Forbid restore and trash action for WP list in bulk action

[MAILPOET-3169]

lib/API/JSON/v1/Segments.php

@@ -117,6 +117,11 @@ class Segments extends APIEndpoint {
   public function restore($data = []) {
     $segment = $this->getSegment($data);
     if ($segment instanceof SegmentEntity) {
+      if (!$this->isTrashOrRestoreAllowed($segment)) {
+        return $this->errorResponse([
+          APIError::FORBIDDEN => WPFunctions::get()->__('This list cannot be moved to trash.', 'mailpoet'),
+        ]);
+      }
       // When the segment is of type WP_USERS we want to restore all its subscribers
       if ($segment->getType() === SegmentEntity::TYPE_WP_USERS) {
         $subscribers = $this->subscribersRepository->findBySegment((int)$segment->getId());
@@ -126,7 +131,7 @@ class Segments extends APIEndpoint {
         $this->subscribersRepository->bulkRestore($subscriberIds);
       }
 
-      $this->segmentsRepository->bulkRestore([$segment->getId()]);
+      $this->segmentsRepository->bulkRestore([$segment->getId()], $segment->getType());
       $this->segmentsRepository->refresh($segment);
       return $this->successResponse(
         $this->segmentsResponseBuilder->build($segment),
@@ -142,6 +147,11 @@ class Segments extends APIEndpoint {
   public function trash($data = []) {
     $segment = $this->getSegment($data);
     if ($segment instanceof SegmentEntity) {
+      if (!$this->isTrashOrRestoreAllowed($segment)) {
+        return $this->errorResponse([
+          APIError::FORBIDDEN => WPFunctions::get()->__('This list cannot be moved to trash.', 'mailpoet'),
+        ]);
+      }
       // When the segment is of type WP_USERS we want to trash all subscribers who aren't subscribed in another list
       if ($segment->getType() === SegmentEntity::TYPE_WP_USERS) {
         $subscribers = $this->subscribersRepository->findExclusiveSubscribersBySegment((int)$segment->getId());
@@ -151,7 +161,7 @@ class Segments extends APIEndpoint {
         $this->subscribersRepository->bulkTrash($subscriberIds);
       }
 
-      $this->segmentsRepository->bulkTrash([$segment->getId()]);
+      $this->segmentsRepository->bulkTrash([$segment->getId()], $segment->getType());
       $this->segmentsRepository->refresh($segment);
       return $this->successResponse(
         $this->segmentsResponseBuilder->build($segment),
@@ -231,6 +241,18 @@ class Segments extends APIEndpoint {
     return $this->successResponse(null, ['count' => $count]);
   }
 
+  private function isTrashOrRestoreAllowed(SegmentEntity $segment): bool {
+    $allowedSegmentTypes = [
+      SegmentEntity::TYPE_DEFAULT,
+      SegmentEntity::TYPE_WP_USERS,
+    ];
+    if (in_array($segment->getType(), $allowedSegmentTypes, true)) {
+      return true;
+    }
+
+    return false;
+  }
+
   private function getSegment(array $data): ?SegmentEntity {
     return isset($data['id'])
       ? $this->segmentsRepository->findOneById((int)$data['id'])

lib/Segments/SegmentsRepository.php

@@ -105,15 +105,15 @@ class SegmentsRepository extends Repository {
     });
   }
 
-  public function bulkTrash(array $ids): int {
+  public function bulkTrash(array $ids, string $type = SegmentEntity::TYPE_DEFAULT): int {
-    return $this->updateDeletedAt($ids, new Carbon());
+    return $this->updateDeletedAt($ids, new Carbon(), $type);
   }
 
-  public function bulkRestore(array $ids): int {
+  public function bulkRestore(array $ids, string $type = SegmentEntity::TYPE_DEFAULT): int {
-    return $this->updateDeletedAt($ids, null);
+    return $this->updateDeletedAt($ids, null, $type);
   }
 
-  private function updateDeletedAt(array $ids, ?DateTime $deletedAt): int {
+  private function updateDeletedAt(array $ids, ?DateTime $deletedAt, string $type): int {
     if (empty($ids)) {
       return 0;
     }
@@ -121,10 +121,10 @@ class SegmentsRepository extends Repository {
     $rows = $this->entityManager->createQueryBuilder()->update(SegmentEntity::class, 's')
     ->set('s.deletedAt', ':deletedAt')
     ->where('s.id IN (:ids)')
-    ->andWhere('s.type IN (:types)')
+    ->andWhere('s.type IN (:type)')
     ->setParameter('deletedAt', $deletedAt)
     ->setParameter('ids', $ids)
-    ->setParameter('types', [SegmentEntity::TYPE_DEFAULT, SegmentEntity::TYPE_WP_USERS])
+    ->setParameter('type', $type)
     ->getQuery()->execute();
 
     return $rows;