← All changes | includes/Activator.php +150 -18 1.10.5 → 1.10.21 View file →

		@@ -38,8 +38,11 @@
38	38	*/
39	39	public function __construct() {
40	40	register_activation_hook( PLUGIN_FILE, array( $this, 'activate' ) );
41	41	add_action( 'wpmu_new_blog', array( $this, 'activate_new_site' ) );
	42	+ // The staff-account rule (#1918, #2104) must hold even when WooCommerce is
	43	+ // inactive and Init never starts; it depends on nothing from WooCommerce.
	44	+ add_filter( 'map_meta_cap', array( Services\Permission_Rules::class, 'map_user_meta_caps' ), 10, 4 );
42	45	add_action( 'plugins_loaded', array( $this, 'init' ) );
43	46	}
44	47
45	48	/**
		@@ -98,20 +101,49 @@
98	101	/**
99	102	* Fired when the plugin is activated.
100	103	*
101	104	* @param bool $install_sync_schema Whether to install the sync schema.
	105	+ * @param bool $full_role_sync Whether to repair all default role capabilities.
102	106	*/
103		- public function single_activate( bool $install_sync_schema = true ): void {
104		- $role_capabilities = self::role_capability_definition();
	107	+ public function single_activate( bool $install_sync_schema = true, bool $full_role_sync = true ): void {
	108	+ $role_capabilities = self::role_capability_definition();
	109	+ $capability_names = $role_capabilities;
	110	+ $capability_names['cashier'] = array_merge( array( 'access_woocommerce_pos' ), array_keys( $role_capabilities['cashier'] ) );
	111	+ $synced = get_option( 'woocommerce_pos_role_caps_synced', false );
	112	+ if ( ! $full_role_sync && false === $synced && get_option( 'woocommerce_pos_role_caps_fingerprint' ) === $this->role_caps_fingerprint() ) {
	113	+ $synced = $capability_names;
	114	+ }
	115	+ // An upgrade grants only capabilities new to the definition since the
	116	+ // last sync, so a capability the merchant removed on the Access screen
	117	+ // stays removed. Explicit activation still repairs every default.
	118	+ $granted = $capability_names;
	119	+ if ( ! $full_role_sync && \is_array( $synced ) ) {
	120	+ foreach ( $granted as $slug => $capabilities ) {
	121	+ $already = isset( $synced[ $slug ] ) && \is_array( $synced[ $slug ] ) ? $synced[ $slug ] : array();
	122	+ $granted[ $slug ] = array_values( array_diff( $capabilities, $already ) );
	123	+ }
	124	+ }
105	125
	126	+ // Reseed the default template terms on the next request: (re)activation
	127	+ // is the repair a merchant reaches for after deleting a term by hand.
	128	+ // This also runs once per upgrade (version_check re-activates to sync
	129	+ // role caps), so one post-upgrade request pays the ~18 seeding queries.
	130	+ delete_option( Templates::DEFAULT_TERMS_OPTION );
	131	+
	132	+ // Second, merchant-reachable trigger for the autoload repair: db_upgrade()
	133	+ // only runs when version_check() trips on an admin load that reaches
	134	+ // woocommerce_init, and a miss there is permanent once bump_versions() ran.
	135	+ self::autoload_request_latches();
	136	+ Admin\Permalink::ensure_default();
	137	+
106	138	// create POS specific roles.
107		- $this->create_pos_roles();
	139	+ $this->create_pos_roles( $granted['cashier'] );
108	140
109	141	// add pos capabilities to non POS roles.
110	142	$this->add_pos_capability(
111	143	array(
112		- 'administrator' => $role_capabilities['administrator'],
113		- 'shop_manager' => $role_capabilities['shop_manager'],
	144	+ 'administrator' => $granted['administrator'],
	145	+ 'shop_manager' => $granted['shop_manager'],
114	146	)
115	147	);
116	148
117	149	$stored_roles = get_option( wp_roles()->role_key, array() );
		@@ -116,13 +148,14 @@
116	148
117	149	$stored_roles = get_option( wp_roles()->role_key, array() );
118	150	$roles_are_persisted = is_array( $stored_roles );
119	151	if ( $roles_are_persisted ) {
120		- foreach ( $role_capabilities as $slug => $capabilities ) {
121		- $required_capabilities = 'cashier' === $slug
122		- ? array_merge( array( 'access_woocommerce_pos' ), array_keys( $capabilities ) )
123		- : $capabilities;
124		- foreach ( $required_capabilities as $capability ) {
	152	+ foreach ( $granted as $slug => $capabilities ) {
	153	+ if ( ! isset( $stored_roles[ $slug ] ) ) {
	154	+ $roles_are_persisted = false;
	155	+ break;
	156	+ }
	157	+ foreach ( $capabilities as $capability ) {
125	158	if ( empty( $stored_roles[ $slug ]['capabilities'][ $capability ] ) ) {
126	159	$roles_are_persisted = false;
127	160	break 2;
128	161	}
		@@ -131,8 +164,11 @@
131	164	}
132	165
133	166	$obsolete_customer_create_cap = isset( $role_capabilities['cashier']['create_customers'] ) ? 'promote_users' : 'create_customers';
134	167	if ( $roles_are_persisted && empty( $stored_roles['cashier']['capabilities'][ $obsolete_customer_create_cap ] ) ) {
	168	+ // Snapshot first: a fingerprint that advanced past a failed snapshot
	169	+ // write would never retry it.
