← All changes | includes/API/V1/Customers_Controller.php +27 -37 1.10.7 → 1.10.18 View file →

		@@ -16,13 +16,15 @@
16	16	use Exception;
17	17	use WC_Customer;
18	18	use WC_REST_Customers_Controller;
19	19	use WCPOS\WooCommercePOS\Logger;
	20	+use WCPOS\WooCommercePOS\Services\Permission_Rules;
20	21	use WCPOS\WooCommercePOS\Services\Settings as SettingsService;
21	22	use WCPOS\WooCommercePOS\Services\Tax_Id_Reader;
22	23	use WCPOS\WooCommercePOS\Services\Tax_Id_Types;
23	24	use WCPOS\WooCommercePOS\Services\Tax_Id_Writer;
24	25	use WCPOS\WooCommercePOS\Sync\Collection_Rules;
	26	+use WCPOS\WooCommercePOS\Sync\Meta_Normalizer;
25	27	use WP_Error;
26	28	use WP_REST_Request;
27	29	use WP_REST_Response;
28	30	use WP_User;
		@@ -127,53 +129,30 @@
127	129
128	130	return $schema;
129	131	}
130	132
131		- /**
132		- * Check if a given request has access to create a customer.
	133	+ /** Delegate the create decision, preserving WooCommerce's request-dependent checks.
133	134	*
134		- * WC checks promote_users (< 9.9) or create_customers (9.9+). The POS
135		- * fallback checks only the version-appropriate capability so it matches
136		- * the toggle shown on the Access settings page.
137		- *
138		- * @param WP_REST_Request $request Full details about the request.
139		- *
140		- * @return WP_Error|bool
	135	+ * @param \WP_REST_Request $request Full request details.
141	136	*/
142	137	public function create_item_permissions_check( $request ) {
143		- $permission = parent::create_item_permissions_check( $request );
144		-
145		- if ( is_wp_error( $permission ) ) {
146		- $customer_create_cap = version_compare( WC()->version, '9.9', '>=' )
147		- ? 'create_customers'
148		- : 'promote_users';
149		-
150		- if ( current_user_can( $customer_create_cap ) ) {
151		- return true;
152		- }
153		- }
154		-
155		- return $permission;
	138	+ return Permission_Rules::verdict( 'customers', 'create', (int) $request['id'], 0, 'v1', $request->get_params() );
156	139	}
157	140
158		- /**
159		- * Check if a given request has access to update a customer.
	141	+ /** Delegate the edit decision, preserving WooCommerce's request-dependent checks.
160	142	*
161		- * WC checks edit_users. The POS fallback also checks edit_users so the
162		- * Access settings page toggle controls this behaviour.
163		- *
164		- * @param WP_REST_Request $request Full details about the request.
165		- *
166		- * @return WP_Error|bool
	143	+ * @param \WP_REST_Request $request Full request details.
167	144	*/
168	145	public function update_item_permissions_check( $request ) {
169		- $permission = parent::update_item_permissions_check( $request );
	146	+ return Permission_Rules::verdict( 'customers', 'edit', (int) $request['id'], 0, 'v1', $request->get_params() );
	147	+ }
170	148
171		- if ( is_wp_error( $permission ) && current_user_can( 'edit_users' ) ) {
172		- return true;
173		- }
174		-
175		- return $permission;
	149	+ /** Delegate the delete decision, preserving WooCommerce's request-dependent checks.
	150	+ *
	151	+ * @param \WP_REST_Request $request Full request details.
	152	+ */
	153	+ public function delete_item_permissions_check( $request ) {
	154	+ return Permission_Rules::verdict( 'customers', 'delete', (int) $request['id'], 0, 'v1', $request->get_params() );
176	155	}
177	156
178	157	/**
179	158	* Add extra fields to WP_REST_Controller::get_collection_params().
		@@ -390,9 +369,20 @@
390	369
391	370	$filtered_meta_data = array_filter(
392	371	$raw_meta_data,
393	372	function ( $meta ) {
394		- return ! is_protected_meta( $meta->key, 'user' );
	373	+ if ( is_protected_meta( $meta->key, 'user' ) ) {
	374	+ return false;
	375	+ }
	376	+ // A single enormous value fatals the response encoder no matter how few
	377	+ // entries the customer has; same budget as the v2 sync lane.
	378	+ if ( Meta_Normalizer::exceeds_value_budget( $meta->value ) ) {
	379	+ Meta_Normalizer::note_oversized_meta( (string) $meta->key, (int) $meta->id );
	380	+
	381	+ return false;
	382	+ }
	383	+
	384	+ return true;
395	385	}
396	386	);
397	387
398	388	// Convert to WC REST API expected format.