| @@ -38,8 +38,15 @@ | ||
| 38 | 38 | */ |
| 39 | 39 | public function __construct() { |
| 40 | 40 | register_activation_hook( PLUGIN_FILE, array( $this, 'activate' ) ); |
| 41 | 41 | add_action( 'wpmu_new_blog', array( $this, 'activate_new_site' ) ); |
| 42 | + // The staff-account rule (#1918, #2104) must hold even when WooCommerce is | |
| 43 | + // inactive and Init never starts; it depends on nothing from WooCommerce. | |
| 44 | + add_filter( 'map_meta_cap', array( Services\Permission_Rules::class, 'map_user_meta_caps' ), 10, 4 ); | |
| 45 | + // So must the role fence: a cashier may hand out no role above customer. Last, | |
| 46 | + // so a role-editor plugin adding roles back at a later priority cannot widen it. | |
| 47 | + add_filter( 'editable_roles', array( Services\Permission_Rules::class, 'filter_editable_roles' ), PHP_INT_MAX ); | |
| 48 | + add_action( 'invite_user', array( Services\Permission_Rules::class, 'refuse_unfenced_invite' ), 10, 3 ); | |
| 42 | 49 | add_action( 'plugins_loaded', array( $this, 'init' ) ); |
| 43 | 50 | } |
| 44 | 51 | |
| 45 | 52 | /** |
| @@ -98,20 +105,49 @@ | ||
| 98 | 105 | /** |
| 99 | 106 | * Fired when the plugin is activated. |
| 100 | 107 | * |
| 101 | 108 | * @param bool $install_sync_schema Whether to install the sync schema. |
| 109 | + * @param bool $full_role_sync Whether to repair all default role capabilities. | |
| 102 | 110 | */ |
| 103 | - public function single_activate( bool $install_sync_schema = true ): void { | |
| 104 | - $role_capabilities = self::role_capability_definition(); | |
| 111 | + public function single_activate( bool $install_sync_schema = true, bool $full_role_sync = true ): void { | |
| 112 | + $role_capabilities = self::role_capability_definition(); | |
| 113 | + $capability_names = $role_capabilities; | |
| 114 | + $capability_names['cashier'] = array_merge( array( 'access_woocommerce_pos' ), array_keys( $role_capabilities['cashier'] ) ); | |
| 115 | + $synced = get_option( 'woocommerce_pos_role_caps_synced', false ); | |
| 116 | + if ( ! $full_role_sync && false === $synced && get_option( 'woocommerce_pos_role_caps_fingerprint' ) === $this->role_caps_fingerprint() ) { | |
| 117 | + $synced = $capability_names; | |
| 118 | + } | |
| 119 | + // An upgrade grants only capabilities new to the definition since the | |
| 120 | + // last sync, so a capability the merchant removed on the Access screen | |
| 121 | + // stays removed. Explicit activation still repairs every default. | |
| 122 | + $granted = $capability_names; | |
| 123 | + if ( ! $full_role_sync && \is_array( $synced ) ) { | |
| 124 | + foreach ( $granted as $slug => $capabilities ) { | |
| 125 | + $already = isset( $synced[ $slug ] ) && \is_array( $synced[ $slug ] ) ? $synced[ $slug ] : array(); | |
| 126 | + $granted[ $slug ] = array_values( array_diff( $capabilities, $already ) ); | |
| 127 | + } | |
| 128 | + } | |
| 105 | 129 | |
| 130 | + // Reseed the default template terms on the next request: (re)activation | |
| 131 | + // is the repair a merchant reaches for after deleting a term by hand. | |
| 132 | + // This also runs once per upgrade (version_check re-activates to sync | |
| 133 | + // role caps), so one post-upgrade request pays the ~18 seeding queries. | |
| 134 | + delete_option( Templates::DEFAULT_TERMS_OPTION ); | |
| 135 | + | |
| 136 | + // Second, merchant-reachable trigger for the autoload repair: db_upgrade() | |
| 137 | + // only runs when version_check() trips on an admin load that reaches | |
| 138 | + // woocommerce_init, and a miss there is permanent once bump_versions() ran. | |
| 139 | + self::autoload_request_latches(); | |
| 140 | + Admin\Permalink::ensure_default(); | |
| 141 | + | |
| 106 | 142 | // create POS specific roles. |
| 107 | - $this->create_pos_roles(); | |
| 143 | + $this->create_pos_roles( $granted['cashier'] ); | |
| 108 | 144 | |
| 109 | 145 | // add pos capabilities to non POS roles. |
| 110 | 146 | $this->add_pos_capability( |
| 111 | 147 | array( |
