| @@ -7,11 +7,13 @@ | ||
| 7 | 7 | |
| 8 | 8 | namespace WCPOS\WooCommercePOS\API\V2; |
| 9 | 9 | |
| 10 | 10 | use WCPOS\WooCommercePOS\API\V2\Writers\Collection_Writer_Resolver; |
| 11 | +use WCPOS\WooCommercePOS\Services\Permission_Rules; | |
| 11 | 12 | use WCPOS\WooCommercePOS\Services\Tax_Id_Types; |
| 12 | 13 | use WCPOS\WooCommercePOS\Sync\Api; |
| 13 | 14 | use WCPOS\WooCommercePOS\Sync\Collections; |
| 15 | +use WCPOS\WooCommercePOS\Sync\Create_Identity; | |
| 14 | 16 | use WCPOS\WooCommercePOS\Sync\Endpoint_Permissions; |
| 15 | 17 | use WCPOS\WooCommercePOS\Sync\Header_Mirror; |
| 16 | 18 | use WCPOS\WooCommercePOS\Sync\Meta_Normalizer; |
| 17 | 19 | use WCPOS\WooCommercePOS\Sync\Mutation_Store; |
| @@ -43,8 +45,9 @@ | ||
| 43 | 45 | * live in an injected mutation store, so the apply logic is unit-testable with a |
| 44 | 46 | * fake store + a stubbed `rest_do_request`. |
| 45 | 47 | */ |
| 46 | 48 | class Write_Controller extends WP_REST_Controller { |
| 49 | + | |
| 47 | 50 | // Our gate (capability + F13 health); forwarded writes scope the client-tier grant below. |
| 48 | 51 | use Endpoint_Permissions; |
| 49 | 52 | |
| 50 | 53 | |
| @@ -50,9 +53,12 @@ | ||
| 50 | 53 | |
| 51 | 54 | /** @var mixed Duck-typed mutation store; tests inject an in-memory implementation. */ |
| 52 | 55 | private $store; |
| 53 | 56 | |
| 57 | + /** @var Create_Identity Shared proof for fresh and poisoned creates. */ | |
| 58 | + private Create_Identity $identity; | |
| 54 | 59 | |
| 60 | + | |
| 55 | 61 | /** |
| 56 | 62 | * collection => wc/v3 route + how its uuid→id is resolved. ONE table, not |
| 57 | 63 | * per-collection controllers. Only collections whose resolver is correct AND |
| 58 | 64 | * exercised are exposed; the rest stay out until their phase: |
| @@ -97,8 +103,9 @@ | ||
| 97 | 103 | } |
| 98 | 104 | |
| 99 | 105 | public function __construct( $store = null ) { |
| 100 | 106 | $this->store = $store ? $store : new Mutation_Store(); |
| 107 | + $this->identity = new Create_Identity( $this->store ); | |
| 101 | 108 | } |
| 102 | 109 | |
| 103 | 110 | /** Resolve the collection-specific writer for registry metadata. */ |
| 104 | 111 | private function writer( array $meta ) { |
| @@ -218,9 +225,14 @@ | ||
| 218 | 225 | return $mismatch; |
| 219 | 226 | } |
| 220 | 227 | } |
| 221 | 228 | if ( is_array( $hit ) && 'poison' === ( $hit['status'] ?? '' ) ) { |
| 222 | - return $this->retry_identity_stamp( $meta, $m, $hit ); | |
| 229 | + $writer = $this->writer( $meta ); | |
| 230 | + $recovered = $this->identity->recover( $meta, $m, $hit, $writer ); | |
| 231 | + if ( is_wp_error( $recovered ) ) { | |
| 232 | + return $recovered; | |
| 233 | + } | |
| 234 | + return $this->envelope_document( $this->document_for( $meta, $recovered['id'] ), $m['recordId'], $meta, $recovered['id'], $recovered['status'], $writer ); | |
| 223 | 235 | } |
| 224 | 236 | if ( is_array( $hit ) && in_array( ( $hit['status'] ?? '' ), array( 'done', 'applied' ), true ) ) { |
| 225 | 237 | if ( 'applied' === $hit['status'] && ! $this->store->finalize( $m['mutationId'], (int) $hit['remote_id'] ) ) { |
| 226 | 238 | return $this->finalize_error(); |
| @@ -404,87 +416,16 @@ | ||
| 404 | 416 | $this->store->mark_indeterminate( $m['mutationId'], 0, $response->get_status() ); |
| 405 | 417 | return new WP_Error( 'woo_rxdb_sync_create_no_id', 'Create returned no server id.', array( 'status' => 502 ) ); |
| 406 | 418 | } |
| 407 | 419 | |
| 408 | - // Poison checkpoint, UUID persistence, and finalization remain shared here. | |
| 409 | - $checkpointed = $this->store->mark_poison( $m['mutationId'], $new_id, $response->get_status() ); | |
| 410 | - $writer->persist( 'create_before_identity', $new_id, $m['payload'] ); | |
| 411 | - $identity_error = null; | |
| 412 | - if ( ! $this->store->persist_uuid( $meta['id_type'], $new_id, $m['recordId'] ) ) { | |
| 413 | - $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 414 | - } else { | |
| 415 | - $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $m['recordId'], $meta ); | |
| 416 | - if ( is_wp_error( $resolved ) ) { | |
| 417 | - $identity_error = $resolved; | |
| 418 | - } elseif ( $resolved !== $new_id ) { | |
| 419 | - $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 420 | - } | |
| 420 | + $stamped = $this->identity->stamp( $meta, $m, $new_id, $response->get_status(), $writer ); | |
| 421 | + if ( is_wp_error( $stamped ) ) { | |
| 422 | + return $stamped; | |
| 421 | 423 | } |
| 422 | - if ( ! $checkpointed ) { | |
| 423 | - $this->store->mark_indeterminate( $m['mutationId'], $new_id, $response->get_status() ); | |
| 424 | - return $this->finalize_error(); | |
| 425 | - } | |
| 426 | - if ( $identity_error ) { | |
| 427 | - return $identity_error; | |
| 428 | - } | |
| 429 | - $writer->persist( 'create_after_identity', $new_id, $m['payload'] ); | |
| 430 | - if ( ! $this->store->finalize_poison( $m['mutationId'], $new_id ) ) { | |
| 431 | - return $this->finalize_error(); | |
| 432 | - } | |
| 433 | 424 | return $this->envelope_document( $this->document_for( $meta, $new_id ), $m['recordId'], $meta, $new_id, $response->get_status(), $writer ); |
| 434 | 425 | } |
| 435 | 426 | |
| 436 | 427 | /** |
| 437 | - * The grace comparer (#423 step 2, option `woo_rxdb_sync_legacy_revision_grace`, | |
| 438 | - * default on until retirement): on a canonical mismatch, accept a baseRevision | |
| 439 | - * that matches the CURRENT document under a PRE-CUTOVER form — | |
| 440 | - * - the legacy order sha256 (no ksort, volatiles included): same content, | |
| 441 | - * old algorithm ⇒ the precondition is genuinely current; | |
| 442 | - * - a pre-taxonomy-sort sha256 for non-orders: same content, previous | |
| 443 | - * canonicalizer ⇒ queued writes survive the revision transition; | |
| 444 | - * - a pre-1b lane synthesis (non-sha256 values the client fetchers stored | |
| 445 | - * as sync.revision before the proxy revision stamp): date_modified_gmt | |
| 446 | - * for order/post/user collections, String(id) for term collections | |
| 447 | - * (deliberately vacuous — that lane never had optimistic concurrency; | |
| 448 | - * grace honours the contract the record was written under). | |
| 449 | - * A real conflict mismatches every form → 409 exactly as before. The ack | |
| 450 | - * always returns the CANONICAL currentRevision, re-anchoring the client. | |
| 451 | - */ | |
| 452 | - private function revision_matches_with_grace( $base, string $current_revision, array $meta, int $id, array $bare, bool $allow_term_grace = true ): bool { | |
| 453 | - if ( $base === $current_revision ) { | |
| 454 | - return true; | |
| 455 | - } | |
| 456 | - if ( ! is_string( $base ) || 'yes' !== get_option( 'woocommerce_pos_sync_legacy_revision_grace', 'yes' ) ) { | |
| 457 | - return false; | |
| 458 | - } | |
| 459 | - if ( 0 === strpos( $base, 'sha256:' ) ) { | |
| 460 | - if ( 'order' === ( $meta['id_type'] ?? '' ) && $id > 0 ) { | |
| 461 | - if ( Order_Serializer::pre_augmentation_canonical_revision( $bare ) === $base | |
| 462 | - || Order_Serializer::pre_item_uuid_canonical_revision( $bare ) === $base ) { | |
| 463 | - return true; | |
| 464 | - } | |
| 465 | - $payload = ( new Order_Serializer() )->serialize_order( $id, new WP_REST_Request() ); | |
| 466 | - return Order_Serializer::legacy_revision( $payload ) === $base; | |
| 467 | - } | |
| 468 | - return Revision::pre_taxonomy_sort_revision( $bare ) === $base; | |
| 469 | - } | |
| 470 | - $id_type = $meta['id_type'] ?? ''; | |
| 471 | - if ( in_array( $id_type, array( 'order', 'post', 'user' ), true ) ) { | |
| 472 | - // Read the date from wherever the document carries it. A variation's document is the | |
| 473 | - // `{ id, parent_id, payload }` wrapper, so a top-level-only read makes this branch dead | |
| 474 | - // code for the one collection whose canonical revision IS a date — and it would come | |
