class-wc-rest-paypal-buttons-controller.php — WooCommerce 10.9.3

woocommerce / includes / rest-api / Controllers / Version3 / class-wc-rest-paypal-buttons-controller.php

woocommerce / includes / rest-api / Controllers / Version3 Last commit date

class-wc-rest-paypal-buttons-controller.php

215 lines

1	<?php
2	/**
3	*
4	* REST API PayPal buttons controller
5	*
6	* @package WooCommerce\RestApi
7	* @since 10.3.0
8	*/
9
10	declare(strict_types=1);
11
12	defined( 'ABSPATH' ) \|\| exit;
13
14	use Automattic\WooCommerce\Enums\OrderStatus;
15	use Automattic\WooCommerce\Gateways\PayPal\Constants as PayPalConstants;
16	use Automattic\WooCommerce\Gateways\PayPal\Request as PayPalRequest;
17
18	// Require the deprecated classes for backward compatibility.
19	// This will be removed in 11.0.0.
20	if ( ! class_exists( 'WC_Gateway_Paypal_Constants' ) ) {
21	require_once WC_ABSPATH . 'includes/gateways/paypal/includes/class-wc-gateway-paypal-constants.php';
22	}
23
24	if ( ! class_exists( 'WC_Gateway_Paypal_Request' ) ) {
25	require_once WC_ABSPATH . 'includes/gateways/paypal/includes/class-wc-gateway-paypal-request.php';
26	}
27
28	/**
29	* REST API PayPal buttons controller class.
30	*
31	* @package WooCommerce\RestApi
32	* @extends WC_REST_Controller
33	*/
34	class WC_REST_Paypal_Buttons_Controller extends WC_REST_Controller {
35
36	/**
37	* Endpoint namespace.
38	*
39	* @var string
40	*/
41	protected $namespace = 'wc/v3';
42
43	/**
44	* Route base.
45	*
46	* @var string
47	*/
48	protected $rest_base = 'paypal-buttons';
49
50	/**
51	* Register the routes for the PayPal buttons functionality handler.
52	*
53	* @return void
54	*/
55	public function register_routes() {
56	register_rest_route(
57	$this->namespace,
58	'/' . $this->rest_base . '/create-order',
59	array(
60	'methods' => WP_REST_Server::CREATABLE,
61	'callback' => array( $this, 'create_order' ),
62	'permission_callback' => array( $this, 'validate_create_order_request' ),
63	)
64	);
65
66	register_rest_route(
67	$this->namespace,
68	'/' . $this->rest_base . '/cancel-payment',
69	array(
70	'methods' => WP_REST_Server::CREATABLE,
71	'callback' => array( $this, 'cancel_payment' ),
72	'permission_callback' => array( $this, 'validate_cancel_payment_request' ),
73	)
74	);
75	}
76
77	/**
78	* Validate the create order request.
79	*
80	* @param WP_REST_Request $request The request object.
81	* @return bool True if the create order request is valid, false otherwise.
82	*/
83	public function validate_create_order_request( WP_REST_Request $request ) {
84	if ( $request->get_header( 'Nonce' ) ) {
85	$nonce = $request->get_header( 'Nonce' );
86	return wp_verify_nonce( $nonce, 'wc_gateway_paypal_standard_create_order' );
87	}
88	return false;
89	}
90
91	/**
92	* Validate the cancel payment request.
93	*
94	* @param WP_REST_Request $request The request object.
95	* @return bool True if the cancel payment request is valid, false otherwise.
96	*/
97	public function validate_cancel_payment_request( WP_REST_Request $request ) {
98	if ( $request->get_header( 'Nonce' ) ) {
99	$nonce = $request->get_header( 'Nonce' );
100	return wp_verify_nonce( $nonce, 'wc_gateway_paypal_standard_cancel_payment' );
101	}
102	return false;
103	}
104
105	/**
106	* Create a PayPal order.
107	*
108	* @param WP_REST_Request $request The request object.
109	* @return WP_REST_Response The response object.
110	*/
111	public function create_order( WP_REST_Request $request ) {
112	$data = $request->get_json_params();
113
114	if ( empty( $data['order_id'] ) \|\| empty( $data['order_key'] ) ) {
115	return new WP_REST_Response( array( 'error' => 'Invalid request' ), 400 );
116	}
117
118	$payment_source = isset( $data['payment_source'] ) ? sanitize_text_field( $data['payment_source'] ) : '';
