* REST API Admin Notes controller
* Handles requests to the admin notes endpoint.
namespace Automattic\WooCommerce\Admin\API;
defined( 'ABSPATH' ) || exit;
use Automattic\WooCommerce\Admin\Notes\Note;
use Automattic\WooCommerce\Admin\Notes\Notes as NotesRepository;
* REST API Admin Notes controller class.
* @extends WC_REST_CRUD_Controller
class Notes extends \WC_REST_CRUD_Controller {
protected $namespace = 'wc-analytics';
protected $rest_base = 'admin/notes';
* Register the routes for admin notes.
public function register_routes() {
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'get_items' ),
'permission_callback' => array( $this, 'get_items_permissions_check' ),
'args' => $this->get_collection_params(),
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/(?P<id>[\d-]+)',
'description' => __( 'Unique ID for the resource.', 'woocommerce' ),
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'get_item' ),
'permission_callback' => array( $this, 'get_item_permissions_check' ),
'methods' => \WP_REST_Server::EDITABLE,
'callback' => array( $this, 'update_item' ),
'permission_callback' => array( $this, 'update_items_permissions_check' ),
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/delete/(?P<id>[\d-]+)',
'methods' => \WP_REST_Server::DELETABLE,
'callback' => array( $this, 'delete_item' ),
'permission_callback' => array( $this, 'update_items_permissions_check' ),
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/delete/all',
'methods' => \WP_REST_Server::DELETABLE,
'callback' => array( $this, 'delete_all_items' ),
'permission_callback' => array( $this, 'update_items_permissions_check' ),
'description' => __( 'Status of note.', 'woocommerce' ),
'sanitize_callback' => 'wp_parse_slug_list',
'validate_callback' => 'rest_validate_request_arg',
'enum' => Note::get_allowed_statuses(),
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/tracker/(?P<note_id>[\d-]+)/user/(?P<user_id>[\d-]+)',
'methods' => \WP_REST_Server::READABLE,
'callback' => array( $this, 'track_opened_email' ),
'permission_callback' => '__return_true',
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/update',
'methods' => \WP_REST_Server::EDITABLE,
'callback' => array( $this, 'batch_update_items' ),
'permission_callback' => array( $this, 'update_items_permissions_check' ),
'schema' => array( $this, 'get_public_item_schema' ),
'/' . $this->rest_base . '/experimental-activate-promo/(?P<promo_note_name>[\w-]+)',
'methods' => \WP_REST_Server::EDITABLE,
'callback' => array( $this, 'activate_promo_note' ),
'permission_callback' => array( $this, 'update_items_permissions_check' ),
'schema' => array( $this, 'get_public_item_schema' ),
* @param WP_REST_Request $request Request data.
* @return WP_REST_Response|WP_Error
public function get_item( $request ) {
$note = NotesRepository::get_note( $request->get_param( 'id' ) );
'woocommerce_note_invalid_id',
__( 'Sorry, there is no resource with that ID.', 'woocommerce' ),
if ( is_wp_error( $note ) ) {
$data = $this->prepare_note_data_for_response( $note, $request );
return rest_ensure_response( $data );
* @param WP_REST_Request $request Request data.
* @return WP_REST_Response
public function get_items( $request ) {
$query_args = $this->prepare_objects_query( $request );
$notes = NotesRepository::get_notes( 'edit', $query_args );
foreach ( (array) $notes as $note_obj ) {
$note = $this->prepare_item_for_response( $note_obj, $request );
$note = $this->prepare_response_for_collection( $note );
$response = rest_ensure_response( $data );
$response->header( 'X-WP-Total', count( $data ) );
* Checks if user is in tasklist experiment.
* @return bool Whether remote inbox notifications are enabled.
private function is_tasklist_experiment_assigned_treatment() {
$anon_id = isset( $_COOKIE['tk_ai'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['tk_ai'] ) ) : '';
$allow_tracking = 'yes' === get_option( 'woocommerce_allow_tracking' );
$abtest = new \WooCommerce\Admin\Experimental_Abtest(
$date->setTimeZone( new \DateTimeZone( 'UTC' ) );
$experiment_name = sprintf(
'woocommerce_tasklist_progression_headercard_%s_%s',
$experiment_name_2col = sprintf(
'woocommerce_tasklist_progression_headercard_2col_%s_%s',
return $abtest->get_variation( $experiment_name ) === 'treatment' ||
$abtest->get_variation( $experiment_name_2col ) === 'treatment';
* @param WP_REST_Request $request Full details about the request.
protected function prepare_objects_query( $request ) {
$args['order'] = $request['order'];
$args['orderby'] = $request['orderby'];
$args['per_page'] = $request['per_page'];
$args['page'] = $request['page'];
$args['type'] = isset( $request['type'] ) ? $request['type'] : array();
$args['status'] = isset( $request['status'] ) ? $request['status'] : array();
$args['source'] = isset( $request['source'] ) ? $request['source'] : array();
if ( isset( $request['is_read'] ) ) {
$args['is_read'] = filter_var( $request['is_read'], FILTER_VALIDATE_BOOLEAN );
if ( 'date' === $args['orderby'] ) {
$args['orderby'] = 'date_created';
* Filter the query arguments for a request.
* Enables adding extra arguments or setting defaults for a post
* @param array $args Key value array of query var to query value.
* @param WP_REST_Request $request The request used.
$args = apply_filters( 'woocommerce_rest_notes_object_query', $args, $request );
* Check whether a given request has permission to read a single note.
