT document under a PRE-CUTOVER form — | |
| 440 | - * - the legacy order sha256 (no ksort, volatiles included): same content, | |
| 441 | - * old algorithm ⇒ the precondition is genuinely current; | |
| 442 | - * - a pre-taxonomy-sort sha256 for non-orders: same content, previous | |
| 443 | - * canonicalizer ⇒ queued writes survive the revision transition; | |
| 444 | - * - a pre-1b lane synthesis (non-sha256 values the client fetchers stored | |
| 445 | - * as sync.revision before the proxy revision stamp): date_modified_gmt | |
| 446 | - * for order/post/user collections, String(id) for term collections | |
| 447 | - * (deliberately vacuous — that lane never had optimistic concurrency; | |
| 448 | - * grace honours the contract the record was written under). | |
| 449 | - * A real conflict mismatches every form → 409 exactly as before. The ack | |
| 450 | - * always returns the CANONICAL currentRevision, re-anchoring the client. | |
| 451 | - */ | |
| 452 | - private function revision_matches_with_grace( $base, string $current_revision, array $meta, int $id, array $bare, bool $allow_term_grace = true ): bool { | |
| 453 | - if ( $base === $current_revision ) { | |
| 454 | - return true; | |
| 455 | - } | |
| 456 | - if ( ! is_string( $base ) || 'yes' !== get_option( 'woocommerce_pos_sync_legacy_revision_grace', 'yes' ) ) { | |
| 457 | - return false; | |
| 458 | - } | |
| 459 | - if ( 0 === strpos( $base, 'sha256:' ) ) { | |
| 460 | - if ( 'order' === ( $meta['id_type'] ?? '' ) && $id > 0 ) { | |
| 461 | - if ( Order_Serializer::pre_augmentation_canonical_revision( $bare ) === $base | |
| 462 | - || Order_Serializer::pre_item_uuid_canonical_revision( $bare ) === $base ) { | |
| 463 | - return true; | |
| 464 | - } | |
| 465 | - $payload = ( new Order_Serializer() )->serialize_order( $id, new WP_REST_Request() ); | |
| 466 | - return Order_Serializer::legacy_revision( $payload ) === $base; | |
| 467 | - } | |
| 468 | - return Revision::pre_taxonomy_sort_revision( $bare ) === $base; | |
| 469 | - } | |
| 470 | - $id_type = $meta['id_type'] ?? ''; | |
| 471 | - if ( in_array( $id_type, array( 'order', 'post', 'user' ), true ) ) { | |
| 472 | - // Read the date from wherever the document carries it. A variation's document is the | |
| 473 | - // `{ id, parent_id, payload }` wrapper, so a top-level-only read makes this branch dead | |
| 474 | - // code for the one collection whose canonical revision IS a date — and it would come | |
| 475 | - // back to life, silently, the day the wrapper is dropped. | |
| 476 | - $nested = isset( $bare['payload'] ) && is_array( $bare['payload'] ) ? $bare['payload'] : array(); | |
| 477 | - $date = (string) ( $bare['date_modified_gmt'] ?? $nested['date_modified_gmt'] ?? '' ); | |
| 478 | - return '' !== $date && $base === $date; | |
| 479 | - } | |
| 480 | - if ( 'term' === $id_type && $allow_term_grace ) { | |
| 481 | - return (string) ( $bare['id'] ?? '' ) === $base; | |
| 482 | - } | |
| 483 | - return false; | |
| 484 | - } | |
| 485 | - | |
| 486 | - /** | |
| 487 | 439 | * The pre-CAS post-type capability gate shared by the update and delete paths. |
| 488 | 440 | * |
| 489 | 441 | * Only the WP-post-backed collections carry a Woo capability check of their own; |
| 490 | 442 | * every other collection is gated by the endpoint permission callback alone, so |
| @@ -542,9 +494,9 @@ | ||
| 542 | 494 | return $current; |
| 543 | 495 | } |
| 544 | 496 | $current_bare = is_array( $current->get_data() ) ? $current->get_data() : array(); |
| 545 | 497 | $current_revision = $this->revision_for( $meta, $id, $current_bare ); |