| 112 | - 'administrator' => $role_capabilities['administrator'], | |
| 113 | - 'shop_manager' => $role_capabilities['shop_manager'], | |
| 148 | + 'administrator' => $granted['administrator'], | |
| 149 | + 'shop_manager' => $granted['shop_manager'], | |
| 114 | 150 | ) |
| 115 | 151 | ); |
| 116 | 152 | |
| 117 | 153 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| @@ -116,13 +152,14 @@ | ||
| 116 | 152 | |
| 117 | 153 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| 118 | 154 | $roles_are_persisted = is_array( $stored_roles ); |
| 119 | 155 | if ( $roles_are_persisted ) { |
| 120 | - foreach ( $role_capabilities as $slug => $capabilities ) { | |
| 121 | - $required_capabilities = 'cashier' === $slug | |
| 122 | - ? array_merge( array( 'access_woocommerce_pos' ), array_keys( $capabilities ) ) | |
| 123 | - : $capabilities; | |
| 124 | - foreach ( $required_capabilities as $capability ) { | |
| 156 | + foreach ( $granted as $slug => $capabilities ) { | |
| 157 | + if ( ! isset( $stored_roles[ $slug ] ) ) { | |
| 158 | + $roles_are_persisted = false; | |
| 159 | + break; | |
| 160 | + } | |
| 161 | + foreach ( $capabilities as $capability ) { | |
| 125 | 162 | if ( empty( $stored_roles[ $slug ]['capabilities'][ $capability ] ) ) { |
| 126 | 163 | $roles_are_persisted = false; |
| 127 | 164 | break 2; |
| 128 | 165 | } |
| @@ -131,8 +168,11 @@ | ||
| 131 | 168 | } |
| 132 | 169 | |
| 133 | 170 | $obsolete_customer_create_cap = isset( $role_capabilities['cashier']['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 134 | 171 | if ( $roles_are_persisted && empty( $stored_roles['cashier']['capabilities'][ $obsolete_customer_create_cap ] ) ) { |
| 172 | + // Snapshot first: a fingerprint that advanced past a failed snapshot | |
| 173 | + // write would never retry it. | |
| 174 | + update_option( 'woocommerce_pos_role_caps_synced', $capability_names, true ); | |
| 135 | 175 | update_option( 'woocommerce_pos_role_caps_fingerprint', $this->role_caps_fingerprint(), true ); |
| 136 | 176 | } |
| 137 | 177 | |
| 138 | 178 | // Flag the consent pop-up for the next admin page load. Done here |
| @@ -193,9 +233,12 @@ | ||
| 193 | 233 | ) { |
| 194 | 234 | return; |
| 195 | 235 | } |
| 196 | 236 | |
| 197 | - update_option( Sync_Api::SCHEMA_OPTION, Sync_Api::SCHEMA_VERSION, false ); | |
| 237 | + // Autoloaded: the Init constructor reads this latch on every request. | |
| 238 | + // This flips an existing row only on WP 6.4+; older rows are flipped by | |
| 239 | + // autoload_request_latches() on upgrade. | |
| 240 | + update_option( Sync_Api::SCHEMA_OPTION, Sync_Api::SCHEMA_VERSION, true ); | |
| 198 | 241 | |
| 199 | 242 | if ( null !== $previous_schema && version_compare( (string) $previous_schema, Sync_Api::SCHEMA_VERSION, '<' ) ) { |
| 200 | 243 | global $wpdb; |
| 201 | 244 | $wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}wcpos_sync_change_log" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Known legacy table name. |
| @@ -297,9 +340,10 @@ | ||
| 297 | 340 | $plugin_needs_upgrade = version_compare( $old, VERSION, '<' ); |
| 298 | 341 | $sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 299 | 342 | |
| 300 | 343 | $role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 301 | - $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint; | |
| 344 | + $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint | |
| 345 | + || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 302 | 346 | if ( ! $plugin_needs_upgrade && ! $sync_needs_upgrade && ! $role_caps_need_sync ) { |
| 303 | 347 | return; |
| 304 | 348 | } |
| 305 | 349 | |
| @@ -311,9 +355,10 @@ | ||
| 311 | 355 | $locked_plugin_needs_upgrade = version_compare( $locked_old, VERSION, '<' ); |
| 312 | 356 | $locked_sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 313 | 357 | |
| 314 | 358 | $locked_role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 315 | - $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint; | |
| 359 | + $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint | |
