From fff721dd185f5b97f7ae7a6e64189e55887ff590 Mon Sep 17 00:00:00 2001
From: Jake Vanderwerf <get@jakevanderwerf.ca>
Date: Sun, 05 Jul 2026 18:36:57 +0000
Subject: [PATCH] =Cleaning up the Square integration (still a bit more to do yet). Also majorly overhauled /rest/ files to ignore a rest request 'user' paramater, and rely on get_current_user_id() instead.
---
inc/rest/routes/ReferralRoutes.php | 35 ++++++++++++++++-------------------
1 files changed, 16 insertions(+), 19 deletions(-)
diff --git a/inc/rest/routes/ReferralRoutes.php b/inc/rest/routes/ReferralRoutes.php
index a1e3f3e..e977513 100644
--- a/inc/rest/routes/ReferralRoutes.php
+++ b/inc/rest/routes/ReferralRoutes.php
@@ -35,7 +35,6 @@
Route::for('referrals')
->get([$this, 'getReferrals'])
->args([
- 'user' => 'integer',
'status' => 'string|enum:all,pending,consulted,treated,unused,registered,completed|default:all',
'date_start' => 'string',
'date_end' => 'string',
@@ -55,7 +54,6 @@
// Referral code endpoint
Route::for('referrals/code')
->get([$this, 'getCode'])
- ->args(['user' => 'integer'])
->auth('user')
->rateLimit(30)
->post([$this, 'validateCode'])
@@ -67,7 +65,6 @@
// Stats endpoint
Route::for('referrals/stats')
->get([$this, 'getStats'])
- ->args(['user' => 'integer'])
->auth('user')
->rateLimit(30)
->register();
@@ -102,15 +99,14 @@
*/
public function getReferrals(WP_REST_Request $request): WP_REST_Response
{
- $user_id = $request->get_param('user');
+ $user_id = get_current_user_id();
- // Determine scope: admin without user param gets all referrals
if (!$user_id) {
- $current_user_id = get_current_user_id();
- if (current_user_can('manage_options')) {
- return $this->getAllReferrals($request);
- }
- $user_id = $current_user_id;
+ return $this->unauthorized();
+ }
+
+ if (current_user_can('manage_options')) {
+ return $this->getAllReferrals($request);
}
// Build cache key
@@ -164,13 +160,12 @@
*/
protected function actionInvite(WP_REST_Request $request): WP_REST_Response
{
- $user = absint($request->get_param('user'));
- if (!$user || !get_userdata($user)) {
- return $this->error('Invalid user', 'invalid_user', 400);
+ $user = get_current_user_id();
+ if (!$user) {
+ return $this->unauthorized();
}
//Additional check to not send too many emails in an hour
- $user = absint($request->get_param('user'));
$transient_key = "referral_invite_limit_{$user}";
$recent_invites = get_transient($transient_key) ?: 0;
@@ -298,11 +293,10 @@
*/
public function getCode(WP_REST_Request $request): WP_REST_Response
{
- $user_id = $request->get_param('user') ?? get_current_user_id();
+ $user_id = get_current_user_id();
- // Check permission
- if ($user_id != get_current_user_id() && !current_user_can('manage_options')) {
- return $this->forbidden('Unauthorized');
+ if (!$user_id) {
+ return $this->unauthorized();
}
$code = JVB()->referrals()->getUserReferralCode($user_id);
@@ -353,7 +347,10 @@
*/
public function getStats(WP_REST_Request $request): WP_REST_Response
{
- $user_id = $request->get_param('user') ?? get_current_user_id();
+ $user_id = get_current_user_id();
+ if (!$user_id) {
+ return $this->unauthorized();
+ }
$cache_key = "stats_{$user_id}";
// Check 304 Not Modified
--
Gitblit v1.10.0