| 475 | - // back to life, silently, the day the wrapper is dropped. | |
| 476 | - $nested = isset( $bare['payload'] ) && is_array( $bare['payload'] ) ? $bare['payload'] : array(); | |
| 477 | - $date = (string) ( $bare['date_modified_gmt'] ?? $nested['date_modified_gmt'] ?? '' ); | |
| 478 | - return '' !== $date && $base === $date; | |
| 479 | - } | |
| 480 | - if ( 'term' === $id_type && $allow_term_grace ) { | |
| 481 | - return (string) ( $bare['id'] ?? '' ) === $base; | |
| 482 | - } | |
| 483 | - return false; | |
| 484 | - } | |
| 485 | - | |
| 486 | - /** | |
| 487 | 428 | * The pre-CAS post-type capability gate shared by the update and delete paths. |
| 488 | 429 | * |
| 489 | 430 | * Only the WP-post-backed collections carry a Woo capability check of their own; |
| 490 | 431 | * every other collection is gated by the endpoint permission callback alone, so |
| @@ -542,9 +483,9 @@ | ||
| 542 | 483 | return $current; |
| 543 | 484 | } |
| 544 | 485 | $current_bare = is_array( $current->get_data() ) ? $current->get_data() : array(); |
| 545 | 486 | $current_revision = $this->revision_for( $meta, $id, $current_bare ); |
| 546 | - if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare ) ) { | |
| 487 | + if ( $m['baseRevision'] !== $current_revision ) { | |
| 547 | 488 | return new WP_REST_Response( |
| 548 | 489 | array( |
| 549 | 490 | 'code' => 'woo_rxdb_sync_conflict', |
| 550 | 491 | 'message' => 'baseRevision is stale.', |
| @@ -567,9 +508,9 @@ | ||
| 567 | 508 | if ( $response->get_status() >= 400 ) { |
| 568 | 509 | return new WP_REST_Response( $response->get_data(), $response->get_status() ); |
| 569 | 510 | } |
| 570 | 511 | $data = $response->get_data(); |
| 571 | - $writer->persist( 'update', $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] ); | |
| 512 | + $writer->after_update( $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] ); | |
| 572 | 513 | |
| 573 | 514 | $this->store->persist_uuid( $meta['id_type'], $id, $m['recordId'] ); |
| 574 | 515 | $finalized = $this->checkpoint_and_finalize( $m['mutationId'], $id, $response->get_status() ); |
| 575 | 516 | if ( is_wp_error( $finalized ) ) { |
| @@ -607,9 +548,9 @@ | ||
| 607 | 548 | return $current; |
| 608 | 549 | } |
| 609 | 550 | $current_bare = is_array( $current->get_data() ) ? $current->get_data() : array(); |
| 610 | 551 | $current_revision = $this->revision_for( $meta, $id, $current_bare ); |
| 611 | - if ( ! $this->revision_matches_with_grace( $m['baseRevision'], $current_revision, $meta, $id, $current_bare, false ) ) { | |
| 552 | + if ( $m['baseRevision'] !== $current_revision ) { | |
| 612 | 553 | return new WP_REST_Response( |
| 613 | 554 | array( |
| 614 | 555 | 'code' => 'woo_rxdb_sync_conflict', |
| 615 | 556 | 'message' => 'baseRevision is stale.', |
| @@ -641,13 +582,13 @@ | ||
| 641 | 582 | * |
| 642 | 583 | * @param int $id The order id. |
| 643 | 584 | */ |
| 644 | 585 | private function can_forward_delete( int $id ): bool { |
| 645 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 586 | + Permission_Rules::install_wc_filter(); | |
| 646 | 587 | try { |
| 647 | 588 | return (bool) wc_rest_check_post_permissions( 'shop_order', 'delete', $id ); |
| 648 | 589 | } finally { |
| 649 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 590 | + Permission_Rules::uninstall_wc_filter(); | |
| 650 | 591 | } |
| 651 | 592 | } |
| 652 | 593 | |
| 653 | 594 | private function checkpoint_and_finalize( string $mutation_id, int $remote_id, int $response_status ) { |
| @@ -689,43 +630,8 @@ | ||
| 689 | 630 | $writer = $this->writer( $meta ); |
| 690 | 631 | return $this->envelope_document( $this->document_for( $meta, $remote_id ), $expected, $meta, $remote_id, $status, $writer ); |
| 691 | 632 | } |
| 692 | 633 | |
| 693 | - private function retry_identity_stamp( array $meta, array $m, array $hit ) { | |
| 694 | - $remote_id = (int) ( $hit['remote_id'] ?? 0 ); | |
