← All changes | includes/API/V1/Coupons_Controller.php +46 -32 1.10.4 → 1.10.19 View file →

		@@ -12,8 +12,9 @@
12	12	if ( ! class_exists( 'WC_REST_Coupons_Controller' ) ) {
13	13	return;
14	14	}
15	15
	16	+use WCPOS\WooCommercePOS\Services\Permission_Rules;
16	17	use Exception;
17	18	use WC_Coupon;
18	19	use WC_REST_Coupons_Controller;
19	20	use WCPOS\WooCommercePOS\Logger;
		@@ -46,8 +47,38 @@
46	47	*/
47	48	protected $wcpos_request;
48	49
49	50	/**
	51	+ * Read coupons with the POS grant scoped to this handler.
	52	+ *
	53	+ * @param WP_REST_Request $request Full request details.
	54	+ * @return WP_REST_Response|WP_Error
	55	+ */
	56	+ public function get_items( $request ) {
	57	+ Permission_Rules::install_wc_filter( 'coupons', 'v1' );
	58	+ try {
	59	+ return parent::get_items( $request );
	60	+ } finally {
	61	+ Permission_Rules::uninstall_wc_filter();
	62	+ }
	63	+ }
	64	+
	65	+ /**
	66	+ * Read coupons with the POS grant scoped to this handler.
	67	+ *
	68	+ * @param WP_REST_Request $request Full request details.
	69	+ * @return WP_REST_Response|WP_Error
	70	+ */
	71	+ public function get_item( $request ) {
	72	+ Permission_Rules::install_wc_filter( 'coupons', 'v1' );
	73	+ try {
	74	+ return parent::get_item( $request );
	75	+ } finally {
	76	+ Permission_Rules::uninstall_wc_filter();
	77	+ }
	78	+ }
	79	+
	80	+ /**
50	81	* Create a single coupon.
51	82	*
52	83	* @param WP_REST_Request $request Full details about the request.
53	84	*
		@@ -84,14 +115,14 @@
84	115	* @param mixed $dispatch_result Dispatch result, will be used if not empty.
85	116	* @param WP_REST_Request $request Request used to generate the response.
86	117	* @param string $route Route matched for the request.
87	118	* @param array $handler Route handler used for the request.
	119	+ * @return mixed
88	120	*/
89	121	public function wcpos_dispatch_request( $dispatch_result, WP_REST_Request $request, $route, $handler ) {
90	122	$this->wcpos_request = $request;
91	123
92	124	add_filter( 'woocommerce_rest_prepare_shop_coupon_object', array( $this, 'wcpos_coupon_response' ), 10, 3 );
93		- add_filter( 'woocommerce_rest_check_permissions', array( $this, 'wcpos_check_permissions' ), 10, 4 );
94	125	// The post-date touch that used to be installed here is now registered
95	126	// unconditionally at plugins_loaded (Sync\Coupon_Modified_Date), so it also
96	127	// covers wp-admin/WP-CLI/third-party coupon saves this dispatch never saw.
97	128
		@@ -106,56 +137,39 @@
106	137	return $dispatch_result;
107	138	}
108	139
109	140	/**
110		- * Check whether a given request has permission to read coupons.
	141	+ * Delegate the read decision, preserving WooCommerce's request-dependent checks.
111	142	*
112		- * @param WP_REST_Request $request Full details about the request.
113		- *
114		- * @return WP_Error|boolean
	143	+ * @param WP_REST_Request $request Full request details.
	144	+ * @return bool|WP_Error
115	145	*/
116	146	public function get_items_permissions_check( $request ) {
117		- if ( current_user_can( 'access_woocommerce_pos' ) ) {
118		- return true;
119		- }
120		-
121		- return parent::get_items_permissions_check( $request );
	147	+ return Permission_Rules::verdict( 'coupons', 'read', (int) $request['id'], 0, 'v1', $request->get_params() );
122	148	}
123	149
124	150	/**
125		- * Check if a given request has access to read a coupon.
	151	+ * Delegate the read decision, preserving WooCommerce's request-dependent checks.
126	152	*
127		- * @param WP_REST_Request $request Full details about the request.
128		- *
129		- * @return WP_Error|boolean
	153	+ * @param WP_REST_Request $request Full request details.
	154	+ * @return bool|WP_Error
130	155	*/
131	156	public function get_item_permissions_check( $request ) {
132		- if ( current_user_can( 'access_woocommerce_pos' ) ) {
133		- return true;
134		- }
135		-
136		- return parent::get_item_permissions_check( $request );
	157	+ return Permission_Rules::verdict( 'coupons', 'read', (int) $request['id'], 0, 'v1', $request->get_params() );
137	158	}
138	159
139	160	/**
140	161	* Authorize coupon read access for POS users.
141	162	*
142		- * The WC CRUD controller's get_items() calls wc_rest_check_post_permissions()
143		- * per coupon. This filter ensures POS users can read coupons.
144		- *
145		- * @param bool $permission The current permission.
146		- * @param string $context The context of the request (read, create, edit, delete).
147		- * @param int $object_id The object ID.
148		- * @param string $post_type The post type.
149		- *
	163	+ * @deprecated Use Permission_Rules::wc_filter().
	164	+ * @param bool $permission Incoming WC permission.
	165	+ * @param string $context Permission context.
	166	+ * @param int $object_id Target object ID.
	167	+ * @param string $post_type WC object type.
150	168	* @return bool
151	169	*/
152	170	public function wcpos_check_permissions( $permission, $context, $object_id, $post_type ) {
153		- if ( ! $permission && 'shop_coupon' === $post_type && 'read' === $context ) {
154		- $permission = current_user_can( 'access_woocommerce_pos' );
155		- }
156		-
157		- return $permission;
	171	+ return Permission_Rules::wc_filter( $permission, $context, $object_id, $post_type, 'coupons', 'v1' );
158	172	}
159	173
160	174	/**
161	175	* Get the query params for collections.