← All changes | includes/Services/Cashier.php +66 -6 1.10.4 → 1.10.20 View file →

		@@ -82,14 +82,10 @@
82	82	'email' => $user->user_email,
83	83	'display_name' => $user->display_name,
84	84	'nice_name' => $user->user_nicename,
85	85	'roles' => array_values( $user->roles ),
86		- // Raw grants (role + user), the same vocabulary the POS Access settings
87		- // screen reads and writes. user_can() is wrong here: the singular meta
88		- // caps (edit_product, delete_product) cannot be checked without a post.
89		- 'capabilities' => array_values(
90		- array_filter( Access_Section::capability_names(), fn( $cap ) => ! empty( $user->allcaps[ $cap ] ) )
91		- ),
	86	+ // The helper reports effective grants, including role-editor denies.
	87	+ 'capabilities' => Access_Section::effective_capabilities( $user ),
92	88	'last_access' => $last_access ? $last_access : '',
93	89	'avatar_url' => get_avatar_url( $user->ID ),
94	90	);
95	91
		@@ -199,8 +195,72 @@
199	195	* @return bool True if user has cashier permissions.
200	196	*/
201	197	public function has_cashier_permissions( WP_User $user ): bool {
202	198	return user_can( $user, 'publish_shop_orders' );
	199	+ }
	200	+
	201	+ /**
	202	+ * POS baseline capabilities the user lacks.
	203	+ *
	204	+ * The baseline is what the POS needs to open and take a sale: the access gate,
	205	+ * the cashier gate (publish_shop_orders — see has_cashier_permissions()), and the
	206	+ * three reads every screen makes. Missing entries are reported, in this order,
	207	+ * so a merchant can see which role or role-editor deny is responsible.
	208	+ *
	209	+ * @param WP_User $user User to check.
	210	+ * @return string[] Missing capability names.
	211	+ */
	212	+ public function missing_pos_capabilities( WP_User $user ): array {
	213	+ $baseline = array( 'access_woocommerce_pos', 'publish_shop_orders', 'read_private_products', 'read_private_shop_orders', 'list_users' );
	214	+
	215	+ return array_values( array_filter( $baseline, fn( $cap ) => ! user_can( $user, $cap ) ) );
	216	+ }
	217	+
	218	+ /**
	219	+ * Whether the user clears the two gates the server already enforces.
	220	+ *
	221	+ * Only access_woocommerce_pos (the REST gate) and publish_shop_orders (the
	222	+ * cashier gate) block entry; a user missing only a read capability can still
	223	+ * work partially, and the corrected capability payload tells the client what
	224	+ * is missing.
	225	+ *
	226	+ * @param WP_User $user User to check.
	227	+ * @return bool True when both entry capabilities are granted.
	228	+ */
	229	+ public function can_open_pos( WP_User $user ): bool {
	230	+ $blocking = array_intersect( array( 'access_woocommerce_pos', 'publish_shop_orders' ), $this->missing_pos_capabilities( $user ) );
	231	+
	232	+ return empty( $blocking );
	233	+ }
	234	+
	235	+ /**
	236	+ * Describe missing baseline capabilities and how to grant them.
	237	+ *
	238	+ * @param WP_User $user User to check.
	239	+ * @return string Diagnostic message, or empty unless the user is blocked by can_open_pos().
	240	+ */
	241	+ public function missing_pos_capabilities_message( WP_User $user ): string {
	242	+ if ( $this->can_open_pos( $user ) ) {
	243	+ return '';
	244	+ }
	245	+ $missing = $this->missing_pos_capabilities( $user );
	246	+ /* translators: %s: Comma-separated missing capability names. */
	247	+ $message = sprintf( __( 'This account cannot use the POS. Missing capabilities: %s.', 'woocommerce-pos' ), implode( ', ', $missing ) );
	248	+ if ( count( $user->roles ) >= 2 ) {
	249	+ $role_names = array_map(
	250	+ function ( $slug ) {
	251	+ $roles = wp_roles()->roles;
	252	+
	253	+ return isset( $roles[ $slug ]['name'] ) ? translate_user_role( $roles[ $slug ]['name'] ) : $slug;
	254	+ },
	255	+ $user->roles
	256	+ );
	257	+ /* translators: %s: Comma-separated role names. */
	258	+ return $message . ' ' . sprintf( __( 'It has the roles %s. A capability denied on one role can override a grant from another, and role-editor plugins such as Members apply that deny first. Remove the extra role or clear the deny in the role editor.', 'woocommerce-pos' ), implode( ', ', $role_names ) );
	259	+ }
	260	+
	261	+ /* translators: Guidance for granting missing POS capabilities. */
	262	+ return $message . ' ' . __( 'Grant them under WCPOS Settings, Access, or assign a role that has them.', 'woocommerce-pos' );
203	263	}
204	264
205	265	/**
206	266	* Validate cashier access for API endpoints.