| 695 | - $record_uuid = (string) ( $hit['record_uuid'] ?? '' ); | |
| 696 | - if ( $record_uuid !== $m['recordId'] ) { | |
| 697 | - return new WP_Error( 'woo_rxdb_sync_identity_conflict', 'recordId disagrees with the stored mutation identity.', array( 'status' => 422 ) ); | |
| 698 | - } | |
| 699 | - if ( 'create' !== ( $hit['operation'] ?? '' ) || $remote_id <= 0 ) { | |
| 700 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Created record identity cannot be recovered safely.', array( 'status' => 500 ) ); | |
| 701 | - } | |
| 702 | - $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta ); | |
| 703 | - if ( is_wp_error( $resolved ) ) { | |
| 704 | - return $resolved; | |
| 705 | - } | |
| 706 | - if ( $resolved > 0 && $resolved !== $remote_id ) { | |
| 707 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Stored create identity points at a different record.', array( 'status' => 500 ) ); | |
| 708 | - } | |
| 709 | - if ( ! $this->store->persist_uuid( $meta['id_type'], $remote_id, $record_uuid ) ) { | |
| 710 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 711 | - } | |
| 712 | - $verified = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta ); | |
| 713 | - if ( is_wp_error( $verified ) ) { | |
| 714 | - return $verified; | |
| 715 | - } | |
| 716 | - if ( $verified !== $remote_id ) { | |
| 717 | - return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) ); | |
| 718 | - } | |
| 719 | - $writer = $this->writer( $meta ); | |
| 720 | - $writer->persist( 'create_recovery', $remote_id, $m['payload'] ); | |
| 721 | - if ( ! $this->store->finalize_poison( $m['mutationId'], $remote_id ) ) { | |
| 722 | - return $this->finalize_error(); | |
| 723 | - } | |
| 724 | - $status = isset( $hit['response_status'] ) ? (int) $hit['response_status'] : 201; | |
| 725 | - return $this->envelope_document( $this->document_for( $meta, $remote_id ), $record_uuid, $meta, $remote_id, $status, $writer ); | |
| 726 | - } | |
| 727 | - | |
| 728 | 634 | /** |
| 729 | 635 | * Validate a client-submitted `tax_ids` payload against the v1 schema. |
| 730 | 636 | * |
| 731 | 637 | * tax_ids is unknown to the stock wc/v3 controllers and is stripped before the forward, |
| @@ -793,9 +699,9 @@ | ||
| 793 | 699 | */ |
| 794 | 700 | private function dispatch_write( WP_REST_Request $request ) { |
| 795 | 701 | // Stamp here so direct callers (notably deletes) carry the scope too. |
| 796 | 702 | Store_Scope::stamp( $request ); |
| 797 | - add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 ); | |
| 703 | + Permission_Rules::install_wc_filter(); | |
| 798 | 704 | try { |
| 799 | 705 | // Marked as OUR traffic for the duration of the forward, so a consumer |
| 800 | 706 | // keyed on store scope can act on a till write without also claiming |
| 801 | 707 | // every stock wc/v3 product write on the site (pro#425 review). |
| @@ -804,65 +710,15 @@ | ||
| 804 | 710 | return rest_do_request( $request ); |
| 805 | 711 | } |
| 806 | 712 | ); |
| 807 | 713 | } finally { |
| 808 | - remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 ); | |
| 714 | + Permission_Rules::uninstall_wc_filter(); | |
| 809 | 715 | } |
| 810 | 716 | } |
| 811 | 717 | |
| 812 | - /** | |
| 813 | - * Authorize proxied catalog mutations for POS users. | |
| 814 | - * | |
| 815 | - * This filter is attached only while a sync push is forwarded to wc/v3, so | |
| 816 | - * direct WooCommerce requests keep their normal permission checks. | |
| 817 | - * | |
| 818 | - * @param bool $permission The current permission. | |
| 819 | - * @param string $context The request context. | |
| 820 | - * @param int $object_id The object ID. | |
| 821 | - * @param string $post_type The object type passed by WooCommerce. | |
| 822 | - * | |
| 823 | - * @return bool | |
| 824 | - */ | |
| 718 | + /** @deprecated Use Permission_Rules::wc_filter(). */ | |
| 825 | 719 | public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) { |
