Google Calendar/Meet + Drive (free side) — IDOR-hardened (supersedes #625)

bootstrap/start.php

@@ -22,6 +22,7 @@
 wedevs_pm_register_routes();
 wedevs_pm_clean_svg();
 
+( new \WeDevs\PM\Google_Workspace\Loader() )->boot();
 new WeDevs\PM\Kanban\Kanban();
 
 do_action( 'wedevs_pm_loaded' );

core/WP/Menu.php

@@ -37,6 +37,36 @@ public static function admin_menu() {
 
         do_action( 'wedevs_cpm_admin_menu', self::$capability, $home );
 
+        // 3b. G Workspace — placed directly under Sprints (or in the views group
+        //     when Sprints isn't present). Shown when any Google feature is on.
+        if ( class_exists( '\WeDevs\PM\Google_Workspace\Google_Service' ) ) {
+            $gw = '\WeDevs\PM\Google_Workspace\Google_Service';
+            $gw_on = $gw::drive_enabled() || $gw::calendar_master_enabled() || $gw::meet_master_enabled();
+            if ( $gw_on ) {
+                $gw_item = [ __( 'G Workspace', 'wedevs-project-manager' ), self::$capability, "admin.php?page={$slug}#/google-workspace" ];
+                $list    = isset( $submenu[ $slug ] ) ? $submenu[ $slug ] : [];
+
+                // Find the integer POSITION of the Sprints entry (its array key may
+                // be a string, so never do arithmetic on the key itself).
+                $pos = -1; $i = 0;
+                foreach ( $list as $it ) {
+                    if ( isset( $it[2] ) && strpos( $it[2], '#/sprints' ) !== false ) { $pos = $i; break; }
+                    $i++;
+                }
+
+                // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Intentionally adding custom submenu items to WordPress admin menu
+                if ( $pos >= 0 ) {
+                    $submenu[ $slug ] = array_merge(
+                        array_slice( $list, 0, $pos + 1 ),
+                        [ $gw_item ],
+                        array_slice( $list, $pos + 1 )
+                    );
+                } else {
+                    $submenu[ $slug ][] = $gw_item;
+                }
+            }
+        }
+
         // 4. Upgrade to Pro (free only)
         if ( ! $wedevs_pm_pro ) {
             // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Intentionally adding custom submenu items to WordPress admin menu

db/Create_Table.php

@@ -26,6 +26,7 @@ public function __construct() {
         $this->crate_role_project_users_table();
         $this->update_version();
         $this->task_types();
+        \WeDevs\PM\Google_Workspace\Loader::install();
     }
 
     private function prefix() {

routes/google-workspace.php

@@ -0,0 +1,63 @@
+<?php
+use WeDevs\PM\Core\Router\Router;
+
+$wedevs_pm_router = Router::singleton();
+
+$gw_base   = 'WeDevs/PM/Google_Workspace/Controllers/';
+$gw_admin  = 'WeDevs\PM\Core\Permissions\Settings_Page_Access';
+$gw_auth   = 'WeDevs\PM\Core\Permissions\Authentic';
+$gw_access = 'WeDevs\PM\Core\Permissions\Access_Project';
+
+// ── Admin: site-level OAuth credentials + Picker keys ────────────────
+$wedevs_pm_router->get( 'google-workspace/settings', $gw_base . 'Settings_Controller@get' )
+    ->permission( [ $gw_admin ] );
+
+$wedevs_pm_router->post( 'google-workspace/settings', $gw_base . 'Settings_Controller@save' )
+    ->permission( [ $gw_admin ] );
+
+// ── Per-user connection ──────────────────────────────────────────────
+$wedevs_pm_router->get( 'google-workspace/status', $gw_base . 'OAuth_Controller@status' )
+    ->permission( [ $gw_auth ] );
+
+$wedevs_pm_router->get( 'google-workspace/auth-url', $gw_base . 'OAuth_Controller@auth_url' )
+    ->permission( [ $gw_auth ] );
+
+$wedevs_pm_router->post( 'google-workspace/disconnect', $gw_base . 'OAuth_Controller@disconnect' )
+    ->permission( [ $gw_auth ] );
+
+$wedevs_pm_router->post( 'google-workspace/my-prefs', $gw_base . 'OAuth_Controller@save_my_prefs' )
+    ->permission( [ $gw_auth ] );
+
+// ── Drive Picker config (vends caller's own access token + Picker keys) ──
+$wedevs_pm_router->get( 'google-workspace/drive/picker-config', $gw_base . 'Drive_Controller@picker_config' )
+    ->permission( [ $gw_auth ] );
+
+// ── Per-project Drive role access (manager configures; members query) ──
+// Same gate as the project Capabilities/Settings tab where these toggles live.
+$gw_manager = 'WeDevs\PM\Core\Permissions\Project_Settings_Page_Access';
+
+$wedevs_pm_router->get( 'projects/{project_id}/google-workspace/access', $gw_base . 'Drive_Controller@get_access' )
+    ->permission( [ $gw_manager ] );
+
+$wedevs_pm_router->post( 'projects/{project_id}/google-workspace/access', $gw_base . 'Drive_Controller@save_access' )
+    ->permission( [ $gw_manager ] );
+
+$wedevs_pm_router->get( 'projects/{project_id}/google-workspace/can-use', $gw_base . 'Drive_Controller@can_use' )
+    ->permission( [ $gw_access ] );
+
+// ── Drive attachments (polymorphic: task, comment, discussion, project) ──
+$wedevs_pm_router->get( 'projects/{project_id}/google-drive', $gw_base . 'Drive_Controller@index' )
+    ->permission( [ $gw_access ] );
+
+$wedevs_pm_router->post( 'projects/{project_id}/google-drive', $gw_base . 'Drive_Controller@attach' )
+    ->permission( [ $gw_access ] );
+
+$wedevs_pm_router->delete( 'projects/{project_id}/google-drive/{id}', $gw_base . 'Drive_Controller@destroy' )
+    ->permission( [ $gw_access ] );
+
+// Legacy task-scoped routes (kept for back-compat).
+$wedevs_pm_router->get( 'projects/{project_id}/tasks/{task_id}/google-drive', $gw_base . 'Drive_Controller@index' )
+    ->permission( [ $gw_access ] );
+
+$wedevs_pm_router->post( 'projects/{project_id}/tasks/{task_id}/google-drive', $gw_base . 'Drive_Controller@attach' )
+    ->permission( [ $gw_access ] );