| 360 | + || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 316 | 361 | if ( ! $locked_plugin_needs_upgrade && ! $locked_sync_needs_upgrade && ! $locked_role_caps_need_sync ) { |
| 317 | 362 | $this->release_db_upgrade_lock(); |
| 318 | 363 | return; |
| 319 | 364 | } |
| @@ -331,9 +376,9 @@ | ||
| 331 | 376 | // requires translations to be loaded (WordPress 6.7+). |
| 332 | 377 | add_action( |
| 333 | 378 | 'init', |
| 334 | 379 | function () { |
| 335 | - $this->single_activate( false ); | |
| 380 | + $this->single_activate( false, false ); | |
| 336 | 381 | } |
| 337 | 382 | ); |
| 338 | 383 | } |
| 339 | 384 | |
| @@ -498,10 +543,13 @@ | ||
| 498 | 543 | } |
| 499 | 544 | |
| 500 | 545 | /** |
| 501 | 546 | * Add POS specific roles. |
| 547 | + * | |
| 548 | + * @param string[]|null $capabilities Capability names to sync onto an existing role, or null for | |
| 549 | + * every default. A missing role is always created with the full set. | |
| 502 | 550 | */ |
| 503 | - private function create_pos_roles(): void { | |
| 551 | + private function create_pos_roles( ?array $capabilities = null ): void { | |
| 504 | 552 | $role_capabilities = self::role_capability_definition(); |
| 505 | 553 | $cashier_capabilities = $role_capabilities['cashier']; |
| 506 | 554 | |
| 507 | 555 | add_role( |
| @@ -507,9 +555,11 @@ | ||
| 507 | 555 | add_role( |
| 508 | 556 | 'cashier', |
| 509 | 557 | /* translators: Plugin activation notice label. */ |
| 510 | 558 | __( 'Cashier', 'woocommerce-pos' ), |
| 511 | - $cashier_capabilities | |
| 559 | + // A missing role is created whole, access gate included, whatever | |
| 560 | + // subset an incremental upgrade asked to sync. | |
| 561 | + array_merge( array( 'access_woocommerce_pos' => true ), $cashier_capabilities ) | |
| 512 | 562 | ); |
| 513 | 563 | |
| 514 | 564 | $obsolete_customer_create_cap = isset( $cashier_capabilities['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 515 | 565 | $cashier = get_role( 'cashier' ); |
| @@ -516,14 +566,14 @@ | ||
| 516 | 566 | if ( $cashier ) { |
| 517 | 567 | $cashier->remove_cap( $obsolete_customer_create_cap ); |
| 518 | 568 | } |
| 519 | 569 | |
| 520 | - // Sync all capabilities to the existing role. add_role() is a no-op when | |
| 570 | + // Sync the requested capabilities to the role. add_role() is a no-op when | |
| 521 | 571 | // the role already exists, so capabilities added in newer versions would |
| 522 | 572 | // never reach existing installs without this. |
| 523 | 573 | $this->add_pos_capability( |
| 524 | 574 | array( |
| 525 | - 'cashier' => array_merge( | |
| 575 | + 'cashier' => $capabilities ?? array_merge( | |
| 526 | 576 | array( 'access_woocommerce_pos' ), |
| 527 | 577 | array_keys( $cashier_capabilities ) |
| 528 | 578 | ), |
| 529 | 579 | ) |
| @@ -574,8 +624,94 @@ | ||
| 574 | 624 | |
| 575 | 625 | if ( Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ) ) { |
| 576 | 626 | $this->install_sync_schema(); |
| 577 | 627 | } |
| 628 | + | |
| 629 | + // Installs that predate 2026-09 wrote the per-request latches with | |
| 630 | + // autoload off; every upgrade re-asserts autoload so the flip is | |
| 631 | + // idempotent and needs no versioned update file. | |
| 632 | + self::autoload_request_latches(); | |
| 633 | + Admin\Permalink::ensure_default(); | |
| 634 | + } | |
| 635 | + | |
| 636 | + /** | |
| 637 | + * Every option row that is read on EVERY request and must therefore ride in | |
| 638 | + * alloptions: the three sync latches the Init constructor reads, the permalink | |
| 639 | + * slug Template_Router reads, and each registered settings section that | |
| 640 | + * declares {@see Services\Settings\Abstract_Section::autoload()} — the | |
| 641 | + * sections are the extension point, so Pro's and extensions' sections join | |
| 642 | + * the repair by declaring it, without touching this file. | |
| 643 | + * | |
| 644 | + * Needed because core's update_option() returns early on an unchanged value | |
| 645 | + * WITHOUT touching the autoload column, so a writer alone never repairs a row | |
