HSLG Media

AccountOrderController.php

AccountOrderController.php

Source file: wordpress/hslg-app-api/src/controllers/AccountOrderController.php

Module: wordpress-hslg-app-api

Size: 205 lines

SHA-256: d51f0d8ed54b586f0de7adabb65adb8bd7e33f3e88302c08281cf3f833213e5f

Responsibility

Hosts independently deployable HSLG-owned API endpoints and schema operations on WordPress/MariaDB.

Declared entry points

  • AccountOrderController — source line 13.
  • __construct — source line 15.
  • register_routes — source line 20.
  • transportPermission — source line 50.
  • input — source line 54.
  • str — source line 60.
  • token — source line 66.
  • permission — source line 75.
  • customer — source line 83.
  • ip — source line 89.
  • response — source line 90.
  • bad — source line 94.
  • registerAccount — source line 101.
  • verify — source line 112.
  • resend — source line 119.
  • login — source line 126.
  • recovery — source line 134.
  • reset — source line 141.
  • me — source line 149.
  • profile — source line 156.
  • logout — source line 165.
  • draft — source line 170.
  • lookupByKey — source line 180.
  • quote — source line 187.

Imports and dependencies

  • Line 4: use Hslg\WordPressApi\Database\WordPressCustomerAuthRepository;
  • Line 5: use Hslg\WordPressApi\Database\WordPressCustomerRecordRepository;
  • Line 6: use Hslg\WordPressApi\Database\WordPressOrderDraftRepository;
  • Line 7: use Hslg\WordPressApi\Database\WordPressMenuPriceRepository;

Behaviour and audit locations

  • Line 24: register_rest_route($this->namespace,'/account/'.$path,[
  • Line 25: 'methods'=>'POST','callback'=>[$this,$handler], 'permission_callback'=>[$this,'transportPermission'],
  • Line 29: register_rest_route($this->namespace,'/account/'.$path,[
  • Line 30: 'methods'=>$verb,'callback'=>[$this,$handler], 'permission_callback'=>[$this,'permission'],
  • Line 33: register_rest_route($this->namespace,'/orders/drafts',[
  • Line 34: 'methods'=>'POST','callback'=>[$this,'draft'], 'permission_callback'=>[$this,'permission'],
  • Line 36: register_rest_route($this->namespace,'/orders/drafts/by-key/(?P<idempotency_key>[a-z0-9-]+)',[
  • Line 37: 'methods'=>'GET','callback'=>[$this,'lookupByKey'], 'permission_callback'=>[$this,'permission'],

Endpoint contract in context

This controller registers account and order-draft REST routes under hslg/v1. Anonymous account operations still require HTTPS. Protected operations validate a Bearer token and derive the customer ID server-side. Registration/recovery responses deliberately avoid account enumeration. Profile update accepts one allowed field per call. Order drafts are explicitly unpriced and cannot be represented as kitchen submissions. The controller maps conflicts, invalid bodies, rate limits and service failures to safe WordPress errors. Email challenge implementation remains due for extraction into one dedicated wp_mail() verification module.

Relationship to the system

This page is the file-level source reference, not the architecture rationale. Read the module explanation, the corresponding architecture decision and user guide before changing behaviour. Names and line locations above are extracted from this exact source version; they are reference points, not proof that an external service or a phone feature works.

Change verification

Review the entry points and errors in this file, then run the module’s associated tests, source dependency gate, history gate and documentation coverage check. If the file changes an API response, user interaction, data model, deployment or third-party dependency, revise those human explanations and disaster recovery/licensing when relevant. Do not infer actual native or external API operation from source presence.