feat(pay): capability gates for transfer and withdraw

AND feature flags with user_caps balance_transfer / points_transfer /
balance_withdraw on REST and user-center buttons.

inc/classes/class-aksrt-balance-service.php

@@ -172,6 +172,9 @@ class AKSRT_Balance_Service {
 			if (empty($cfg['enabled']) || empty($cfg['transfer']['enabled'])) {
 				return new WP_Error('aksrt_transfer_closed', __('余额转账未开启', 'aksrt'), ['status' => 403]);
 			}
+			if (class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('balance_transfer', $from_id)) {
+				return new WP_Error('aksrt_transfer_forbidden', __('当前账号无权转账余额', 'aksrt'), ['status' => 403]);
+			}
 			$amount = round((float) $amount_raw, 2);
 			if ($amount <= 0) {
 				return new WP_Error('aksrt_transfer_amount', __('请输入有效金额', 'aksrt'), ['status' => 400]);
@@ -220,6 +223,9 @@ class AKSRT_Balance_Service {
 		if (!class_exists('AKSRT_Settings') || !AKSRT_Settings::credits_enabled() || !$points_transfer_on) {
 			return new WP_Error('aksrt_transfer_closed', __('积分转账未开启', 'aksrt'), ['status' => 403]);
 		}
+		if (class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('points_transfer', $from_id)) {
+			return new WP_Error('aksrt_transfer_forbidden', __('当前账号无权转账积分', 'aksrt'), ['status' => 403]);
+		}
 		$amount = (int) $amount_raw;
 		if ($amount <= 0) {
 			return new WP_Error('aksrt_transfer_amount', __('请输入有效积分', 'aksrt'), ['status' => 400]);
@@ -724,6 +730,9 @@ class AKSRT_Balance_Service {
 			$params = $request->get_params();
 		}
 		$user_id = get_current_user_id();
+		if (class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('balance_withdraw', $user_id)) {
+			return new WP_Error('aksrt_withdraw_forbidden', __('当前账号无权提现', 'aksrt'), ['status' => 403]);
+		}
 		$amount  = round((float) ($params['amount'] ?? 0), 2);
 		$method  = sanitize_key((string) ($params['method'] ?? 'alipay'));
 		$account = sanitize_textarea_field((string) ($params['account_info'] ?? $params['account'] ?? ''));

inc/classes/settings/class-aksrt-settings-capabilities.php

@@ -19,6 +19,7 @@ class AKSRT_Settings_Capabilities {
             'user_report'               => ['label' => __('举报其它用户', 'aksrt'),              'default' => ['logged' => true]],
             'balance_transfer'          => ['label' => __('余额转账给其他用户', 'aksrt'),         'exclude_roles' => ['all']],
             'points_transfer'           => ['label' => __('积分转账给其他用户', 'aksrt'),         'exclude_roles' => ['all']],
+            'balance_withdraw'          => ['label' => __('余额提现', 'aksrt'),                   'exclude_roles' => ['all']],
             'set_user_ban'              => ['label' => __('设置用户封禁状态', 'aksrt'),           'roles' => ['cat_moderator'], 'default' => ['cat_moderator' => true]],
             'medal_manually_set'        => ['label' => __('为用户授予徽章', 'aksrt'),             'roles' => ['cat_moderator'], 'default' => ['cat_moderator' => true]],
 

inc/helpers/user-center-renderers/credits-balance.php

@@ -19,7 +19,11 @@ if (class_exists('AKSRT_Charge_Card')) {
 	$card_pass_credits = is_array($opts['credits'] ?? null) ? $opts['credits'] : $card_pass_credits;
 }
 $all_settings = class_exists('AKSRT_Settings') ? AKSRT_Settings::get_all() : [];
+$points_uid = (int) ($user_id ?? get_current_user_id());
 $points_transfer_on = !empty($all_settings['points_transfer_s']);
+if ($points_transfer_on && class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('points_transfer', $points_uid)) {
+	$points_transfer_on = false;
+}
 $points_buy_on = class_exists('AKSRT_Balance_Service') && AKSRT_Balance_Service::get_instance()->points_buy_enabled();
 $points_buy_view = $points_buy_on ? AKSRT_Balance_Service::get_instance()->get_points_buy_view((int) ($user_id ?? 0)) : [];
 $currency = (string) ($currency_name ?? __('积分', 'aksrt'));

inc/helpers/user-center-renderers/credits-wallet.php

@@ -21,10 +21,17 @@ $wallet_fmt = class_exists('AKSRT_Balance')
 $recharge = class_exists('AKSRT_Settings') && method_exists('AKSRT_Settings', 'get_payment_recharge_settings')
 	? AKSRT_Settings::get_payment_recharge_settings()
 	: [];
+$uid = (int) ($user_id ?? get_current_user_id());
 $transfer_on = !empty($recharge['transfer']['enabled']);
+if ($transfer_on && class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('balance_transfer', $uid)) {
+	$transfer_on = false;
+}
 $exchange_on = !empty($recharge['exchange']['enabled']);
 $all_settings = class_exists('AKSRT_Settings') ? AKSRT_Settings::get_all() : [];
 $withdraw_on = !empty($all_settings['pay_balance_withdraw_s']);
+if ($withdraw_on && class_exists('AKSRT_Settings_Capabilities') && !AKSRT_Settings_Capabilities::user_can('balance_withdraw', $uid)) {
+	$withdraw_on = false;
+}
 $withdraw_min = max(1, (float) ($all_settings['pay_balance_withdraw_lowest_money'] ?? $all_settings['pay_rebate_withdraw_lowest_money'] ?? 50));
 $withdraw_pending_hold = 0.0;
 $withdraw_history = [];