| 646 | + * an older release wrote with autoload off. Without a persistent object cache | |
| 647 | + * each such row cost one `SELECT option_value` per page load (measured | |
| 648 | + * 2026-09-03 on dev-next and dev-free). | |
| 649 | + * | |
| 650 | + * @return string[] | |
| 651 | + */ | |
| 652 | + private static function request_option_names(): array { | |
| 653 | + $names = array( | |
| 654 | + Sync_Api::SCHEMA_OPTION, | |
| 655 | + \WCPOS\WooCommercePOS\Sync\Visibility_Observer::SEED_VERSION_OPTION, | |
| 656 | + \WCPOS\WooCommercePOS\Sync\Config_Fingerprint::CLEANUP_VERSION_OPTION, | |
| 657 | + Admin\Permalink::DB_KEY, | |
| 658 | + ); | |
| 659 | + foreach ( Services\Settings::instance()->sections()->all() as $section ) { | |
| 660 | + if ( $section instanceof Services\Settings\Abstract_Section && $section->autoload() ) { | |
| 661 | + $names[] = $section->autoload_option_name(); | |
| 662 | + } | |
| 663 | + } | |
| 664 | + return $names; | |
| 665 | + } | |
| 666 | + | |
| 667 | + /** | |
| 668 | + * Flip the per-request rows to autoload in place, and seed the settings | |
| 669 | + * sections that are absent. | |
| 670 | + * | |
| 671 | + * One UPDATE on the flag column: never delete-and-recreate, because | |
| 672 | + * `Sync_Api::SCHEMA_OPTION` gates the sync observers on every request and a | |
| 673 | + * request landing in that gap would run with journaling off. 'yes' is | |
| 674 | + * accepted by every core version (6.6+ maps it alongside 'on'). Idempotent: | |
| 675 | + * already-autoloaded rows match nothing. Latches that were never written | |
| 676 | + * stay absent (their absence is the signal). An autoloaded settings section | |
| 677 | + * that was never saved is seeded as an autoloaded row — an absent option is | |
| 678 | + * queried on every request too. General also persists its migrated consent | |
| 679 | + * so the legacy row does not remain on the read path; other defaults stay | |
| 680 | + * dynamic. | |
| 681 | + */ | |
| 682 | + public static function autoload_request_latches(): void { | |
| 683 | + global $wpdb; | |
| 684 | + // The key comes from the section itself (autoload_option_name()): Pro's | |
| 685 | + // License section stores under a Pro-prefixed key, so deriving it from | |
| 686 | + // id() flipped nothing for that row and seeded a stray free-prefixed one. | |
| 687 | + foreach ( Services\Settings::instance()->sections()->all() as $section ) { | |
| 688 | + if ( ! $section instanceof Services\Settings\Abstract_Section || ! $section->autoload() ) { | |
| 689 | + continue; | |
| 690 | + } | |
| 691 | + $option_name = $section->autoload_option_name(); | |
| 692 | + if ( false === get_option( $option_name ) ) { | |
| 693 | + $value = $section instanceof Services\Settings\General_Section | |
| 694 | + ? array( 'tracking_consent' => $section->raw_tracking_consent() ) | |
| 695 | + : array(); | |
| 696 | + add_option( $option_name, $value, '', true ); | |
| 697 | + } | |
| 698 | + } | |
| 699 | + $options = self::request_option_names(); | |
| 700 | + $placeholders = implode( ', ', array_fill( 0, \count( $options ), '%s' ) ); | |
| 701 | + $flipped = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- the flag column is the target; caches are cleared below. | |
| 702 | + $wpdb->prepare( | |
| 703 | + "UPDATE {$wpdb->options} SET autoload = 'yes' WHERE option_name IN ({$placeholders}) AND autoload NOT IN ('yes', 'on', 'auto-on')", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- placeholders are generated for the prepared values. | |
| 704 | + $options | |
| 705 | + ) | |
| 706 | + ); | |
| 707 | + if ( ! $flipped ) { | |
| 708 | + return; | |
| 709 | + } | |
| 710 | + foreach ( $options as $option ) { | |
| 711 | + wp_cache_delete( $option, 'options' ); | |
| 712 | + } | |
| 713 | + wp_cache_delete( 'alloptions', 'options' ); | |
| 578 | 714 | } |
| 579 | 715 | |
| 580 | 716 | /** |
| 581 | 717 | * If \WCPOS\WooCommercePOSPro\ is installed, check the version is above MIN_PRO_VERSION. |
