| @@ -7,12 +7,13 @@ | ||
| 7 | 7 | |
| 8 | 8 | namespace WCPOS\WooCommercePOS\API\V2; |
| 9 | 9 | |
| 10 | 10 | use WCPOS\WooCommercePOS\API\V2\Writers\Collection_Writer_Resolver; |
| 11 | -use WCPOS\WooCommercePOS\Services\Customer_Account_Guard; | |
| 11 | +use WCPOS\WooCommercePOS\Services\Permission_Rules; | |
| 12 | 12 | use WCPOS\WooCommercePOS\Services\Tax_Id_Types; |
| 13 | 13 | use WCPOS\WooCommercePOS\Sync\Api; |
| 14 | 14 | use WCPOS\WooCommercePOS\Sync\Collections; |
| 15 | +use WCPOS\WooCommercePOS\Sync\Create_Identity; | |
| 15 | 16 | use WCPOS\WooCommercePOS\Sync\Endpoint_Permissions; |
| 16 | 17 | use WCPOS\WooCommercePOS\Sync\Header_Mirror; |
| 17 | 18 | use WCPOS\WooCommercePOS\Sync\Meta_Normalizer; |
| 18 | 19 | use WCPOS\WooCommercePOS\Sync\Mutation_Store; |
| @@ -44,14 +45,8 @@ | ||
| 44 | 45 | * live in an injected mutation store, so the apply logic is unit-testable with a |
| 45 | 46 | * fake store + a stubbed `rest_do_request`. |
| 46 | 47 | */ |
| 47 | 48 | class Write_Controller extends WP_REST_Controller { |
| 48 | - /** | |
| 49 | - * True while wc_rest_check_user_permissions() is re-run for a cleared target. | |
| 50 | - * | |
| 51 | - * @var bool | |
| 52 | - */ | |
| 53 | - private $rejudging_user_target = false; | |
| 54 | 49 | |
| 55 | 50 | // Our gate (capability + F13 health); forwarded writes scope the client-tier grant below. |
| 56 | 51 | use Endpoint_Permissions; |
| 57 | 52 | |
| @@ -58,9 +53,12 @@ | ||
| 58 | 53 | |
| 59 | 54 | /** @var mixed Duck-typed mutation store; tests inject an in-memory implementation. */ |
| 60 | 55 | private $store; |
| 61 | 56 | |
| 57 | + /** @var Create_Identity Shared proof for fresh and poisoned creates. */ | |
| 58 | + private Create_Identity $identity; | |
| 62 | 59 | |
| 60 | + | |
| 63 | 61 | /** |
| 64 | 62 | * collection => wc/v3 route + how its uuid→id is resolved. ONE table, not |
| 65 | 63 | * per-collection controllers. Only collections whose resolver is correct AND |
| 66 | 64 | * exercised are exposed; the rest stay out until their phase: |
| @@ -105,8 +103,9 @@ | ||
| 105 | 103 | } |
| 106 | 104 | |
| 107 | 105 | public function __construct( $store = null ) { |
| 108 | 106 | $this->store = $store ? $store : new Mutation_Store(); |
| 107 | + $this->identity = new Create_Identity( $this->store ); | |
| 109 | 108 | } |
| 110 | 109 | |
| 111 | 110 | /** Resolve the collection-specific writer for registry metadata. */ |
| 112 | 111 | private function writer( array $meta ) { |
| @@ -226,9 +225,14 @@ | ||
| 226 | 225 | return $mismatch; |
| 227 | 226 | } |
| 228 | 227 | } |
| 229 | 228 | if ( is_array( $hit ) && 'poison' === ( $hit['status'] ?? '' ) ) { |
| 230 | - return $this->retry_identity_stamp( $meta, $m, $hit ); | |
| 229 | + $writer = $this->writer( $meta ); | |
| 230 | + $recovered = $this->identity->recover( $meta, $m, $hit, $writer ); | |
| 231 | + if ( is_wp_error( $recovered ) ) { | |
| 232 | + return $recovered; | |
| 233 | + } | |
| 234 | + return $this->envelope_document( $this->document_for( $meta, $recovered['id'] ), $m['recordId'], $meta, $recovered['id'], $recovered['status'], $writer ); | |
| 231 | 235 | } |
| 232 | 236 | if ( is_array( $hit ) && in_array( ( $hit['status'] ?? '' ), array( 'done', 'applied' ), true ) ) { |
| 233 | 237 | if ( 'applied' === $hit['status'] && ! $this->store->finalize( $m['mutationId'], (int) $hit['remote_id'] ) ) { |
| 234 | 238 | return $this->finalize_error(); |
| @@ -412,33 +416,12 @@ | ||
| 412 | 416 | $this->store->mark_indeterminate( $m['mutationId'], 0, $response->get_status() ); |
| 413 | 417 | return new WP_Error( 'woo_rxdb_sync_create_no_id', 'Create returned no server id.', array( 'status' => 502 ) ); |
| 414 | 418 | } |
| 415 | 419 | |
| 416 | - // Poison checkpoint, UUID persistence, and finalization remain shared here. | |
| 417 | - $checkpointed = $this->store->mark_poison( $m['mutationId'], $new_id, $response->get_status() ); | |
| 418 | - $writer->persist( 'create_before_identity', $new_id, $m['payload'] ); | |
