| @@ -92,8 +92,36 @@ | ||
| 92 | 92 | ]); |
| 93 | 93 | } |
| 94 | 94 | |
| 95 | 95 | /** |
| 96 | + * Itinerary endpoints are bound to a trip. Reads use the view-trips | |
| 97 | + * cap (Sales Agent / Front Desk / Guide / Auditor all hold this); | |
| 98 | + * writes use the edit-trips cap. WP admins pass via the Team | |
| 99 | + * module's admin-fallback filter. Overrides BaseController's default | |
| 100 | + * which was the coarse `manage_options` check. | |
| 101 | + */ | |
| 102 | + public function check_permission(?WP_REST_Request $request = null): bool | |
| 103 | + { | |
| 104 | + if ($request === null) { | |
| 105 | + return true; | |
| 106 | + } | |
| 107 | + if (!is_user_logged_in()) { | |
| 108 | + return false; | |
| 109 | + } | |
| 110 | + switch ($request->get_method()) { | |
| 111 | + case 'GET': | |
| 112 | + return current_user_can('yatra_view_trips'); | |
| 113 | + case 'POST': | |
| 114 | + case 'PUT': | |
| 115 | + case 'PATCH': | |
| 116 | + case 'DELETE': | |
| 117 | + return current_user_can('yatra_edit_trips'); | |
| 118 | + default: | |
| 119 | + return current_user_can('yatra_view_trips'); | |
| 120 | + } | |
| 121 | + } | |
| 122 | + | |
| 123 | + /** | |
| 96 | 124 | * Get items by trip ID |
| 97 | 125 | */ |
| 98 | 126 | public function get_items_by_trip(WP_REST_Request $request) |
| 99 | 127 | { |
| @@ -264,20 +292,25 @@ | ||
| 264 | 292 | { |
| 265 | 293 | try { |
| 266 | 294 | $data = $request->get_json_params(); |
| 267 | 295 | $ids = $data['ids'] ?? []; |
| 296 | + $dayIds = $data['day_ids'] ?? []; | |
| 268 | 297 | |
| 269 | - if (empty($ids) || !is_array($ids)) { | |
| 298 | + $ids = is_array($ids) ? $ids : []; | |
| 299 | + $dayIds = is_array($dayIds) ? $dayIds : []; | |
| 300 | + | |
| 301 | + if (empty($ids) && empty($dayIds)) { | |
| 270 | 302 | return $this->error_response('No IDs provided for bulk delete', 400); |
| 271 | 303 | } |
| 272 | 304 | |
| 273 | - $result = $this->service->bulkDelete($ids); | |
| 305 | + $result = $this->service->bulkDelete($ids, $dayIds); | |
| 274 | 306 | |
| 275 | 307 | return $this->success_response([ |
| 276 | 308 | 'deleted' => $result['deleted'], |
| 277 | 309 | 'failed' => $result['failed'], |
| 278 | 310 | 'message' => sprintf( |
| 279 | - __('%d item(s) deleted successfully. %d item(s) failed to delete.', 'yatra'), | |
| 311 | + /* translators: 1: number of items deleted, 2: number of items that failed to delete. */ | |
| 312 | + __('%1$d item(s) deleted successfully. %2$d item(s) failed to delete.', 'yatra'), | |
| 280 | 313 | $result['deleted'], |
| 281 | 314 | $result['failed'] |
| 282 | 315 | ), |
| 283 | 316 | ]); |
