<?php

[0] Fix | Delete

namespace Automattic\WooCommerce\StoreApi\Utilities;

[1] Fix | Delete

[2] Fix | Delete

use Automattic\WooCommerce\StoreApi\Exceptions\RouteException;

[3] Fix | Delete

[4] Fix | Delete

/**

[5] Fix | Delete

* OrderAuthorizationTrait

[6] Fix | Delete

*

[7] Fix | Delete

* Shared functionality for getting order authorization.

[8] Fix | Delete

*/

[9] Fix | Delete

trait OrderAuthorizationTrait {

[10] Fix | Delete

/**

[11] Fix | Delete

* Check if authorized to get the order.

[12] Fix | Delete

*

[13] Fix | Delete

* @throws RouteException If the order is not found or the order key is invalid.

[14] Fix | Delete

*

[15] Fix | Delete

* @param \WP_REST_Request $request Request object.

[16] Fix | Delete

* @return boolean|\WP_Error

[17] Fix | Delete

*/

[18] Fix | Delete

public function is_authorized( \WP_REST_Request $request ) {

[19] Fix | Delete

$order_id = absint( $request['id'] );

[20] Fix | Delete

$order_key = sanitize_text_field( wp_unslash( $request->get_param( 'key' ) ) );

[21] Fix | Delete

$billing_email = sanitize_text_field( wp_unslash( $request->get_param( 'billing_email' ) ) );

[22] Fix | Delete

[23] Fix | Delete

try {

[24] Fix | Delete

$order = wc_get_order( $order_id );

[25] Fix | Delete

[26] Fix | Delete

if ( ! $order ) {

[27] Fix | Delete

throw new RouteException( 'woocommerce_rest_invalid_order', esc_html__( 'Invalid order ID.', 'woocommerce' ), 404 );

[28] Fix | Delete

}

[29] Fix | Delete

[30] Fix | Delete

$order_customer_id = $order->get_customer_id();

[31] Fix | Delete

[32] Fix | Delete

// If the order belongs to a registered customer, check if the current user is the owner.

[33] Fix | Delete

if ( $order_customer_id ) {

[34] Fix | Delete

// If current user is the order owner, allow access, otherwise reject with an error.

[35] Fix | Delete

if ( get_current_user_id() === $order_customer_id ) {

[36] Fix | Delete

return true;

[37] Fix | Delete

} else {

[38] Fix | Delete

throw new RouteException( 'woocommerce_rest_invalid_user', esc_html__( 'This order belongs to a different customer.', 'woocommerce' ), 403 );

[39] Fix | Delete

}

[40] Fix | Delete

}

[41] Fix | Delete

[42] Fix | Delete

// Guest order: require order key and billing email validation for all visitors (logged-in or not).

[43] Fix | Delete

$this->order_controller->validate_order_key( $order_id, $order_key );

[44] Fix | Delete

$this->validate_billing_email_matches_order( $order_id, $billing_email );

[45] Fix | Delete

} catch ( RouteException $error ) {

[46] Fix | Delete

return new \WP_Error(

[47] Fix | Delete

$error->getErrorCode(),

[48] Fix | Delete

$error->getMessage(),

[49] Fix | Delete

array( 'status' => $error->getCode() )

[50] Fix | Delete

);

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

return true;

[54] Fix | Delete

}

[55] Fix | Delete

[56] Fix | Delete

/**

[57] Fix | Delete

* Validate a given billing email against an existing order.

[58] Fix | Delete

*

[59] Fix | Delete

* @throws RouteException Exception if invalid data is detected.

[60] Fix | Delete

* @param integer $order_id Order ID.

[61] Fix | Delete

* @param string $billing_email Billing email.

[62] Fix | Delete

*/

[63] Fix | Delete

public function validate_billing_email_matches_order( $order_id, $billing_email ) {

[64] Fix | Delete

$order = wc_get_order( $order_id );

[65] Fix | Delete

[66] Fix | Delete

if ( ! $order ) {

[67] Fix | Delete

throw new RouteException( 'woocommerce_rest_invalid_order', esc_html__( 'Invalid order ID.', 'woocommerce' ), 404 );

[68] Fix | Delete

}

[69] Fix | Delete

[70] Fix | Delete

$order_billing_email = $order->get_billing_email();

[71] Fix | Delete

[72] Fix | Delete

// If the order doesn't have an email, then allowing an empty billing_email param is acceptable. It will still be compared to order email below.

[73] Fix | Delete

if ( ! $billing_email && ! empty( $order_billing_email ) ) {

[74] Fix | Delete

throw new RouteException( 'woocommerce_rest_invalid_billing_email', esc_html__( 'No billing email provided.', 'woocommerce' ), 401 );

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete

// For Store API authorization, the provided billing email must exactly match the order's billing email. We use

[78] Fix | Delete

// direct comparison rather than Users::should_user_verify_order_email() because that function has a grace

[79] Fix | Delete

// period for newly created orders which is inappropriate for use when querying orders on the API.

[80] Fix | Delete

if ( 0 !== strcasecmp( $order_billing_email, $billing_email ) ) {

[81] Fix | Delete

throw new RouteException( 'woocommerce_rest_invalid_billing_email', esc_html__( 'Invalid billing email provided.', 'woocommerce' ), 401 );

[82] Fix | Delete

}

[83] Fix | Delete

}

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete