class CartApiAccessCheck in Commerce Cart API 8

Access check for the cart rest plugins.

Uses the cart provider to check if a cart belongs to the current session, and also verifies order items belong to a valid cart.

Hierarchy

• class \Drupal\commerce_cart_api\Access\CartApiAccessCheck implements AccessInterface

1 string reference to 'CartApiAccessCheck'

commerce_cart_api.services.yml in ./commerce_cart_api.services.yml

commerce_cart_api.services.yml

1 service uses CartApiAccessCheck

access_check.cart_api in ./commerce_cart_api.services.yml

Drupal\commerce_cart_api\Access\CartApiAccessCheck

File

src/Access/CartApiAccessCheck.php, line 20

Namespace

Drupal\commerce_cart_api\Access

class CartApiAccessCheck implements AccessInterface {

  /**
   * The cart provider.
   *
   * @var \Drupal\commerce_cart\CartProviderInterface
   */
  protected $cartProvider;

  /**
   * Constructs a new CartApiAccessCheck object.
   *
   * @param \Drupal\commerce_cart\CartProviderInterface $cart_provider
   *   The cart provider.
   */
  public function __construct(CartProviderInterface $cart_provider) {
    $this->cartProvider = $cart_provider;
  }

  /**
   * Checks access.
   *
   * @param \Symfony\Component\Routing\Route $route
   *   The route to check against.
   * @param \Drupal\Core\Routing\RouteMatchInterface $route_match
   *   The route match.
   * @param \Drupal\Core\Session\AccountInterface $account
   *   The currently logged in account.
   *
   * @return \Drupal\Core\Access\AccessResultInterface
   *   The access result.
   */
  public function access(Route $route, RouteMatchInterface $route_match, AccountInterface $account) {

    // If the route has no parameters (cart collection), allow.
    $parameters = $route
      ->getOption('parameters');
    if (empty($parameters['commerce_order'])) {
      return AccessResult::allowed();
    }

    // If there is no cart, no access.
    $order = $route_match
      ->getParameter('commerce_order');
    if (!$order || !$order instanceof OrderInterface) {
      return AccessResult::forbidden();
    }

    // Carts must be a draft and flagged as a cart.
    if ($order
      ->getState()->value != 'draft' || empty($order->cart->value)) {
      return AccessResult::forbidden()
        ->addCacheableDependency($order);
    }

    // Ensure cart belongs to the current user.
    $carts = $this->cartProvider
      ->getCartIds($account);
    if (!in_array($order
      ->id(), $carts)) {
      return AccessResult::forbidden()
        ->addCacheableDependency($order);
    }

    // If there is also an order item in the route, make sure it belongs
    // to this cart as well.
    $order_item = $route_match
      ->getParameter('commerce_order_item');
    if ($order_item && $order_item instanceof OrderItemInterface) {
      if (!$order
        ->hasItem($order_item)) {
        return AccessResult::forbidden()
          ->addCacheableDependency($order_item)
          ->addCacheableDependency($order);
      }
    }
    return AccessResult::allowed()
      ->addCacheableDependency($order);
  }

}

Members

Name	Modifiers	Type	Description	Overrides
CartApiAccessCheck::$cartProvider	protected	property	The cart provider.
CartApiAccessCheck::access	public	function	Checks access.
CartApiAccessCheck::__construct	public	function	Constructs a new CartApiAccessCheck object.