| 419 | - $identity_error = null; | |
| 420 | - if ( ! $this->store->persist_uuid( $meta['id_type'], $new_id, $m['recordId'] ) ) { | |
| 421 | - $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 422 | - } else { | |
| 423 | - $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $m['recordId'], $meta ); | |
| 424 | - if ( is_wp_error( $resolved ) ) { | |
| 425 | - $identity_error = $resolved; | |
| 426 | - } elseif ( $resolved !== $new_id ) { | |
| 427 | - $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 428 | - } | |
| 420 | + $stamped = $this->identity->stamp( $meta, $m, $new_id, $response->get_status(), $writer ); | |
| 421 | + if ( is_wp_error( $stamped ) ) { | |
| 422 | + return $stamped; | |
| 429 | 423 | } |
| 430 | - if ( ! $checkpointed ) { | |
| 431 | - $this->store->mark_indeterminate( $m['mutationId'], $new_id, $response->get_status() ); | |
| 432 | - return $this->finalize_error(); | |
| 433 | - } | |
| 434 | - if ( $identity_error ) { | |
| 435 | - return $identity_error; | |
| 436 | - } | |
| 437 | - $writer->persist( 'create_after_identity', $new_id, $m['payload'] ); | |
| 438 | - if ( ! $this->store->finalize_poison( $m['mutationId'], $new_id ) ) { | |
| 439 | - return $this->finalize_error(); | |
| 440 | - } | |
| 441 | 424 | return $this->envelope_document( $this->document_for( $meta, $new_id ), $m['recordId'], $meta, $new_id, $response->get_status(), $writer ); |
| 442 | 425 | } |
| 443 | 426 | |
| 444 | 427 | /** |
| @@ -525,9 +508,9 @@ | ||
| 525 | 508 | if ( $response->get_status() >= 400 ) { |
| 526 | 509 | return new WP_REST_Response( $response->get_data(), $response->get_status() ); |
| 527 | 510 | } |
| 528 | 511 | $data = $response->get_data(); |
| 529 | - $writer->persist( 'update', $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] ); | |
| 512 | + $writer->after_update( $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] ); | |
| 530 | 513 | |
| 531 | 514 | $this->store->persist_uuid( $meta['id_type'], $id, $m['recordId'] ); |
| 532 | 515 | $finalized = $this->checkpoint_and_finalize( $m['mutationId'], $id, $response->get_status() ); |
| 533 | 516 | if ( is_wp_error( $finalized ) ) { |
| @@ -599,13 +582,13 @@ | ||
| 599 | 582 | * |
| 600 | 583 | * @param int $id The order id. |
| 601 | 584 | */ |
| 602 | 585 | private function can_forward_delete( int $id ): bool { |
| 603 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 586 | + Permission_Rules::install_wc_filter(); | |
| 604 | 587 | try { |
| 605 | 588 | return (bool) wc_rest_check_post_permissions( 'shop_order', 'delete', $id ); |
| 606 | 589 | } finally { |
| 607 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 590 | + Permission_Rules::uninstall_wc_filter(); | |
| 608 | 591 | } |
| 609 | 592 | } |
| 610 | 593 | |
| 611 | 594 | private function checkpoint_and_finalize( string $mutation_id, int $remote_id, int $response_status ) { |
| @@ -647,43 +630,8 @@ | ||
| 647 | 630 | $writer = $this->writer( $meta ); |
| 648 | 631 | return $this->envelope_document( $this->document_for( $meta, $remote_id ), $expected, $meta, $remote_id, $status, $writer ); |
| 649 | 632 | } |
| 650 | 633 | |
| 651 | - private function retry_identity_stamp( array $meta, array $m, array $hit ) { | |
| 652 | - $remote_id = (int) ( $hit['remote_id'] ?? 0 ); | |
| 653 | - $record_uuid = (string) ( $hit['record_uuid'] ?? '' ); | |
| 654 | - if ( $record_uuid !== $m['recordId'] ) { | |
| 655 | - return new WP_Error( 'woo_rxdb_sync_identity_conflict', 'recordId disagrees with the stored mutation identity.', array( 'status' => 422 ) ); | |
| 656 | - } | |
| 657 | - if ( 'create' !== ( $hit['operation'] ?? '' ) || $remote_id <= 0 ) { | |
| 658 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Created record identity cannot be recovered safely.', array( 'status' => 500 ) ); | |
| 659 | - } | |
| 660 | - $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta ); | |
| 661 | - if ( is_wp_error( $resolved ) ) { | |
