| @@ -373,10 +373,10 @@ | ||
| 373 | 373 | /* translators: %s: discount percentage */ |
| 374 | 374 | return sprintf(__('%s%% off', 'yatra'), $this->formatDiscountNumberForDisplay($amount)); |
| 375 | 375 | } |
| 376 | 376 | |
| 377 | - /* translators: %s: discount amount */ | |
| 378 | - return sprintf(__('%s off', 'yatra'), '$' . number_format($amount, 2)); | |
| 377 | + /* translators: %s: discount amount, already formatted with the site currency */ | |
| 378 | + return sprintf(__('%s off', 'yatra'), yatra_format_price((float) $amount, null, false)); | |
| 379 | 379 | } |
| 380 | 380 | |
| 381 | 381 | private function formatDiscountNumberForDisplay(float $amount): string |
| 382 | 382 | { |
| @@ -401,33 +401,28 @@ | ||
| 401 | 401 | |
| 402 | 402 | return ''; |
| 403 | 403 | } |
| 404 | 404 | |
| 405 | + /** | |
| 406 | + * Discount management — gated on the dedicated `yatra_manage_discounts` | |
| 407 | + * cap. Held by Owner, Manager, and Marketing roles by default. | |
| 408 | + * | |
| 409 | + * The previous implementation gated on `yatra_view_bookings` / | |
| 410 | + * `yatra_edit_bookings`, which meant the Marketing role (which has | |
| 411 | + * `yatra_manage_discounts` but NOT the booking caps) could not | |
| 412 | + * actually manage discounts despite holding the documented cap. | |
| 413 | + * Sales Agent / Front Desk (which DO have the booking caps but | |
| 414 | + * NOT `yatra_manage_discounts`) were incorrectly granted access | |
| 415 | + * to discount management. | |
| 416 | + * | |
| 417 | + * WP admins pass via the Team module's admin-fallback filter. | |
| 418 | + */ | |
| 405 | 419 | public function check_permission(?WP_REST_Request $request = null): bool |
| 406 | 420 | { |
| 407 | - if ($request === null) { | |
| 408 | - return true; | |
| 409 | - } | |
| 410 | - | |
| 411 | 421 | if (!is_user_logged_in()) { |
| 412 | 422 | return false; |
| 413 | 423 | } |
| 414 | - | |
| 415 | - if (current_user_can('manage_options')) { | |
| 416 | - return true; | |
| 417 | - } | |
| 418 | - | |
| 419 | - switch ($request->get_method()) { | |
| 420 | - case 'GET': | |
| 421 | - return current_user_can('yatra_view_bookings'); | |
| 422 | - case 'POST': | |
| 423 | - case 'PUT': | |
| 424 | - case 'PATCH': | |
| 425 | - case 'DELETE': | |
| 426 | - return current_user_can('yatra_edit_bookings'); | |
| 427 | - default: | |
| 428 | - return current_user_can('manage_options'); | |
| 429 | - } | |
| 424 | + return current_user_can('yatra_manage_discounts'); | |
| 430 | 425 | } |
| 431 | 426 | |
| 432 | 427 | /** |
| 433 | 428 | * GET /discounts/stats — counts per status for admin toolbar tabs |