src/Activity/Transformers/Activity_Transformer.php

@@ -152,6 +152,10 @@ private function parse_meta_for_comment( Activity $activity ) {
             }
         }
 
+        // Google Workspace: flag comments that contain a Drive/Meet link.
+        if ( ! empty( $activity->meta['has_drive'] ) ) { $meta['has_drive'] = true; }
+        if ( ! empty( $activity->meta['has_meet'] ) )  { $meta['has_meet']  = true; }
+
         return $meta;
     }
 
@@ -228,6 +232,16 @@ private function get_nested_value( $data, $path ) {
      */
     private function get_activity_message_by_action( $action ) {
         switch ( $action ) {
+            // Google Workspace activities
+            case 'attach_drive_file':
+                return __( '{{actor.data.display_name}} attached a Google Drive file to {{meta.task_title}}.', 'wedevs-project-manager' );
+
+            case 'detach_drive_file':
+                return __( '{{actor.data.display_name}} removed a Google Drive file from {{meta.task_title}}.', 'wedevs-project-manager' );
+
+            case 'create_meet':
+                return __( '{{actor.data.display_name}} started a Google Meet meeting.', 'wedevs-project-manager' );
+
             // Project activities
             case 'create_project':
                 /* translators: 1: User display name, 2: Project title */

src/Comment/Observers/Comment_Observer.php

@@ -37,8 +37,14 @@ protected function content( Comment $comment, $old_value ) {
 
     private function log_activity( Comment $comment, $action_type ) {
         $parent_comment = Comment::parent_comment( $comment->id );
+        if ( ! $parent_comment ) {
+            return; // can't resolve the thread root — skip activity logging
+        }
         $commentable_type = $parent_comment->commentable_type;
         $commentable = $this->get_commentable( $parent_comment );
+        if ( ! $commentable ) {
+            return; // commentable (task/discussion/file) gone — skip logging
+        }
 
         switch ( $commentable_type ) {
             case 'task':
@@ -67,11 +73,24 @@ private function log_activity( Comment $comment, $action_type ) {
         }
     }
 
+    /** Flags whether a comment body contains a Drive / Meet link (for activity icons). */
+    private function gw_meta( Comment $comment ) {
+        $content = (string) $comment->content;
+        return [
+            'has_drive' => ( strpos( $content, 'drive.google.com' ) !== false || strpos( $content, 'docs.google.com' ) !== false ),
+            'has_meet'  => ( strpos( $content, 'meet.google.com' ) !== false ),
+        ];
+    }
+
     private function comment_on_task( Comment $comment, Task $task, $action_type ) {
         $meta = [
             'comment_id' => $comment->id,
             'task_title' => $task->title,
         ];
+        // Don't mark a deleted comment with Drive/Meet icons.
+        if ( $action_type !== 'delete' ) {
+            $meta = array_merge( $meta, $this->gw_meta( $comment ) );
+        }
 
         if ( $action_type == 'create' && $comment->commentable_type == 'comment' ) {
             $action = 'reply_comment_on_task';

src/Comment/Transformers/Comment_Transformer.php

@@ -30,7 +30,7 @@ class Comment_Transformer extends TransformerAbstract {
     public function transform( Comment $item ) {
         return [
             'id'               => (int) $item->id,
-            'content'          => wedevs_pm_get_content( $item->content ),
+            'content'          => apply_filters( 'wedevs_pm_comment_content_visibility', wedevs_pm_get_content( $item->content ), (int) $item->project_id ),
             'commentable_type' => $item->commentable_type,
             'commentable_id'   => $item->commentable_id,
             'created_at'       => wedevs_pm_format_date( $item->created_at ),