← All changes | includes/API/V2/Write_Controller.php +23 -117 1.10.3 → 1.10.19 View file →

		@@ -7,11 +7,13 @@
7	7
8	8	namespace WCPOS\WooCommercePOS\API\V2;
9	9
10	10	use WCPOS\WooCommercePOS\API\V2\Writers\Collection_Writer_Resolver;
	11	+use WCPOS\WooCommercePOS\Services\Permission_Rules;
11	12	use WCPOS\WooCommercePOS\Services\Tax_Id_Types;
12	13	use WCPOS\WooCommercePOS\Sync\Api;
13	14	use WCPOS\WooCommercePOS\Sync\Collections;
	15	+use WCPOS\WooCommercePOS\Sync\Create_Identity;
14	16	use WCPOS\WooCommercePOS\Sync\Endpoint_Permissions;
15	17	use WCPOS\WooCommercePOS\Sync\Header_Mirror;
16	18	use WCPOS\WooCommercePOS\Sync\Meta_Normalizer;
17	19	use WCPOS\WooCommercePOS\Sync\Mutation_Store;
		@@ -43,8 +45,9 @@
43	45	* live in an injected mutation store, so the apply logic is unit-testable with a
44	46	* fake store + a stubbed `rest_do_request`.
45	47	*/
46	48	class Write_Controller extends WP_REST_Controller {
	49	+
47	50	// Our gate (capability + F13 health); forwarded writes scope the client-tier grant below.
48	51	use Endpoint_Permissions;
49	52
50	53
		@@ -50,9 +53,12 @@
50	53
51	54	/** @var mixed Duck-typed mutation store; tests inject an in-memory implementation. */
52	55	private $store;
53	56
	57	+ /** @var Create_Identity Shared proof for fresh and poisoned creates. */
	58	+ private Create_Identity $identity;
54	59
	60	+
55	61	/**
56	62	* collection => wc/v3 route + how its uuid→id is resolved. ONE table, not
57	63	* per-collection controllers. Only collections whose resolver is correct AND
58	64	* exercised are exposed; the rest stay out until their phase:
		@@ -97,8 +103,9 @@
97	103	}
98	104
99	105	public function __construct( $store = null ) {
100	106	$this->store = $store ? $store : new Mutation_Store();
	107	+ $this->identity = new Create_Identity( $this->store );
101	108	}
102	109
103	110	/** Resolve the collection-specific writer for registry metadata. */
104	111	private function writer( array $meta ) {
		@@ -218,9 +225,14 @@
218	225	return $mismatch;
219	226	}
220	227	}
221	228	if ( is_array( $hit ) && 'poison' === ( $hit['status'] ?? '' ) ) {
222		- return $this->retry_identity_stamp( $meta, $m, $hit );
	229	+ $writer = $this->writer( $meta );
	230	+ $recovered = $this->identity->recover( $meta, $m, $hit, $writer );
	231	+ if ( is_wp_error( $recovered ) ) {
	232	+ return $recovered;
	233	+ }
	234	+ return $this->envelope_document( $this->document_for( $meta, $recovered['id'] ), $m['recordId'], $meta, $recovered['id'], $recovered['status'], $writer );
223	235	}
224	236	if ( is_array( $hit ) && in_array( ( $hit['status'] ?? '' ), array( 'done', 'applied' ), true ) ) {
225	237	if ( 'applied' === $hit['status'] && ! $this->store->finalize( $m['mutationId'], (int) $hit['remote_id'] ) ) {
226	238	return $this->finalize_error();
		@@ -404,33 +416,12 @@
404	416	$this->store->mark_indeterminate( $m['mutationId'], 0, $response->get_status() );
405	417	return new WP_Error( 'woo_rxdb_sync_create_no_id', 'Create returned no server id.', array( 'status' => 502 ) );
406	418	}
407	419
408		- // Poison checkpoint, UUID persistence, and finalization remain shared here.
