← All changes | app/Controllers/CustomerController.php +117 -0 3.0.7 → trunk View file →

		@@ -70,8 +70,39 @@
70	70	'permission_callback' => [$this, 'checkCustomerPermission'],
71	71	],
72	72	]);
73	73
	74	+ // Request an account email change (WordPress pending-change pattern:
	75	+ // a confirmation link is emailed to the new address; nothing changes yet).
	76	+ // The confirmation link itself is a normal front-end URL handled by
	77	+ // AccountPageHandler — NOT a REST route — because a browser GET to REST
	78	+ // carries no nonce and would be treated as anonymous.
	79	+ register_rest_route($namespace, '/' . $base . '/me/email', [
	80	+ [
	81	+ 'methods' => \WP_REST_Server::CREATABLE,
	82	+ 'callback' => [$this, 'updateMyEmail'],
	83	+ 'permission_callback' => [$this, 'checkCustomerPermission'],
	84	+ ],
	85	+ ]);
	86	+
	87	+ // Re-send the confirmation email for an already-pending email change.
	88	+ register_rest_route($namespace, '/' . $base . '/me/email/resend', [
	89	+ [
	90	+ 'methods' => \WP_REST_Server::CREATABLE,
	91	+ 'callback' => [$this, 'resendMyEmailConfirmation'],
	92	+ 'permission_callback' => [$this, 'checkCustomerPermission'],
	93	+ ],
	94	+ ]);
	95	+
	96	+ // Cancel (dismiss) a pending email change — deletes the stored token.
	97	+ register_rest_route($namespace, '/' . $base . '/me/email', [
	98	+ [
	99	+ 'methods' => \WP_REST_Server::DELETABLE,
	100	+ 'callback' => [$this, 'cancelMyEmailChange'],
	101	+ 'permission_callback' => [$this, 'checkCustomerPermission'],
	102	+ ],
	103	+ ]);
	104	+
74	105	// Current customer's bookings
75	106	register_rest_route($namespace, '/' . $base . '/my-bookings', [
76	107	[
77	108	'methods' => \WP_REST_Server::READABLE,
		@@ -369,8 +400,65 @@
369	400	return $this->success_response(['updated' => true]);
370	401	}
371	402
372	403	/**
	404	+ * POST /customers/me/email - Request a change to the account login email.
	405	+ *
	406	+ * Follows WordPress core's pending-change pattern: the email is NOT changed
	407	+ * here. A confirmation link is emailed to the NEW address; the change only
	408	+ * applies once the customer clicks it (confirmed by AccountPageHandler).
	409	+ */
	410	+ public function updateMyEmail(WP_REST_Request $request)
	411	+ {
	412	+ $userId = get_current_user_id();
	413	+ if ($userId <= 0) {
	414	+ return $this->error_response(__('Authentication required.', 'yatra'), 401);
	415	+ }
	416	+
	417	+ $data = $request->get_json_params();
	418	+ $newEmail = '';
	419	+ if (is_array($data)) {
	420	+ $newEmail = (string) ($data['email'] ?? $data['new_email'] ?? '');
	421	+ }
	422	+
	423	+ $result = $this->customerService->requestEmailChange($userId, $newEmail);
	424	+
	425	+ return new WP_REST_Response($result, empty($result['success']) ? 400 : 200);
	426	+ }
	427	+
	428	+ /**
	429	+ * POST /customers/me/email/resend - Re-send the confirmation link for a
	430	+ * pending email change (reuses the existing token; nothing else changes).
	431	+ */
	432	+ public function resendMyEmailConfirmation(WP_REST_Request $request)
	433	+ {
	434	+ $userId = get_current_user_id();
	435	+ if ($userId <= 0) {
	436	+ return $this->error_response(__('Authentication required.', 'yatra'), 401);
	437	+ }
	438	+
	439	+ $result = $this->customerService->resendEmailChangeConfirmation($userId);
	440	+
	441	+ return new WP_REST_Response($result, empty($result['success']) ? 400 : 200);
	442	+ }
	443	+
	444	+ /**
	445	+ * DELETE /customers/me/email - Cancel (dismiss) a pending email change,
	446	+ * discarding the stored token so the emailed link stops working.
	447	+ */
	448	+ public function cancelMyEmailChange(WP_REST_Request $request)
	449	+ {
	450	+ $userId = get_current_user_id();
	451	+ if ($userId <= 0) {
	452	+ return $this->error_response(__('Authentication required.', 'yatra'), 401);
	453	+ }
	454	+
	455	+ $result = $this->customerService->cancelEmailChange($userId);
	456	+
	457	+ return new WP_REST_Response($result, empty($result['success']) ? 400 : 200);
	458	+ }
	459	+
	460	+ /**
373	461	* GET /customers/my-bookings - Get current customer's bookings
374	462	*/
375	463	public function getMyBookings(WP_REST_Request $request): WP_REST_Response
376	464	{
		@@ -536,10 +624,25 @@
536	624	public function createCustomer(WP_REST_Request $request): WP_REST_Response
537	625	{
538	626	$data = $request->get_json_params();
539	627
	628	+ // Creating a WordPress login account is a higher-privilege action than
	629	+ // adding a CRM record, so it needs the WP user-creation capability. A
	630	+ // staffer who can manage customers but not create users simply gets a
	631	+ // CRM-only record — the request still succeeds.
	632	+ if (!empty($data['create_account']) && !current_user_can('create_users')) {
	633	+ unset($data['create_account']);
	634	+ }
	635	+
540	636	$result = $this->customerService->createCustomer($data);
541	637
	638	+ // A confirmation request (email already has a login) is not an error — the
	639	+ // client shows a prompt and re-submits with confirm_link_existing. Return
	640	+ // 200 so it isn't treated as a failed request.
	641	+ if (!empty($result['needs_link_confirmation'])) {
	642	+ return new WP_REST_Response($result, 200);
	643	+ }
	644	+
542	645	if (!$result['success']) {
543	646	return new WP_REST_Response($result, 400);
544	647	}
545	648
		@@ -553,9 +656,23 @@
553	656	{
554	657	$id = (int) $request->get_param('id');
555	658	$data = $request->get_json_params();
556	659
	660	+ // Adding a login account from the edit form is the same higher-privilege
	661	+ // action as on create, so it needs the WP user-creation capability. A
	662	+ // staffer who can edit customers but not create users just saves the edit
	663	+ // without an account being made.
	664	+ if (is_array($data) && !empty($data['create_account']) && !current_user_can('create_users')) {
	665	+ unset($data['create_account']);
	666	+ }
	667	+
557	668	$result = $this->customerService->updateCustomer($id, $data);
	669	+
	670	+ // Confirmation request (email already has a login) — not an error; 200 so
	671	+ // the client can prompt and re-submit with confirm_link_existing.
	672	+ if (!empty($result['needs_link_confirmation'])) {
	673	+ return new WP_REST_Response($result, 200);
	674	+ }
558	675
559	676	if (!$result['success']) {
560	677	return new WP_REST_Response($result, 400);
561	678	}