	170	+ update_option( 'woocommerce_pos_role_caps_synced', $capability_names, true );
135	171	update_option( 'woocommerce_pos_role_caps_fingerprint', $this->role_caps_fingerprint(), true );
136	172	}
137	173
138	174	// Flag the consent pop-up for the next admin page load. Done here
		@@ -193,9 +229,12 @@
193	229	) {
194	230	return;
195	231	}
196	232
197		- update_option( Sync_Api::SCHEMA_OPTION, Sync_Api::SCHEMA_VERSION, false );
	233	+ // Autoloaded: the Init constructor reads this latch on every request.
	234	+ // This flips an existing row only on WP 6.4+; older rows are flipped by
	235	+ // autoload_request_latches() on upgrade.
	236	+ update_option( Sync_Api::SCHEMA_OPTION, Sync_Api::SCHEMA_VERSION, true );
198	237
199	238	if ( null !== $previous_schema && version_compare( (string) $previous_schema, Sync_Api::SCHEMA_VERSION, '<' ) ) {
200	239	global $wpdb;
201	240	$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}wcpos_sync_change_log" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Known legacy table name.
		@@ -297,9 +336,10 @@
297	336	$plugin_needs_upgrade = version_compare( $old, VERSION, '<' );
298	337	$sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null );
299	338
300	339	$role_caps_fingerprint = $this->role_caps_fingerprint();
301		- $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint;
	340	+ $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint
	341	+ || false === get_option( 'woocommerce_pos_role_caps_synced' );
302	342	if ( ! $plugin_needs_upgrade && ! $sync_needs_upgrade && ! $role_caps_need_sync ) {
303	343	return;
304	344	}
305	345
		@@ -311,9 +351,10 @@
311	351	$locked_plugin_needs_upgrade = version_compare( $locked_old, VERSION, '<' );
312	352	$locked_sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null );
313	353
314	354	$locked_role_caps_fingerprint = $this->role_caps_fingerprint();
315		- $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint;
	355	+ $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint
	356	+ || false === get_option( 'woocommerce_pos_role_caps_synced' );
316	357	if ( ! $locked_plugin_needs_upgrade && ! $locked_sync_needs_upgrade && ! $locked_role_caps_need_sync ) {
317	358	$this->release_db_upgrade_lock();
318	359	return;
319	360	}
		@@ -331,9 +372,9 @@
331	372	// requires translations to be loaded (WordPress 6.7+).
332	373	add_action(
333	374	'init',
334	375	function () {
335		- $this->single_activate( false );
	376	+ $this->single_activate( false, false );
336	377	}
337	378	);
338	379	}
339	380
		@@ -498,10 +539,13 @@
498	539	}
499	540
500	541	/**
501	542	* Add POS specific roles.
	543	+ *
	544	+ * @param string[]|null $capabilities Capability names to sync onto an existing role, or null for
	545	+ * every default. A missing role is always created with the full set.
502	546	*/
503		- private function create_pos_roles(): void {
	547	+ private function create_pos_roles( ?array $capabilities = null ): void {
504	548	$role_capabilities = self::role_capability_definition();
505	549	$cashier_capabilities = $role_capabilities['cashier'];
506	550
507	551	add_role(
		@@ -507,9 +551,11 @@
507	551	add_role(
508	552	'cashier',
509	553	/* translators: Plugin activation notice label. */
510	554	__( 'Cashier', 'woocommerce-pos' ),
511		- $cashier_capabilities
	555	+ // A missing role is created whole, access gate included, whatever
	556	+ // subset an incremental upgrade asked to sync.
	557	+ array_merge( array( 'access_woocommerce_pos' => true ), $cashier_capabilities )
512	558	);
513	559
514	560	$obsolete_customer_create_cap = isset( $cashier_capabilities['create_customers'] ) ? 'promote_users' : 'create_customers';
515	561	$cashier = get_role( 'cashier' );
		@@ -516,14 +562,14 @@
516	562	if ( $cashier ) {
517	563	$cashier->remove_cap( $obsolete_customer_create_cap );
518	564	}
519	565
520		- // Sync all capabilities to the existing role. add_role() is a no-op when
	566	+ // Sync the requested capabilities to the role. add_role() is a no-op when
521	567	// the role already exists, so capabilities added in newer versions would
522	568	// never reach existing installs without this.