| 546 | - if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare ) ) { | |
| 498 | + if ( $m['baseRevision'] !== $current_revision ) { | |
| 547 | 499 | return new WP_REST_Response( |
| 548 | 500 | array( |
| 549 | 501 | 'code' => 'woo_rxdb_sync_conflict', |
| 550 | 502 | 'message' => 'baseRevision is stale.', |
| @@ -607,9 +559,9 @@ | ||
| 607 | 559 | return $current; |
| 608 | 560 | } |
| 609 | 561 | $current_bare = is_array( $current->get_data() ) ? $current->get_data() : array(); |
| 610 | 562 | $current_revision = $this->revision_for( $meta, $id, $current_bare ); |
| 611 | - if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare, false ) ) { | |
| 563 | + if ( $m['baseRevision'] !== $current_revision ) { | |
| 612 | 564 | return new WP_REST_Response( |
| 613 | 565 | array( |
| 614 | 566 | 'code' => 'woo_rxdb_sync_conflict', |
| 615 | 567 | 'message' => 'baseRevision is stale.', |
| @@ -641,13 +593,13 @@ | ||
| 641 | 593 | * |
| 642 | 594 | * @param int $id The order id. |
| 643 | 595 | */ |
| 644 | 596 | private function can_forward_delete( int $id ): bool { |
| 645 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 597 | + Permission_Rules::install_wc_filter(); | |
| 646 | 598 | try { |
| 647 | 599 | return (bool) wc_rest_check_post_permissions( 'shop_order', 'delete', $id ); |
| 648 | 600 | } finally { |
| 649 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 601 | + Permission_Rules::uninstall_wc_filter(); | |
| 650 | 602 | } |
| 651 | 603 | } |
| 652 | 604 | |
| 653 | 605 | private function checkpoint_and_finalize( string $mutation_id, int $remote_id, int $response_status ) { |
| @@ -793,9 +745,9 @@ | ||
| 793 | 745 | */ |
| 794 | 746 | private function dispatch_write( WP_REST_Request $request ) { |
| 795 | 747 | // Stamp here so direct callers (notably deletes) carry the scope too. |
| 796 | 748 | Store_Scope::stamp( $request ); |
| 797 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 749 | + Permission_Rules::install_wc_filter(); | |
| 798 | 750 | try { |
| 799 | 751 | // Marked as OUR traffic for the duration of the forward, so a consumer |
| 800 | 752 | // keyed on store scope can act on a till write without also claiming |
| 801 | 753 | // every stock wc/v3 product write on the site (pro#425 review). |
| @@ -804,65 +756,15 @@ | ||
| 804 | 756 | return rest_do_request( $request ); |
| 805 | 757 | } |
| 806 | 758 | ); |
| 807 | 759 | } finally { |
| 808 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 760 | + Permission_Rules::uninstall_wc_filter(); | |
| 809 | 761 | } |
| 810 | 762 | } |
| 811 | 763 | |
| 812 | - /** | |
| 813 | - * Authorize proxied catalog mutations for POS users. | |
| 814 | - * | |
| 815 | - * This filter is attached only while a sync push is forwarded to wc/v3, so | |
| 816 | - * direct WooCommerce requests keep their normal permission checks. | |
| 817 | - * | |
| 818 | - * @param bool $permission The current permission. | |
| 819 | - * @param string $context The request context. | |
| 820 | - * @param int $object_id The object ID. | |
| 821 | - * @param string $post_type The object type passed by WooCommerce. | |
| 822 | - * | |
| 823 | - * @return bool | |
| 824 | - */ | |
| 764 | + /** @deprecated Use Permission_Rules::wc_filter(). */ | |
| 825 | 765 | public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) { |
| 826 | - // Catalog and coupon WRITES require the user's real WooCommerce | |
| 827 | - // capabilities — no POS-tier widening. The cashier role is deliberately | |
| 828 | - // read-only on catalog (Activator), and a blanket grant here handed | |
| 829 | - // every POS user product deletion and coupon minting. Product decision | |
