\WP_REST_Server::CREATABLE, 'permission_callback' => '__return_true', 'callback' => static function ( \WP_REST_Request $request ): \WP_REST_Response { return ( new WebhookHandler() )->handle( $request ); }, ] ); register_rest_route( self::NAMESPACE, '/status/(?P\d+)', [ 'methods' => \WP_REST_Server::READABLE, 'permission_callback' => [ self::class, 'can_view' ], 'args' => [ 'id' => [ 'validate_callback' => static fn( $value ): bool => is_numeric( $value ) ], 'cwkey' => [ 'sanitize_callback' => 'sanitize_text_field' ], ], 'callback' => [ self::class, 'status' ], ] ); } /** Only the browser that holds the payment's random view key may read it; anyone else gets a 404. */ public static function can_view( \WP_REST_Request $request ): bool|\WP_Error { $payment = Payment::get( (int) $request['id'] ); $key = (string) $request['cwkey']; if ( ! $payment || '' === $key || ! hash_equals( $payment->view_key(), $key ) ) { return new \WP_Error( 'cryptoway_button_unknown_payment', 'Unknown payment', [ 'status' => 404 ] ); } return true; } /** The state of one payment, for the visitor who started it (can_view() checked the view key). */ public static function status( \WP_REST_Request $request ): \WP_REST_Response { $payment = Payment::get( (int) $request['id'] ); if ( ! $payment ) { return new \WP_REST_Response( [ 'error' => 'Unknown payment' ], 404 ); } Checkout::sync_if_stale( $payment ); $response = new \WP_REST_Response( Button::state( $payment ), 200 ); $response->header( 'Cache-Control', 'no-store' ); return $response; } }