409		- $checkpointed = $this->store->mark_poison( $m['mutationId'], $new_id, $response->get_status() );
410		- $writer->persist( 'create_before_identity', $new_id, $m['payload'] );
411		- $identity_error = null;
412		- if ( ! $this->store->persist_uuid( $meta['id_type'], $new_id, $m['recordId'] ) ) {
413		- $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) );
414		- } else {
415		- $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $m['recordId'], $meta );
416		- if ( is_wp_error( $resolved ) ) {
417		- $identity_error = $resolved;
418		- } elseif ( $resolved !== $new_id ) {
419		- $identity_error = new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) );
420		- }
	420	+ $stamped = $this->identity->stamp( $meta, $m, $new_id, $response->get_status(), $writer );
	421	+ if ( is_wp_error( $stamped ) ) {
	422	+ return $stamped;
421	423	}
422		- if ( ! $checkpointed ) {
423		- $this->store->mark_indeterminate( $m['mutationId'], $new_id, $response->get_status() );
424		- return $this->finalize_error();
425		- }
426		- if ( $identity_error ) {
427		- return $identity_error;
428		- }
429		- $writer->persist( 'create_after_identity', $new_id, $m['payload'] );
430		- if ( ! $this->store->finalize_poison( $m['mutationId'], $new_id ) ) {
431		- return $this->finalize_error();
432		- }
433	424	return $this->envelope_document( $this->document_for( $meta, $new_id ), $m['recordId'], $meta, $new_id, $response->get_status(), $writer );
434	425	}
435	426
436	427	/**
		@@ -517,9 +508,9 @@
517	508	if ( $response->get_status() >= 400 ) {
518	509	return new WP_REST_Response( $response->get_data(), $response->get_status() );
519	510	}
520	511	$data = $response->get_data();
521		- $writer->persist( 'update', $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] );
	512	+ $writer->after_update( $id, $m['payload'], $current_bare, is_array( $data ) ? $data : array(), $prepared['context'] );
522	513
523	514	$this->store->persist_uuid( $meta['id_type'], $id, $m['recordId'] );
524	515	$finalized = $this->checkpoint_and_finalize( $m['mutationId'], $id, $response->get_status() );
525	516	if ( is_wp_error( $finalized ) ) {
		@@ -591,13 +582,13 @@
591	582	*
592	583	* @param int $id The order id.
593	584	*/
594	585	private function can_forward_delete( int $id ): bool {
595		- add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 );
	586	+ Permission_Rules::install_wc_filter();
596	587	try {
597	588	return (bool) wc_rest_check_post_permissions( 'shop_order', 'delete', $id );
598	589	} finally {
599		- remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 );
	590	+ Permission_Rules::uninstall_wc_filter();
600	591	}
601	592	}
602	593
603	594	private function checkpoint_and_finalize( string $mutation_id, int $remote_id, int $response_status ) {
		@@ -639,43 +630,8 @@
639	630	$writer = $this->writer( $meta );
640	631	return $this->envelope_document( $this->document_for( $meta, $remote_id ), $expected, $meta, $remote_id, $status, $writer );
641	632	}
642	633
643		- private function retry_identity_stamp( array $meta, array $m, array $hit ) {
644		- $remote_id = (int) ( $hit['remote_id'] ?? 0 );
645		- $record_uuid = (string) ( $hit['record_uuid'] ?? '' );
646		- if ( $record_uuid !== $m['recordId'] ) {
647		- return new WP_Error( 'woo_rxdb_sync_identity_conflict', 'recordId disagrees with the stored mutation identity.', array( 'status' => 422 ) );
648		- }
649		- if ( 'create' !== ( $hit['operation'] ?? '' ) || $remote_id <= 0 ) {
650		- return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Created record identity cannot be recovered safely.', array( 'status' => 500 ) );
651		- }
652		- $resolved = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta );
653		- if ( is_wp_error( $resolved ) ) {
654		- return $resolved;
655		- }
656		- if ( $resolved > 0 && $resolved !== $remote_id ) {
657		- return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Stored create identity points at a different record.', array( 'status' => 500 ) );
658		- }
659		- if ( ! $this->store->persist_uuid( $meta['id_type'], $remote_id, $record_uuid ) ) {
660		- return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) );
661		- }
662		- $verified = $this->store->resolve_id_by_uuid( $meta['id_type'], $record_uuid, $meta );
663		- if ( is_wp_error( $verified ) ) {
664		- return $verified;
665		- }
666		- if ( $verified !== $remote_id ) {
667		- return new WP_Error( 'woo_rxdb_sync_identity_persistence_failed', 'Unable to persist created record identity.', array( 'status' => 500 ) );
668		- }
669		- $writer = $this->writer( $meta );
670		- $writer->persist( 'create_recovery', $remote_id, $m['payload'] );
671		- if ( ! $this->store->finalize_poison( $m['mutationId'], $remote_id ) ) {
672		- return $this->finalize_error();
673		- }
674		- $status = isset( $hit['response_status'] ) ? (int) $hit['response_status'] : 201;
675		- return $this->envelope_document( $this->document_for( $meta, $remote_id ), $record_uuid, $meta, $remote_id, $status, $writer );
676		- }
677		-
678	634	/**
679	635	* Validate a client-submitted `tax_ids` payload against the v1 schema.