119	if ( empty( $payment_source ) \|\| ! in_array( $payment_source, PayPalConstants::SUPPORTED_PAYMENT_SOURCES, true ) ) {
120	return new WP_REST_Response( array( 'error' => 'Missing/Invalid payment source: ' . esc_html( $payment_source ) ), 400 );
121	}
122
123	$order_id = $data['order_id'];
124	$order = wc_get_order( $order_id );
125
126	if ( ! $order \|\| ! ( $order instanceof \WC_Order ) ) {
127	return new WP_REST_Response( array( 'error' => 'Order not found' ), 404 );
128	}
129
130	$order_key = $data['order_key'];
131	if ( ! $order_key \|\| ! hash_equals( $order->get_order_key(), $order_key ) ) {
132	return new WP_REST_Response( array( 'error' => 'Order not found' ), 404 );
133	}
134
135	if ( ! in_array( $order->get_status(), array( OrderStatus::CHECKOUT_DRAFT, OrderStatus::PENDING ), true ) ) {
136	return new WP_REST_Response( array( 'error' => 'Invalid order status' ), 409 );
137	}
138
139	$gateway = WC_Gateway_Paypal::get_instance();
140
141	// For Buttons requests, we need to explicitly set the payment method to PayPal.
142	$order->set_payment_method( $gateway->id );
143	$order->save();
144
145	$paypal_request = new PayPalRequest( $gateway );
146	$paypal_order = $paypal_request->create_paypal_order(
147	$order,
148	$payment_source,
149	array(
150	'is_js_sdk_flow' => true,
151	'app_switch_request_origin' => $data['app_switch_request_origin'] ?? '',
152	)
153	);
154
155	if ( ! $paypal_order \|\| empty( $paypal_order['id'] ) ) {
156	return new WP_REST_Response( array( 'error' => 'Failed to create PayPal order' ), 400 );
157	}
158
159	$order->update_meta_data( PayPalConstants::PAYPAL_ORDER_META_ORDER_ID, $paypal_order['id'] );
160	$order->update_status( OrderStatus::PENDING );
161	$order->save();
162
163	return new WP_REST_Response(
164	array(
165	'paypal_order_id' => $paypal_order['id'] ?? null,
166	'order_id' => $order_id,
167	'return_url' => esc_url_raw( add_query_arg( 'utm_nooverride', '1', $gateway->get_return_url( $order ) ) ),
168	),
169	200
170	);
171	}
172
173	/**
174	* Cancel a PayPal payment. This is used to move the woocommerce order back to a draft status.
175	*
176	* @param WP_REST_Request $request The request object.
177	* @return WP_REST_Response The response object.
178	*/
179	public function cancel_payment( WP_REST_Request $request ) {
180	$data = $request->get_json_params();
181
182	$order_id = isset( $data['order_id'] ) ? absint( $data['order_id'] ) : 0;
183	$paypal_order_id = isset( $data['paypal_order_id'] ) ? wc_clean( $data['paypal_order_id'] ) : '';
184	if ( ! $order_id \|\| '' === $paypal_order_id ) {
185	return new WP_REST_Response( array( 'error' => 'Invalid request' ), 400 );
186	}
187
188	$order = wc_get_order( $order_id );
189	if ( ! $order \|\| ! ( $order instanceof \WC_Order ) ) {
190	return new WP_REST_Response( array( 'error' => 'Order not found' ), 404 );
191	}
192
193	// Verify order by checking the PayPal order ID.
194	$paypal_order_id_from_meta = $order->get_meta( '_paypal_order_id' );
195	if ( $paypal_order_id_from_meta !== $paypal_order_id ) {
196	return new WP_REST_Response( array( 'error' => 'Invalid PayPal order' ), 404 );
197	}
198
199	// If order is already in draft status, do nothing and return success.
200	if ( $order->has_status( OrderStatus::CHECKOUT_DRAFT ) ) {
201	return new WP_REST_Response( array( 'success' => true ), 200 );
202	}
203
204	// If order is not pending, return an error.
205	if ( ! $order->has_status( OrderStatus::PENDING ) ) {
206	return new WP_REST_Response( array( 'error' => 'Order is not pending' ), 409 );
207	}
208
209	$order->update_status( OrderStatus::CHECKOUT_DRAFT );
210	$order->save();
211
212	return new WP_REST_Response( array( 'success' => true ), 200 );
213	}
214	}
215