| @@ -38,8 +38,15 @@ | ||
| 38 | 38 | */ |
| 39 | 39 | public function __construct() { |
| 40 | 40 | register_activation_hook( PLUGIN_FILE, array( $this, 'activate' ) ); |
| 41 | 41 | add_action( 'wpmu_new_blog', array( $this, 'activate_new_site' ) ); |
| 42 | + // The staff-account rule (#1918, #2104) must hold even when WooCommerce is | |
| 43 | + // inactive and Init never starts; it depends on nothing from WooCommerce. | |
| 44 | + add_filter( 'map_meta_cap', array( Services\Permission_Rules::class, 'map_user_meta_caps' ), 10, 4 ); | |
| 45 | + // So must the role fence: a cashier may hand out no role above customer. Last, | |
| 46 | + // so a role-editor plugin adding roles back at a later priority cannot widen it. | |
| 47 | + add_filter( 'editable_roles', array( Services\Permission_Rules::class, 'filter_editable_roles' ), PHP_INT_MAX ); | |
| 48 | + add_action( 'invite_user', array( Services\Permission_Rules::class, 'refuse_unfenced_invite' ), 10, 3 ); | |
| 42 | 49 | add_action( 'plugins_loaded', array( $this, 'init' ) ); |
| 43 | 50 | } |
| 44 | 51 | |
| 45 | 52 | /** |
| @@ -98,11 +105,28 @@ | ||
| 98 | 105 | /** |
| 99 | 106 | * Fired when the plugin is activated. |
| 100 | 107 | * |
| 101 | 108 | * @param bool $install_sync_schema Whether to install the sync schema. |
| 109 | + * @param bool $full_role_sync Whether to repair all default role capabilities. | |
| 102 | 110 | */ |
| 103 | - public function single_activate( bool $install_sync_schema = true ): void { | |
| 104 | - $role_capabilities = self::role_capability_definition(); | |
| 111 | + public function single_activate( bool $install_sync_schema = true, bool $full_role_sync = true ): void { | |
| 112 | + $role_capabilities = self::role_capability_definition(); | |
| 113 | + $capability_names = $role_capabilities; | |
| 114 | + $capability_names['cashier'] = array_merge( array( 'access_woocommerce_pos' ), array_keys( $role_capabilities['cashier'] ) ); | |
| 115 | + $synced = get_option( 'woocommerce_pos_role_caps_synced', false ); | |
| 116 | + if ( ! $full_role_sync && false === $synced && get_option( 'woocommerce_pos_role_caps_fingerprint' ) === $this->role_caps_fingerprint() ) { | |
| 117 | + $synced = $capability_names; | |
| 118 | + } | |
| 119 | + // An upgrade grants only capabilities new to the definition since the | |
| 120 | + // last sync, so a capability the merchant removed on the Access screen | |
| 121 | + // stays removed. Explicit activation still repairs every default. | |
| 122 | + $granted = $capability_names; | |
| 123 | + if ( ! $full_role_sync && \is_array( $synced ) ) { | |
| 124 | + foreach ( $granted as $slug => $capabilities ) { | |
| 125 | + $already = isset( $synced[ $slug ] ) && \is_array( $synced[ $slug ] ) ? $synced[ $slug ] : array(); | |
| 126 | + $granted[ $slug ] = array_values( array_diff( $capabilities, $already ) ); | |
| 127 | + } | |
| 128 | + } | |
| 105 | 129 | |
| 106 | 130 | // Reseed the default template terms on the next request: (re)activation |
| 107 | 131 | // is the repair a merchant reaches for after deleting a term by hand. |
| 108 | 132 | // This also runs once per upgrade (version_check re-activates to sync |
| @@ -115,15 +139,15 @@ | ||
| 115 | 139 | self::autoload_request_latches(); |
| 116 | 140 | Admin\Permalink::ensure_default(); |
| 117 | 141 | |
| 118 | 142 | // create POS specific roles. |
| 119 | - $this->create_pos_roles(); | |
| 143 | + $this->create_pos_roles( $granted['cashier'] ); | |
| 120 | 144 | |
| 121 | 145 | // add pos capabilities to non POS roles. |
| 122 | 146 | $this->add_pos_capability( |
| 123 | 147 | array( |
| 124 | - 'administrator' => $role_capabilities['administrator'], | |
| 125 | - 'shop_manager' => $role_capabilities['shop_manager'], | |
| 148 | + 'administrator' => $granted['administrator'], | |
| 149 | + 'shop_manager' => $granted['shop_manager'], | |
| 126 | 150 | ) |
| 127 | 151 | ); |
| 128 | 152 | |
| 129 | 153 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| @@ -128,13 +152,14 @@ | ||
| 128 | 152 | |
| 129 | 153 | $stored_roles = get_option( wp_roles()->role_key, array() ); |
| 130 | 154 | $roles_are_persisted = is_array( $stored_roles ); |
| 131 | 155 | if ( $roles_are_persisted ) { |
| 132 | - foreach ( $role_capabilities as $slug => $capabilities ) { | |
| 133 | - $required_capabilities = 'cashier' === $slug | |
| 134 | - ? array_merge( array( 'access_woocommerce_pos' ), array_keys( $capabilities ) ) | |
| 135 | - : $capabilities; | |
| 136 | - foreach ( $required_capabilities as $capability ) { | |
| 156 | + foreach ( $granted as $slug => $capabilities ) { | |
| 157 | + if ( ! isset( $stored_roles[ $slug ] ) ) { | |
| 158 | + $roles_are_persisted = false; | |
| 159 | + break; | |
| 160 | + } | |
| 161 | + foreach ( $capabilities as $capability ) { | |
| 137 | 162 | if ( empty( $stored_roles[ $slug ]['capabilities'][ $capability ] ) ) { |