680	636	*
681	637	* tax_ids is unknown to the stock wc/v3 controllers and is stripped before the forward,
		@@ -743,9 +699,9 @@
743	699	*/
744	700	private function dispatch_write( WP_REST_Request $request ) {
745	701	// Stamp here so direct callers (notably deletes) carry the scope too.
746	702	Store_Scope::stamp( $request );
747		- add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 );
	703	+ Permission_Rules::install_wc_filter();
748	704	try {
749	705	// Marked as OUR traffic for the duration of the forward, so a consumer
750	706	// keyed on store scope can act on a till write without also claiming
751	707	// every stock wc/v3 product write on the site (pro#425 review).
		@@ -754,65 +710,15 @@
754	710	return rest_do_request( $request );
755	711	}
756	712	);
757	713	} finally {
758		- remove_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10 );
	714	+ Permission_Rules::uninstall_wc_filter();
759	715	}
760	716	}
761	717
762		- /**
763		- * Authorize proxied catalog mutations for POS users.
764		- *
765		- * This filter is attached only while a sync push is forwarded to wc/v3, so
766		- * direct WooCommerce requests keep their normal permission checks.
767		- *
768		- * @param bool $permission The current permission.
769		- * @param string $context The request context.
770		- * @param int $object_id The object ID.
771		- * @param string $post_type The object type passed by WooCommerce.
772		- *
773		- * @return bool
774		- */
	718	+ /** @deprecated Use Permission_Rules::wc_filter(). */
775	719	public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) {
776		- // Catalog and coupon WRITES require the user's real WooCommerce
777		- // capabilities — no POS-tier widening. The cashier role is deliberately
778		- // read-only on catalog (Activator), and a blanket grant here handed
779		- // every POS user product deletion and coupon minting. Product decision
780		- // 2026-08-06: strict wc/v3 parity for catalog mutations; only the
781		- // HPOS placeholder remap below (orders) adjusts anything, and it never
782		- // grants beyond the user's own role caps.
783		-
784		- // Orders: with HPOS enabled (sync off), get_post() yields shop_order_placehold
785		- // (map_meta_cap = false, no capability_type), so WooCommerce's REST check maps
786		- // to the generic edit_post/delete_post caps that cashier-tier roles lack —
787		- // even though they hold the real shop_orders caps. Re-check the capability the
788		- // mapping SHOULD have produced, mirroring V1\Orders_Controller's
789		- // update_item_permissions_check fix. No grant beyond the user's own role caps.
790		- if ( ! $permission && 'shop_order' === $post_type ) {
791		- $order_caps = array(
792		- 'read' => 'read_private_shop_orders',
793		- 'create' => 'publish_shop_orders',
794		- 'delete' => 'delete_shop_orders',
795		- );
796		- $order_cap = $order_caps[ $context ] ?? null;
797		- // edit and delete are ownership-sensitive: the base *_shop_orders cap only
798		- // authorizes acting on the user's OWN orders. Touching another user's order
799		- // additionally requires the *_others_shop_orders cap, mirroring WooCommerce's
800		- // own meta-cap map. Without this, a cashier with delete_shop_orders (but not
801		- // delete_others_shop_orders) could delete/void orders they do not own.
802		- if ( \in_array( $context, array( 'edit', 'delete' ), true ) ) {
803		- $order_post = get_post( $object_id );
804		- if ( $order_post ) {
805		- $owns_order = get_current_user_id() === (int) $order_post->post_author;
806		- $order_cap = $owns_order ? "{$context}_shop_orders" : "{$context}_others_shop_orders";
807		- }
808		- }
809		- if ( $order_cap && current_user_can( $order_cap ) ) {
810		- $permission = true;
811		- }
812		- }
813		-
814		- return $permission;
	720	+ return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'writes' );
815	721	}
816	722
817	723	/**
818	724	* Read this collection's document for one record, through its writer.