| 662 | - return $resolved; | |
| 663 | - } | |
| 664 | - if ( $resolved > 0 && $resolved !== $remote_id ) { | |
| 665 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Stored create identity points at a different record.', array( 'status' => 500 ) ); | |
| 666 | - } | |
| 667 | - if ( ! $this->store->persist_uuid( $meta['id_type'], $remote_id, $record_uuid ) ) { | |
| 668 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 669 | - } | |
| 670 | - $verified = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta ); | |
| 671 | - if ( is_wp_error( $verified ) ) { | |
| 672 | - return $verified; | |
| 673 | - } | |
| 674 | - if ( $verified !== $remote_id ) { | |
| 675 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 676 | - } | |
| 677 | - $writer = $this->writer( $meta ); | |
| 678 | - $writer->persist( 'create_recovery', $remote_id, $m['payload'] ); | |
| 679 | - if ( ! $this->store->finalize_poison( $m['mutationId'], $remote_id ) ) { | |
| 680 | - return $this->finalize_error(); | |
| 681 | - } | |
| 682 | - $status = isset( $hit['response_status'] ) ? (int) $hit['response_status'] : 201; | |
| 683 | - return $this->envelope_document( $this->document_for( $meta, $remote_id ), $record_uuid, $meta, $remote_id, $status, $writer ); | |
| 684 | - } | |
| 685 | - | |
| 686 | 634 | /** |
| 687 | 635 | * Validate a client-submitted `tax_ids` payload against the v1 schema. |
| 688 | 636 | * |
| 689 | 637 | * tax_ids is unknown to the stock wc/v3 controllers and is stripped before the forward, |
| @@ -751,9 +699,9 @@ | ||
| 751 | 699 | */ |
| 752 | 700 | private function dispatch_write( WP_REST_Request $request ) { |
| 753 | 701 | // Stamp here so direct callers (notably deletes) carry the scope too. |
| 754 | 702 | Store_Scope::stamp( $request ); |
| 755 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 703 | + Permission_Rules::install_wc_filter(); | |
| 756 | 704 | try { |
| 757 | 705 | // Marked as OUR traffic for the duration of the forward, so a consumer |
| 758 | 706 | // keyed on store scope can act on a till write without also claiming |
| 759 | 707 | // every stock wc/v3 product write on the site (pro#425 review). |
| @@ -762,104 +710,15 @@ | ||
| 762 | 710 | return rest_do_request( $request ); |
| 763 | 711 | } |
| 764 | 712 | ); |
| 765 | 713 | } finally { |
| 766 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 714 | + Permission_Rules::uninstall_wc_filter(); | |
| 767 | 715 | } |
| 768 | 716 | } |
| 769 | 717 | |
| 770 | - /** | |
| 771 | - * Judge a customer edit or delete the way V1\Customers_Controller does. | |
| 772 | - * | |
| 773 | - * The staff guard runs first and is final. A target it has cleared is then | |
| 774 | - * re-judged by WooCommerce with the target's own roles allowed through the | |
| 775 | - * shop_manager role-name restriction, so a shop manager can edit a subscriber | |
| 776 | - * from a current app exactly as from the legacy route. WooCommerce's | |
| 777 | - * credential fence is untouched: it runs in the controller, not here. | |
| 778 | - * | |
| 779 | - * @param bool $permission WooCommerce's verdict so far. | |
| 780 | - * @param string $context 'edit' or 'delete'. | |
| 781 | - * @param int $target_id Target user ID. | |
| 782 | - */ | |
| 783 | - private function check_user_permission( bool $permission, string $context, int $target_id ): bool { | |
| 784 | - if ( $this->rejudging_user_target ) { | |
| 785 | - return $permission; | |
| 786 | - } | |
| 787 | - if ( ! Customer_Account_Guard::can_modify( get_current_user_id(), $target_id ) ) { | |
| 788 | - return false; | |
| 789 | - } | |
| 790 | - if ( $permission ) { | |
| 791 | - return true; | |
| 792 | - } | |
| 793 | - $this->rejudging_user_target = true; | |
| 794 | - $restore = Customer_Account_Guard::allow_target_roles( $target_id ); | |
| 795 | - try { | |
| 796 | - return (bool) wc_rest_check_user_permissions( $context, $target_id ); | |
| 797 | - } finally { | |
| 798 | - $restore(); | |
