← All changes | app/Controllers/CustomerController.php +29 -0 3.0.13 → trunk View file →

		@@ -624,10 +624,25 @@
624	624	public function createCustomer(WP_REST_Request $request): WP_REST_Response
625	625	{
626	626	$data = $request->get_json_params();
627	627
	628	+ // Creating a WordPress login account is a higher-privilege action than
	629	+ // adding a CRM record, so it needs the WP user-creation capability. A
	630	+ // staffer who can manage customers but not create users simply gets a
	631	+ // CRM-only record — the request still succeeds.
	632	+ if (!empty($data['create_account']) && !current_user_can('create_users')) {
	633	+ unset($data['create_account']);
	634	+ }
	635	+
628	636	$result = $this->customerService->createCustomer($data);
629	637
	638	+ // A confirmation request (email already has a login) is not an error — the
	639	+ // client shows a prompt and re-submits with confirm_link_existing. Return
	640	+ // 200 so it isn't treated as a failed request.
	641	+ if (!empty($result['needs_link_confirmation'])) {
	642	+ return new WP_REST_Response($result, 200);
	643	+ }
	644	+
630	645	if (!$result['success']) {
631	646	return new WP_REST_Response($result, 400);
632	647	}
633	648
		@@ -641,9 +656,23 @@
641	656	{
642	657	$id = (int) $request->get_param('id');
643	658	$data = $request->get_json_params();
644	659
	660	+ // Adding a login account from the edit form is the same higher-privilege
	661	+ // action as on create, so it needs the WP user-creation capability. A
	662	+ // staffer who can edit customers but not create users just saves the edit
	663	+ // without an account being made.
	664	+ if (is_array($data) && !empty($data['create_account']) && !current_user_can('create_users')) {
	665	+ unset($data['create_account']);
	666	+ }
	667	+
645	668	$result = $this->customerService->updateCustomer($id, $data);
	669	+
	670	+ // Confirmation request (email already has a login) — not an error; 200 so
	671	+ // the client can prompt and re-submit with confirm_link_existing.
	672	+ if (!empty($result['needs_link_confirmation'])) {
	673	+ return new WP_REST_Response($result, 200);
	674	+ }
646	675
647	676	if (!$result['success']) {
648	677	return new WP_REST_Response($result, 400);
649	678	}