Skip to content
This repository has been archived by the owner on Feb 23, 2024. It is now read-only.

Add reviews endpoint #705

Merged
merged 2 commits into from
Jul 11, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/js/blocks/reviews-by-product/block.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ class ReviewsByProduct extends Component {
}

apiFetch( {
path: addQueryArgs( `/wc/v3/products/reviews`, {
path: addQueryArgs( `/wc/blocks/products/reviews`, {
order_by: orderby,
per_page: perPage,
product: productId,
Expand Down
1 change: 1 addition & 0 deletions src/RestApi.php
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ protected static function get_controllers() {
'product-categories' => __NAMESPACE__ . '\RestApi\Controllers\ProductCategories',
'products' => __NAMESPACE__ . '\RestApi\Controllers\Products',
'variations' => __NAMESPACE__ . '\RestApi\Controllers\Variations',
'product-reviews' => __NAMESPACE__ . '\RestApi\Controllers\ProductReviews',
];
}
}
82 changes: 82 additions & 0 deletions src/RestApi/ProductReviews.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
<?php
/**
* REST API Reviews controller customized for Blocks.
*
* Handles requests to the /products/reviews endpoint. These endpoints allow read-only access to editors.
*
* @internal This API is used internally by the block post editor--it is still in flux. It should not be used outside of wc-blocks.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This API is used internally by the block post editor

Should we update that to clarify it's also used in the frontend?

* @package WooCommerce/Blocks
*/

namespace Automattic\WooCommerce\Blocks\RestApi\Controllers;

defined( 'ABSPATH' ) || exit;

use \WC_REST_Product_Reviews_Controller;

/**
* REST API Product Reviews controller class.
*/
class ProductReviews extends WC_REST_Product_Reviews_Controller {

/**
* Endpoint namespace.
*
* @var string
*/
protected $namespace = 'wc/blocks';

/**
* Register the routes for product reviews.
*/
public function register_routes() {
register_rest_route(
$this->namespace,
'/' . $this->rest_base,
array(
array(
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'get_items' ),
'permission_callback' => array( $this, 'get_items_permissions_check' ),
'args' => $this->get_collection_params(),
),
'schema' => array( $this, 'get_public_item_schema' ),
)
);

register_rest_route(
$this->namespace,
'/' . $this->rest_base . '/(?P<id>[\d]+)',
array(
'args' => array(
'id' => array(
'description' => __( 'Unique identifier for the resource.', 'woo-gutenberg-products-block' ),
'type' => 'integer',
),
),
array(
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'get_item' ),
'permission_callback' => array( $this, 'get_items_permissions_check' ),
'args' => array(
'context' => $this->get_context_param( array( 'default' => 'view' ) ),
),
),
'schema' => array( $this, 'get_public_item_schema' ),
)
);
}

/**
* Check if a given request has access to read the attributes.
*
* @param \WP_REST_Request $request Full details about the request.
* @return \WP_Error|boolean
*/
public function get_items_permissions_check( $request ) {
if ( ! current_user_can( 'edit_posts' ) ) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-logged-in users should have permissions to fetch reviews too, isn't it?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to look at that in a separate PR after checking with Claudio about security concerns.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good. Approving this PR, then.

return new \WP_Error( 'woocommerce_rest_cannot_view', __( 'Sorry, you cannot list resources.', 'woo-gutenberg-products-block' ), array( 'status' => rest_authorization_required_code() ) );
}
return true;
}
}