Automattic\WooCommerce\Internal\RestApi\Routes\V4\Fulfillments

Controller::check_permission_for_fulfillments │ public │ WC 1.0

Permission check for REST API endpoints, given the request method. For all fulfillments methods that have an order_id, we need to be sure the user has permission to view the order. For all other methods, we check if the user is logged in as admin and has the required capability.

Method of the class: Controller{}

No Hooks.

Returns

bool|WP_Error. True if the current user has the capability, otherwise an "Unauthorized" error or False if no error is available for the request method.

Usage

$Controller = new Controller();
$Controller->check_permission_for_fulfillments( $request );

$request(WP_REST_Request) (required)

The request for which the permission is checked.

Controller::check_permission_for_fulfillments() Controller::check permission for fulfillments code ^{WC 11.1.2}

public function check_permission_for_fulfillments( WP_REST_Request $request ) {
	// Fetch the order first if there's an order_id in the request.
	$order = null;

	// If there's an order_id in the request, try to get the order.
	if ( $request->has_param( 'order_id' ) ) {
		$order_id = (int) $request->get_param( 'order_id' );
		$order    = wc_get_order( $order_id );
	}

	// If there's a fulfillment_id in the request, try to get the order from the fulfillment.
	if ( ! $order && $request->has_param( 'fulfillment_id' ) ) {
		$fulfillment_id = (int) $request->get_param( 'fulfillment_id' );
		if ( $fulfillment_id ) {
			try {
				$fulfillment = new Fulfillment( $fulfillment_id );
				$order_id    = (int) $fulfillment->get_entity_id();
				$order       = wc_get_order( $order_id );
			} catch ( ApiException $ex ) {
				return new WP_Error(
					$ex->getErrorCode(),
					$ex->getMessage(),
					array( 'status' => esc_attr( WP_Http::BAD_REQUEST ) )
				);
			} catch ( \Throwable $e ) {
				return new WP_Error(
					'woocommerce_rest_fulfillment_invalid_id',
					$e->getMessage(),
					array( 'status' => esc_attr( WP_Http::BAD_REQUEST ) )
				);
			}
		}
	}

	// If there's no order_id in the request, try to get it from the request body.
	$body_params = $request->get_json_params();
	if ( ! $order && isset( $body_params['entity_id'] ) && isset( $body_params['entity_type'] ) ) {
		if ( WC_Order::class !== $body_params['entity_type'] ) {
			return new WP_Error(
				'woocommerce_rest_invalid_entity_type',
				esc_html__( 'The entity type must be "order".', 'woocommerce' ),
				array( 'status' => esc_attr( WP_Http::BAD_REQUEST ) )
			);
		}

		$order_id = (int) $body_params['entity_id'];
		$order    = wc_get_order( $order_id );
	}

	// If there's still no order, return an error.
	if ( ! $order ) {
		return new WP_Error(
			'woocommerce_rest_order_id_required',
			esc_html__( 'The order ID is required.', 'woocommerce' ),
			array( 'status' => esc_attr( WP_Http::BAD_REQUEST ) )
		);
	}

	// Check if the user is logged in as admin, and has the required capability.
	// Admins who can manage WooCommerce can view all fulfillments.
	if ( current_user_can( 'manage_woocommerce' ) ) { // phpcs:ignore WordPress.WP.Capabilities.Unknown
		return true;
	}

	// Check if the order exists, and if the current user is the owner of the order, and the request is a read request.
	// Guest order fulfillments are rendered server-side via templates, so they don't need REST API access.
	// The get_current_user_id() > 0 check prevents unauthenticated users from accessing guest orders
	// where both get_current_user_id() and get_customer_id() would return 0.
	if ( get_current_user_id() > 0 && get_current_user_id() === $order->get_customer_id() && WP_REST_Server::READABLE === $request->get_method() ) {
		return true;
	}

	// Return an error related to the request method.
	$error_information = $this->get_authentication_error_by_method( $request->get_method() );

	if ( false === $error_information ) {
		return false;
	}

	return $error_information;
}