| 826 | - // Catalog and coupon WRITES require the user's real WooCommerce | |
| 827 | - // capabilities — no POS-tier widening. The cashier role is deliberately | |
| 828 | - // read-only on catalog (Activator), and a blanket grant here handed | |
| 829 | - // every POS user product deletion and coupon minting. Product decision | |
| 830 | - // 2026-08-06: strict wc/v3 parity for catalog mutations; only the | |
| 831 | - // HPOS placeholder remap below (orders) adjusts anything, and it never | |
| 832 | - // grants beyond the user's own role caps. | |
| 833 | - | |
| 834 | - // Orders: with HPOS enabled (sync off), get_post() yields shop_order_placehold | |
| 835 | - // (map_meta_cap = false, no capability_type), so WooCommerce's REST check maps | |
| 836 | - // to the generic edit_post/delete_post caps that cashier-tier roles lack — | |
| 837 | - // even though they hold the real shop_orders caps. Re-check the capability the | |
| 838 | - // mapping SHOULD have produced, mirroring V1\Orders_Controller's | |
| 839 | - // update_item_permissions_check fix. No grant beyond the user's own role caps. | |
| 840 | - if ( ! $permission && 'shop_order' === $post_type ) { | |
| 841 | - $order_caps = array( | |
| 842 | - 'read' => 'read_private_shop_orders', | |
| 843 | - 'create' => 'publish_shop_orders', | |
| 844 | - 'delete' => 'delete_shop_orders', | |
| 845 | - ); | |
| 846 | - $order_cap = $order_caps[ $context ] ?? null; | |
| 847 | - // edit and delete are ownership-sensitive: the base *_shop_orders cap only | |
| 848 | - // authorizes acting on the user's OWN orders. Touching another user's order | |
| 849 | - // additionally requires the *_others_shop_orders cap, mirroring WooCommerce's | |
| 850 | - // own meta-cap map. Without this, a cashier with delete_shop_orders (but not | |
| 851 | - // delete_others_shop_orders) could delete/void orders they do not own. | |
| 852 | - if ( \in_array( $context, array( 'edit', 'delete' ), true ) ) { | |
| 853 | - $order_post = get_post( $object_id ); | |
| 854 | - if ( $order_post ) { | |
| 855 | - $owns_order = get_current_user_id() === (int) $order_post->post_author; | |
| 856 | - $order_cap = $owns_order ? "{$context}_shop_orders" : "{$context}_others_shop_orders"; | |
| 857 | - } | |
| 858 | - } | |
| 859 | - if ( $order_cap && current_user_can( $order_cap ) ) { | |
| 860 | - $permission = true; | |
| 861 | - } | |
| 862 | - } | |
| 863 | - | |
| 864 | - return $permission; | |
| 720 | + return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'writes' ); | |
| 865 | 721 | } |
| 866 | 722 | |
| 867 | 723 | /** |
| 868 | 724 | * Read this collection's document for one record, through its writer. |
| @@ -967,12 +823,11 @@ | ||
| 967 | 823 | * |
| 968 | 824 | * This used to read `$bare['payload']['date_modified_gmt']` only, with `$bare['id']` as |
| 969 | 825 | * the fallback. Against a FLAT document that silently degrades to the variation's own |
| 970 | 826 | * ID — a value that never changes again. The failure would be total and invisible: |
| 971 | - * `revision_matches_with_grace()` would still let a queued date-based write through | |
| 972 | - * (with the wrapper gone, its top-level `date_modified_gmt` branch finally resolves), | |
| 973 | 827 | * the ack would hand the client the id as `currentRevision`, and from then on every |
| 974 | - * stale baseRevision would equal every recomputed one. Two tills editing the same | |
| 828 | + * stale baseRevision would equal every recomputed one — the strict revision | |
| 829 | + * comparison would pass every queued write. Two tills editing the same | |
| 975 | 830 | * variation hours apart would both pass the precondition; the per-record lock would |
| 976 | 831 | * serialize them, so there would be no error — just a lost update, every time. |
| 977 | 832 | * |
| 978 | 833 | * The `$bare['id']` fallback is kept ONLY for a document carrying no date at all, and is |