* @param WP_REST_Request $request Full details about the request.
* @return WP_Error|boolean
public function get_item_permissions_check( $request ) {
if ( ! wc_rest_check_manager_permissions( 'system_status', 'read' ) ) {
return new \WP_Error( 'woocommerce_rest_cannot_view', __( 'Sorry, you cannot list resources.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );
* Check whether a given request has permission to read notes.
* @param WP_REST_Request $request Full details about the request.
* @return WP_Error|boolean
public function get_items_permissions_check( $request ) {
if ( ! wc_rest_check_manager_permissions( 'system_status', 'read' ) ) {
return new \WP_Error( 'woocommerce_rest_cannot_view', __( 'Sorry, you cannot list resources.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );
* @param WP_REST_Request $request Full details about the request.
* @return WP_REST_Request|WP_Error
public function update_item( $request ) {
$note = NotesRepository::get_note( $request->get_param( 'id' ) );
'woocommerce_note_invalid_id',
__( 'Sorry, there is no resource with that ID.', 'woocommerce' ),
NotesRepository::update_note( $note, $this->get_requested_updates( $request ) );
return $this->get_item( $request );
* @param WP_REST_Request $request Full details about the request.
* @return WP_REST_Request|WP_Error
public function delete_item( $request ) {
$note = NotesRepository::get_note( $request->get_param( 'id' ) );
'woocommerce_note_invalid_id',
__( 'Sorry, there is no note with that ID.', 'woocommerce' ),
NotesRepository::delete_note( $note );
$data = $this->prepare_note_data_for_response( $note, $request );
return rest_ensure_response( $data );
* @param WP_REST_Request $request Request object.
* @return WP_REST_Request|WP_Error
public function delete_all_items( $request ) {
if ( isset( $request['status'] ) ) {
$args['status'] = $request['status'];
$notes = NotesRepository::delete_all_notes( $args );
foreach ( (array) $notes as $note_obj ) {
$data[] = $this->prepare_note_data_for_response( $note_obj, $request );
$response = rest_ensure_response( $data );
$response->header( 'X-WP-Total', NotesRepository::get_notes_count( array( 'info', 'warning' ), array() ) );
* @param Note $note Note data.
* @param WP_REST_Request $request Request object.
* @return WP_REST_Response $response Response data.
public function prepare_note_data_for_response( $note, $request ) {
$note = $note->get_data();
$note = $this->prepare_item_for_response( $note, $request );
return $this->prepare_response_for_collection( $note );
* Prepare an array with the requested updates.
* @param WP_REST_Request $request Request object.
* @return array A list of the requested updates values.
protected function get_requested_updates( $request ) {
$requested_updates = array();
if ( ! is_null( $request->get_param( 'status' ) ) ) {
$requested_updates['status'] = $request->get_param( 'status' );
if ( ! is_null( $request->get_param( 'date_reminder' ) ) ) {
$requested_updates['date_reminder'] = $request->get_param( 'date_reminder' );
if ( ! is_null( $request->get_param( 'is_deleted' ) ) ) {
$requested_updates['is_deleted'] = $request->get_param( 'is_deleted' );
if ( ! is_null( $request->get_param( 'is_read' ) ) ) {
$requested_updates['is_read'] = $request->get_param( 'is_read' );
return $requested_updates;
* Batch update a set of notes.
* @param WP_REST_Request $request Request object.
* @return WP_REST_Request|WP_Error
public function batch_update_items( $request ) {
$note_ids = $request->get_param( 'noteIds' );
if ( ! isset( $note_ids ) || ! is_array( $note_ids ) ) {
'woocommerce_note_invalid_ids',
__( 'Please provide an array of IDs through the noteIds param.', 'woocommerce' ),
foreach ( (array) $note_ids as $note_id ) {
$note = NotesRepository::get_note( (int) $note_id );
NotesRepository::update_note( $note, $this->get_requested_updates( $request ) );
$data[] = $this->prepare_note_data_for_response( $note, $request );
$response = rest_ensure_response( $data );
$response->header( 'X-WP-Total', NotesRepository::get_notes_count( array( 'info', 'warning' ), array() ) );
* Activate a promo note, create if not exist.
* @param WP_REST_Request $request Request object.
* @return WP_REST_Request|WP_Error
public function activate_promo_note( $request ) {
* Filter allowed promo notes for experimental-activate-promo.
* @param array $promo_notes Array of allowed promo notes.
$allowed_promo_notes = apply_filters( 'woocommerce_admin_allowed_promo_notes', [] );
$promo_note_name = $request->get_param( 'promo_note_name' );
if ( ! in_array( $promo_note_name, $allowed_promo_notes, true ) ) {
'woocommerce_note_invalid_promo_note_name',
__( 'Please provide a valid promo note name.', 'woocommerce' ),
$data_store = NotesRepository::load_data_store();
$note_ids = $data_store->get_notes_with_name( $promo_note_name );
if ( empty( $note_ids ) ) {
// Promo note doesn't exist, this could happen in cases where
// user might have disabled RemoteInboxNotications via disabling
// marketing suggestions. Thus we'd have to manually add the note.
$note->set_name( $promo_note_name );
$note->set_status( Note::E_WC_ADMIN_NOTE_ACTIONED );
$data_store->create( $note );
$note = NotesRepository::get_note( $note_ids[0] );
NotesRepository::update_note(
'status' => Note::E_WC_ADMIN_NOTE_ACTIONED,
return rest_ensure_response(
* Makes sure the current user has access to WRITE the settings APIs.