| 830 | - // 2026-08-06: strict wc/v3 parity for catalog mutations; only the | |
| 831 | - // HPOS placeholder remap below (orders) adjusts anything, and it never | |
| 832 | - // grants beyond the user's own role caps. | |
| 833 | - | |
| 834 | - // Orders: with HPOS enabled (sync off), get_post() yields shop_order_placehold | |
| 835 | - // (map_meta_cap = false, no capability_type), so WooCommerce's REST check maps | |
| 836 | - // to the generic edit_post/delete_post caps that cashier-tier roles lack — | |
| 837 | - // even though they hold the real shop_orders caps. Re-check the capability the | |
| 838 | - // mapping SHOULD have produced, mirroring V1\Orders_Controller's | |
| 839 | - // update_item_permissions_check fix. No grant beyond the user's own role caps. | |
| 840 | - if ( ! $permission && 'shop_order' === $post_type ) { | |
| 841 | - $order_caps = array( | |
| 842 | - 'read' => 'read_private_shop_orders', | |
| 843 | - 'create' => 'publish_shop_orders', | |
| 844 | - 'delete' => 'delete_shop_orders', | |
| 845 | - ); | |
| 846 | - $order_cap = $order_caps[ $context ] ?? null; | |
| 847 | - // edit and delete are ownership-sensitive: the base *_shop_orders cap only | |
| 848 | - // authorizes acting on the user's OWN orders. Touching another user's order | |
| 849 | - // additionally requires the *_others_shop_orders cap, mirroring WooCommerce's | |
| 850 | - // own meta-cap map. Without this, a cashier with delete_shop_orders (but not | |
| 851 | - // delete_others_shop_orders) could delete/void orders they do not own. | |
| 852 | - if ( \in_array( $context, array( 'edit', 'delete' ), true ) ) { | |
| 853 | - $order_post = get_post( $object_id ); | |
| 854 | - if ( $order_post ) { | |
| 855 | - $owns_order = get_current_user_id() === (int) $order_post->post_author; | |
| 856 | - $order_cap = $owns_order ? "{$context}_shop_orders" : "{$context}_others_shop_orders"; | |
| 857 | - } | |
| 858 | - } | |
| 859 | - if ( $order_cap && current_user_can( $order_cap ) ) { | |
| 860 | - $permission = true; | |
| 861 | - } | |
| 862 | - } | |
| 863 | - | |
| 864 | - return $permission; | |
| 766 | + return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'writes' ); | |
| 865 | 767 | } |
| 866 | 768 | |
| 867 | 769 | /** |
| 868 | 770 | * Read this collection's document for one record, through its writer. |
| @@ -967,12 +869,11 @@ | ||
| 967 | 869 | * |
| 968 | 870 | * This used to read `$bare['payload']['date_modified_gmt']` only, with `$bare['id']` as |
| 969 | 871 | * the fallback. Against a FLAT document that silently degrades to the variation's own |
| 970 | 872 | * ID — a value that never changes again. The failure would be total and invisible: |
| 971 | - * `revision_matches_with_grace()` would still let a queued date-based write through | |
| 972 | - * (with the wrapper gone, its top-level `date_modified_gmt` branch finally resolves), | |
| 973 | 873 | * the ack would hand the client the id as `currentRevision`, and from then on every |
| 974 | - * stale baseRevision would equal every recomputed one. Two tills editing the same | |
| 874 | + * stale baseRevision would equal every recomputed one — the strict revision | |
| 875 | + * comparison would pass every queued write. Two tills editing the same | |
| 975 | 876 | * variation hours apart would both pass the precondition; the per-record lock would |
| 976 | 877 | * serialize them, so there would be no error — just a lost update, every time. |
| 977 | 878 | * |
| 978 | 879 | * The `$bare['id']` fallback is kept ONLY for a document carrying no date at all, and is |