| 138 | 163 | $roles_are_persisted = false; |
| 139 | 164 | break 2; |
| 140 | 165 | } |
| @@ -143,8 +168,11 @@ | ||
| 143 | 168 | } |
| 144 | 169 | |
| 145 | 170 | $obsolete_customer_create_cap = isset( $role_capabilities['cashier']['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 146 | 171 | if ( $roles_are_persisted && empty( $stored_roles['cashier']['capabilities'][ $obsolete_customer_create_cap ] ) ) { |
| 172 | + // Snapshot first: a fingerprint that advanced past a failed snapshot | |
| 173 | + // write would never retry it. | |
| 174 | + update_option( 'woocommerce_pos_role_caps_synced', $capability_names, true ); | |
| 147 | 175 | update_option( 'woocommerce_pos_role_caps_fingerprint', $this->role_caps_fingerprint(), true ); |
| 148 | 176 | } |
| 149 | 177 | |
| 150 | 178 | // Flag the consent pop-up for the next admin page load. Done here |
| @@ -312,9 +340,10 @@ | ||
| 312 | 340 | $plugin_needs_upgrade = version_compare( $old, VERSION, '<' ); |
| 313 | 341 | $sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 314 | 342 | |
| 315 | 343 | $role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 316 | - $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint; | |
| 344 | + $role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $role_caps_fingerprint | |
| 345 | + || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 317 | 346 | if ( ! $plugin_needs_upgrade && ! $sync_needs_upgrade && ! $role_caps_need_sync ) { |
| 318 | 347 | return; |
| 319 | 348 | } |
| 320 | 349 | |
| @@ -326,9 +355,10 @@ | ||
| 326 | 355 | $locked_plugin_needs_upgrade = version_compare( $locked_old, VERSION, '<' ); |
| 327 | 356 | $locked_sync_needs_upgrade = Sync_Api::SCHEMA_VERSION !== get_option( Sync_Api::SCHEMA_OPTION, null ); |
| 328 | 357 | |
| 329 | 358 | $locked_role_caps_fingerprint = $this->role_caps_fingerprint(); |
| 330 | - $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint; | |
| 359 | + $locked_role_caps_need_sync = get_option( 'woocommerce_pos_role_caps_fingerprint' ) !== $locked_role_caps_fingerprint | |
| 360 | + || false === get_option( 'woocommerce_pos_role_caps_synced' ); | |
| 331 | 361 | if ( ! $locked_plugin_needs_upgrade && ! $locked_sync_needs_upgrade && ! $locked_role_caps_need_sync ) { |
| 332 | 362 | $this->release_db_upgrade_lock(); |
| 333 | 363 | return; |
| 334 | 364 | } |
| @@ -346,9 +376,9 @@ | ||
| 346 | 376 | // requires translations to be loaded (WordPress 6.7+). |
| 347 | 377 | add_action( |
| 348 | 378 | 'init', |
| 349 | 379 | function () { |
| 350 | - $this->single_activate( false ); | |
| 380 | + $this->single_activate( false, false ); | |
| 351 | 381 | } |
| 352 | 382 | ); |
| 353 | 383 | } |
| 354 | 384 | |
| @@ -513,10 +543,13 @@ | ||
| 513 | 543 | } |
| 514 | 544 | |
| 515 | 545 | /** |
| 516 | 546 | * Add POS specific roles. |
| 547 | + * | |
| 548 | + * @param string[]|null $capabilities Capability names to sync onto an existing role, or null for | |
| 549 | + * every default. A missing role is always created with the full set. | |
| 517 | 550 | */ |
| 518 | - private function create_pos_roles(): void { | |
| 551 | + private function create_pos_roles( ?array $capabilities = null ): void { | |
| 519 | 552 | $role_capabilities = self::role_capability_definition(); |
| 520 | 553 | $cashier_capabilities = $role_capabilities['cashier']; |
| 521 | 554 | |
| 522 | 555 | add_role( |
| @@ -522,9 +555,11 @@ | ||
| 522 | 555 | add_role( |
| 523 | 556 | 'cashier', |
| 524 | 557 | /* translators: Plugin activation notice label. */ |
| 525 | 558 | __( 'Cashier', 'woocommerce-pos' ), |
| 526 | - $cashier_capabilities | |
| 559 | + // A missing role is created whole, access gate included, whatever | |
| 560 | + // subset an incremental upgrade asked to sync. | |
| 561 | + array_merge( array( 'access_woocommerce_pos' => true ), $cashier_capabilities ) | |
| 527 | 562 | ); |
| 528 | 563 | |
| 529 | 564 | $obsolete_customer_create_cap = isset( $cashier_capabilities['create_customers'] ) ? 'promote_users' : 'create_customers'; |
| 530 | 565 | $cashier = get_role( 'cashier' ); |
| @@ -531,14 +566,14 @@ | ||
| 531 | 566 | if ( $cashier ) { |
| 532 | 567 | $cashier->remove_cap( $obsolete_customer_create_cap ); |
| 533 | 568 | } |
| 534 | 569 | |
| 535 | - // Sync all capabilities to the existing role. add_role() is a no-op when | |
| 570 | + // Sync the requested capabilities to the role. add_role() is a no-op when | |
| 536 | 571 | // the role already exists, so capabilities added in newer versions would |
| 537 | 572 | // never reach existing installs without this. |
| 538 | 573 | $this->add_pos_capability( |
| 539 | 574 | array( |
| 540 | - 'cashier' => array_merge( | |
| 575 | + 'cashier' => $capabilities ?? array_merge( | |
| 541 | 576 | array( 'access_woocommerce_pos' ), |
| 542 | 577 | array_keys( $cashier_capabilities ) |
| 543 | 578 | ), |
| 544 | 579 | ) |
