wordpress-theme-aksrt/src/AKSRT/Payment/OrderCenterRest.php

<?php
/**
 * Public REST for order-center actions (pay / cancel / detail).
 *
 * Registered outside the admin SPA bootstrap so front-end order center
 * always has routes even if an admin controller fails to load.
 *
 * @package AKSRT
 */

namespace AKSRT\Payment;

defined('ABSPATH') || exit;

class OrderCenterRest {

	private static $instance = null;

	public static function get_instance(): self {
		if (null === self::$instance) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	public function init(): void {
		add_action('rest_api_init', [$this, 'register_routes'], 20);
	}

	public function register_routes(): void {
		$ns = 'aksrt/v1';
		// Allow common order_number charset (AKS… + optional separators).
		$on = '(?P<order_number>[A-Za-z0-9_-]+)';

		register_rest_route($ns, '/shop/frontend/orders/' . $on . '/pay', [
			'methods'             => 'POST',
			'callback'            => [$this, 'pay'],
			'permission_callback' => [$this, 'require_logged_in'],
		]);

		register_rest_route($ns, '/shop/frontend/orders/' . $on . '/cancel', [
			'methods'             => 'POST',
			'callback'            => [$this, 'cancel'],
			'permission_callback' => [$this, 'require_logged_in'],
		]);

		register_rest_route($ns, '/shop/frontend/orders/' . $on, [
			[
				'methods'             => 'GET',
				'callback'            => [$this, 'get_order'],
				'permission_callback' => [$this, 'require_logged_in'],
			],
			[
				// order-center.js historically POSTed for refresh — accept both.
				'methods'             => 'POST',
				'callback'            => [$this, 'get_order'],
				'permission_callback' => [$this, 'require_logged_in'],
			],
		]);
	}

	/**
	 * @return true|\WP_Error
	 */
	public function require_logged_in() {
		if (!is_user_logged_in()) {
			return new \WP_Error(
				'aksrt_rest_forbidden',
				__('请先登录', 'aksrt'),
				['status' => 401]
			);
		}
		return true;
	}

	public function pay(\WP_REST_Request $request): \WP_REST_Response {
		$order_number = sanitize_text_field((string) $request->get_param('order_number'));
		$params         = $request->get_json_params();
		if (!is_array($params)) {
			$params = [];
		}
		$payment_method = sanitize_key((string) ($params['payment_method'] ?? ''));

		if (class_exists(UserOrders::class)) {
			$result = UserOrders::get_instance()->pay_order(get_current_user_id(), $order_number, $payment_method);
		} elseif (class_exists('\AKSRT\Shop\Shop')) {
			$result = \AKSRT\Shop\Shop::get_instance()->pay_order(
				get_current_user_id(),
				$order_number,
				$payment_method
			);
		} else {
			return $this->error(__('订单服务不可用', 'aksrt'), 500);
		}

		if (empty($result['success'])) {
			return $this->error((string) ($result['message'] ?? __('支付失败', 'aksrt')), 400);
		}

		return $this->success(['data' => $result['data'] ?? []]);
	}

	public function cancel(\WP_REST_Request $request): \WP_REST_Response {
		$order_number = sanitize_text_field((string) $request->get_param('order_number'));

		if (class_exists(UserOrders::class)) {
			$result = UserOrders::get_instance()->cancel_order(get_current_user_id(), $order_number);
		} elseif (class_exists('\AKSRT\Shop\Shop')) {
			$result = \AKSRT\Shop\Shop::get_instance()->cancel_order(get_current_user_id(), $order_number);
		} else {
			return $this->error(__('订单服务不可用', 'aksrt'), 500);
		}

		if (empty($result['success'])) {
			return $this->error((string) ($result['message'] ?? __('取消订单失败', 'aksrt')), 400);
		}

		return $this->success(['data' => $result['data'] ?? []]);
	}

	public function get_order(\WP_REST_Request $request): \WP_REST_Response {
		$order_number = sanitize_text_field((string) $request->get_param('order_number'));
		$order          = null;

		if (class_exists(UserOrders::class)) {
			$order = UserOrders::get_instance()->get_order_detail_view(get_current_user_id(), $order_number);
		} elseif (class_exists('\AKSRT\Shop\Shop')) {
			$order = \AKSRT\Shop\Shop::get_instance()->get_order_detail_view(get_current_user_id(), $order_number);
		}

		if (!$order) {
			return $this->error(__('订单不存在', 'aksrt'), 404);
		}

		return $this->success(['data' => $order]);
	}

	private function success(array $data = [], int $status = 200): \WP_REST_Response {
		return new \WP_REST_Response(array_merge(['success' => true], $data), $status);
	}

	private function error(string $message, int $status = 400): \WP_REST_Response {
		return new \WP_REST_Response([
			'success' => false,
			'message' => $message,
		], $status);
	}
}