fix(orders): restore frontend pay REST and harden order-center client

Add AKSRT\Payment\OrderCenterRest so /shop/frontend/orders/{n}/pay|cancel always register on rest_api_init; widen order_number route charset; make order-center.js use credentials, encodeURIComponent, and clearer 404 errors.
2026-07-25 14:12:40 +08:00
parent 3117081a58
commit 9277674da0
4 changed files with 200 additions and 23 deletions
@@ -0,0 +1,148 @@
+<?php
+/**
+ * Public REST for order-center actions (pay / cancel / detail).
+ *
+ * Registered outside the admin SPA bootstrap so front-end order center
+ * always has routes even if an admin controller fails to load.
+ *
+ * @package AKSRT
+ */
+
+namespace AKSRT\Payment;
+
+defined('ABSPATH') || exit;
+
+class OrderCenterRest {
+
+	private static $instance = null;
+
+	public static function get_instance(): self {
+		if (null === self::$instance) {
+			self::$instance = new self();
+		}
+		return self::$instance;
+	}
+
+	public function init(): void {
+		add_action('rest_api_init', [$this, 'register_routes'], 20);
+	}
+
+	public function register_routes(): void {
+		$ns = 'aksrt/v1';
+		// Allow common order_number charset (AKS… + optional separators).
+		$on = '(?P<order_number>[A-Za-z0-9_-]+)';
+
+		register_rest_route($ns, '/shop/frontend/orders/' . $on . '/pay', [
+			'methods'             => 'POST',
+			'callback'            => [$this, 'pay'],
+			'permission_callback' => [$this, 'require_logged_in'],
+		]);
+
+		register_rest_route($ns, '/shop/frontend/orders/' . $on . '/cancel', [
+			'methods'             => 'POST',
+			'callback'            => [$this, 'cancel'],
+			'permission_callback' => [$this, 'require_logged_in'],
+		]);
+
+		register_rest_route($ns, '/shop/frontend/orders/' . $on, [
+			[
+				'methods'             => 'GET',
+				'callback'            => [$this, 'get_order'],
+				'permission_callback' => [$this, 'require_logged_in'],
+			],
+			[
+				// order-center.js historically POSTed for refresh — accept both.
+				'methods'             => 'POST',
+				'callback'            => [$this, 'get_order'],
+				'permission_callback' => [$this, 'require_logged_in'],
+			],
+		]);
+	}
+
+	/**
+	 * @return true|\WP_Error
+	 */
+	public function require_logged_in() {
+		if (!is_user_logged_in()) {
+			return new \WP_Error(
+				'aksrt_rest_forbidden',
+				__('请先登录', 'aksrt'),
+				['status' => 401]
+			);
+		}
+		return true;
+	}
+
+	public function pay(\WP_REST_Request $request): \WP_REST_Response {
+		$order_number = sanitize_text_field((string) $request->get_param('order_number'));
+		$params         = $request->get_json_params();
+		if (!is_array($params)) {
+			$params = [];
+		}
+		$payment_method = sanitize_key((string) ($params['payment_method'] ?? ''));
+
+		if (class_exists(UserOrders::class)) {
+			$result = UserOrders::get_instance()->pay_order(get_current_user_id(), $order_number, $payment_method);
+		} elseif (class_exists('\AKSRT\Shop\Shop')) {
+			$result = \AKSRT\Shop\Shop::get_instance()->pay_order(
+				get_current_user_id(),
+				$order_number,
+				$payment_method
+			);
+		} else {
+			return $this->error(__('订单服务不可用', 'aksrt'), 500);
+		}
+
+		if (empty($result['success'])) {
+			return $this->error((string) ($result['message'] ?? __('支付失败', 'aksrt')), 400);
+		}
+
+		return $this->success(['data' => $result['data'] ?? []]);
+	}
+
+	public function cancel(\WP_REST_Request $request): \WP_REST_Response {
+		$order_number = sanitize_text_field((string) $request->get_param('order_number'));
+
+		if (class_exists(UserOrders::class)) {
+			$result = UserOrders::get_instance()->cancel_order(get_current_user_id(), $order_number);
+		} elseif (class_exists('\AKSRT\Shop\Shop')) {
+			$result = \AKSRT\Shop\Shop::get_instance()->cancel_order(get_current_user_id(), $order_number);
+		} else {
+			return $this->error(__('订单服务不可用', 'aksrt'), 500);
+		}
+
+		if (empty($result['success'])) {
+			return $this->error((string) ($result['message'] ?? __('取消订单失败', 'aksrt')), 400);
+		}
+
+		return $this->success(['data' => $result['data'] ?? []]);
+	}
+
+	public function get_order(\WP_REST_Request $request): \WP_REST_Response {
+		$order_number = sanitize_text_field((string) $request->get_param('order_number'));
+		$order          = null;
+
+		if (class_exists(UserOrders::class)) {
+			$order = UserOrders::get_instance()->get_order_detail_view(get_current_user_id(), $order_number);
+		} elseif (class_exists('\AKSRT\Shop\Shop')) {
+			$order = \AKSRT\Shop\Shop::get_instance()->get_order_detail_view(get_current_user_id(), $order_number);
+		}
+
+		if (!$order) {
+			return $this->error(__('订单不存在', 'aksrt'), 404);
+		}
+
+		return $this->success(['data' => $order]);
+	}
+
+	private function success(array $data = [], int $status = 200): \WP_REST_Response {
+		return new \WP_REST_Response(array_merge(['success' => true], $data), $status);
+	}
+
+	private function error(string $message, int $status = 400): \WP_REST_Response {
+		return new \WP_REST_Response([
+			'success' => false,
+			'message' => $message,
+		], $status);
+	}
+}