523	569	$this->add_pos_capability(
524	570	array(
525		- 'cashier' => array_merge(
	571	+ 'cashier' => $capabilities ?? array_merge(
526	572	array( 'access_woocommerce_pos' ),
527	573	array_keys( $cashier_capabilities )
528	574	),
529	575	)
		@@ -574,8 +620,94 @@
574	620
575	621	if ( Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ) ) {
576	622	$this->install_sync_schema();
577	623	}
	624	+
	625	+ // Installs that predate 2026-09 wrote the per-request latches with
	626	+ // autoload off; every upgrade re-asserts autoload so the flip is
	627	+ // idempotent and needs no versioned update file.
	628	+ self::autoload_request_latches();
	629	+ Admin\Permalink::ensure_default();
	630	+ }
	631	+
	632	+ /**
	633	+ * Every option row that is read on EVERY request and must therefore ride in
	634	+ * alloptions: the three sync latches the Init constructor reads, the permalink
	635	+ * slug Template_Router reads, and each registered settings section that
	636	+ * declares {@see Services\Settings\Abstract_Section::autoload()} — the
	637	+ * sections are the extension point, so Pro's and extensions' sections join
	638	+ * the repair by declaring it, without touching this file.
	639	+ *
	640	+ * Needed because core's update_option() returns early on an unchanged value
	641	+ * WITHOUT touching the autoload column, so a writer alone never repairs a row
	642	+ * an older release wrote with autoload off. Without a persistent object cache
	643	+ * each such row cost one `SELECT option_value` per page load (measured
	644	+ * 2026-09-03 on dev-next and dev-free).
	645	+ *
	646	+ * @return string[]
	647	+ */
	648	+ private static function request_option_names(): array {
	649	+ $names = array(
	650	+ Sync_Api::SCHEMA_OPTION,
	651	+ \WCPOS\WooCommercePOS\Sync\Visibility_Observer::SEED_VERSION_OPTION,
	652	+ \WCPOS\WooCommercePOS\Sync\Config_Fingerprint::CLEANUP_VERSION_OPTION,
	653	+ Admin\Permalink::DB_KEY,
	654	+ );
	655	+ foreach ( Services\Settings::instance()->sections()->all() as $section ) {
	656	+ if ( $section instanceof Services\Settings\Abstract_Section && $section->autoload() ) {
	657	+ $names[] = $section->autoload_option_name();
	658	+ }
	659	+ }
	660	+ return $names;
	661	+ }
	662	+
	663	+ /**
	664	+ * Flip the per-request rows to autoload in place, and seed the settings
	665	+ * sections that are absent.
	666	+ *
	667	+ * One UPDATE on the flag column: never delete-and-recreate, because
	668	+ * `Sync_Api::SCHEMA_OPTION` gates the sync observers on every request and a
	669	+ * request landing in that gap would run with journaling off. 'yes' is
	670	+ * accepted by every core version (6.6+ maps it alongside 'on'). Idempotent:
	671	+ * already-autoloaded rows match nothing. Latches that were never written
	672	+ * stay absent (their absence is the signal). An autoloaded settings section
	673	+ * that was never saved is seeded as an autoloaded row — an absent option is
	674	+ * queried on every request too. General also persists its migrated consent
	675	+ * so the legacy row does not remain on the read path; other defaults stay
	676	+ * dynamic.
	677	+ */
	678	+ public static function autoload_request_latches(): void {
	679	+ global $wpdb;
	680	+ // The key comes from the section itself (autoload_option_name()): Pro's
	681	+ // License section stores under a Pro-prefixed key, so deriving it from
	682	+ // id() flipped nothing for that row and seeded a stray free-prefixed one.
	683	+ foreach ( Services\Settings::instance()->sections()->all() as $section ) {
	684	+ if ( ! $section instanceof Services\Settings\Abstract_Section || ! $section->autoload() ) {
	685	+ continue;
	686	+ }
	687	+ $option_name = $section->autoload_option_name();
	688	+ if ( false === get_option( $option_name ) ) {
	689	+ $value = $section instanceof Services\Settings\General_Section
	690	+ ? array( 'tracking_consent' => $section->raw_tracking_consent() )
	691	+ : array();
	692	+ add_option( $option_name, $value, '', true );
	693	+ }
	694	+ }
	695	+ $options = self::request_option_names();
	696	+ $placeholders = implode( ', ', array_fill( 0, \count( $options ), '%s' ) );
	697	+ $flipped = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- the flag column is the target; caches are cleared below.
	698	+ $wpdb->prepare(
	699	+ "UPDATE {$wpdb->options} SET autoload = 'yes' WHERE option_name IN ({$placeholders}) AND autoload NOT IN ('yes', 'on', 'auto-on')", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- placeholders are generated for the prepared values.
	700	+ $options
	701	+ )
	702	+ );
	703	+ if ( ! $flipped ) {
	704	+ return;
	705	+ }
	706	+ foreach ( $options as $option ) {
	707	+ wp_cache_delete( $option, 'options' );
	708	+ }
	709	+ wp_cache_delete( 'alloptions', 'options' );
578	710	}
579	711
580	712	/**
581	713	* If \WCPOS\WooCommercePOSPro\ is installed, check the version is above MIN_PRO_VERSION.