| 799 | - $this->rejudging_user_target = false; | |
| 800 | - } | |
| 801 | - } | |
| 802 | - | |
| 803 | - /** | |
| 804 | - * Authorize proxied mutations for POS users while protecting staff accounts. | |
| 805 | - * | |
| 806 | - * This filter is attached only while a sync push is forwarded to wc/v3, so | |
| 807 | - * direct WooCommerce requests keep their normal permission checks. | |
| 808 | - * | |
| 809 | - * @param bool $permission The current permission. | |
| 810 | - * @param string $context The request context. | |
| 811 | - * @param int $object_id The object ID. | |
| 812 | - * @param string $post_type The object type passed by WooCommerce. | |
| 813 | - * | |
| 814 | - * @return bool | |
| 815 | - */ | |
| 718 | + /** @deprecated Use Permission_Rules::wc_filter(). */ | |
| 816 | 719 | public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) { |
| 817 | - // Customer edits/deletes: the staff guard is final, then a cleared target | |
| 818 | - // is judged by WooCommerce the same way the v1 controller judges it. | |
| 819 | - if ( 'user' === $post_type && (int) $object_id > 0 && \in_array( $context, array( 'edit', 'delete' ), true ) ) { | |
| 820 | - return $this->check_user_permission( (bool) $permission, $context, (int) $object_id ); | |
| 821 | - } | |
| 822 | - | |
| 823 | - // Catalog and coupon WRITES require the user's real WooCommerce | |
| 824 | - // capabilities — no POS-tier widening. The cashier role is deliberately | |
| 825 | - // read-only on catalog (Activator), and a blanket grant here handed | |
| 826 | - // every POS user product deletion and coupon minting. Product decision | |
| 827 | - // 2026-08-06: strict wc/v3 parity for catalog mutations; only the | |
| 828 | - // HPOS placeholder remap below (orders) adjusts anything, and it never | |
| 829 | - // grants beyond the user's own role caps. | |
| 830 | - | |
| 831 | - // Orders: with HPOS enabled (sync off), get_post() yields shop_order_placehold | |
| 832 | - // (map_meta_cap = false, no capability_type), so WooCommerce's REST check maps | |
| 833 | - // to the generic edit_post/delete_post caps that cashier-tier roles lack — | |
| 834 | - // even though they hold the real shop_orders caps. Re-check the capability the | |
| 835 | - // mapping SHOULD have produced, mirroring V1\Orders_Controller's | |
| 836 | - // update_item_permissions_check fix. No grant beyond the user's own role caps. | |
| 837 | - if ( ! $permission && 'shop_order' === $post_type ) { | |
| 838 | - $order_caps = array( | |
| 839 | - 'read' => 'read_private_shop_orders', | |
| 840 | - 'create' => 'publish_shop_orders', | |
| 841 | - 'delete' => 'delete_shop_orders', | |
| 842 | - ); | |
| 843 | - $order_cap = $order_caps[ $context ] ?? null; | |
| 844 | - // edit and delete are ownership-sensitive: the base *_shop_orders cap only | |
| 845 | - // authorizes acting on the user's OWN orders. Touching another user's order | |
| 846 | - // additionally requires the *_others_shop_orders cap, mirroring WooCommerce's | |
| 847 | - // own meta-cap map. Without this, a cashier with delete_shop_orders (but not | |
| 848 | - // delete_others_shop_orders) could delete/void orders they do not own. | |
| 849 | - if ( \in_array( $context, array( 'edit', 'delete' ), true ) ) { | |
| 850 | - $order_post = get_post( $object_id ); | |
| 851 | - if ( $order_post ) { | |
| 852 | - $owns_order = get_current_user_id() === (int) $order_post->post_author; | |
| 853 | - $order_cap = $owns_order ? "{$context}_shop_orders" : "{$context}_others_shop_orders"; | |
| 854 | - } | |
| 855 | - } | |
| 856 | - if ( $order_cap && current_user_can( $order_cap ) ) { | |
| 857 | - $permission = true; | |
| 858 | - } | |
| 859 | - } | |
| 860 | - | |
| 861 | - return $permission; | |
| 720 | + return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'writes' ); | |
| 862 | 721 | } |
| 863 | 722 | |
| 864 | 723 | /** |
| 865 | 724 | * Read this collection's document for one record, through its writer. |
