← All changes | includes/oauth/class-scope.php +88 -13 8.2.1 → 9.2.1 View file →

		@@ -51,8 +51,25 @@
51	51	self::PROFILE,
52	52	);
53	53
54	54	/**
	55	+ * SWICG ActivityPub API Basic Profile canonical scope aliases.
	56	+ *
	57	+ * Advertised in OAuth metadata so Basic Profile clients can discover them,
	58	+ * and accepted in scope requests (any `activitypub:read:*` collapses to
	59	+ * `read`, any `activitypub:write:*` collapses to `write`). Enforcement
	60	+ * stays coarse: there is no per-activity-type access control yet.
	61	+ *
	62	+ * @since 9.0.0
	63	+ *
	64	+ * @var array
	65	+ */
	66	+ const CANONICAL_ALIASES = array(
	67	+ 'activitypub:read:all',
	68	+ 'activitypub:write:all',
	69	+ );
	70	+
	71	+ /**
55	72	* Human-readable descriptions for each scope.
56	73	*
57	74	* @var array
58	75	*/
		@@ -78,30 +95,88 @@
78	95
79	96	/**
80	97	* Validate and filter requested scopes.
81	98	*
	99	+ * Canonical SWICG ActivityPub API Basic Profile scope names of the form
	100	+ * `activitypub:read:*` and `activitypub:write:*` are normalized to the
	101	+ * plugin's internal `read` and `write` scopes before validation.
	102	+ *
82	103	* @param string|array $scopes The requested scopes (space-separated string or array).
83	104	* @return array Valid scopes.
84	105	*/
85	106	public static function validate( $scopes ) {
86		- if ( is_string( $scopes ) ) {
	107	+ if ( \is_string( $scopes ) ) {
87	108	$scopes = self::parse( $scopes );
88	109	}
89	110
90		- if ( ! is_array( $scopes ) ) {
	111	+ if ( ! \is_array( $scopes ) ) {
91	112	return self::DEFAULT_SCOPES;
92	113	}
93	114
94		- $valid_scopes = array_intersect( $scopes, self::ALL );
	115	+ $scopes = self::normalize( $scopes );
	116	+ $valid_scopes = \array_intersect( $scopes, self::ALL );
95	117
96	118	if ( empty( $valid_scopes ) ) {
97	119	return self::DEFAULT_SCOPES;
98	120	}
99	121
100		- return array_values( $valid_scopes );
	122	+ return \array_values( \array_unique( $valid_scopes ) );
101	123	}
102	124
103	125	/**
	126	+ * Normalize canonical Basic Profile scope names to internal scopes.
	127	+ *
	128	+ * Maps any `activitypub:read:*` to {@see self::READ} and any
	129	+ * `activitypub:write:*` to {@see self::WRITE}. Unknown values pass through
	130	+ * unchanged so they can be filtered out by the caller.
	131	+ *
	132	+ * @since 9.0.0
	133	+ *
	134	+ * @param array $scopes Requested scope strings.
	135	+ * @return array Normalized scope strings.
	136	+ */
	137	+ public static function normalize( $scopes ) {
	138	+ if ( ! \is_array( $scopes ) ) {
	139	+ return array();
	140	+ }
	141	+
	142	+ $normalized = array();
	143	+ foreach ( $scopes as $scope ) {
	144	+ if ( ! \is_string( $scope ) || '' === $scope ) {
	145	+ continue;
	146	+ }
	147	+
	148	+ if ( 0 === \strpos( $scope, 'activitypub:read:' ) ) {
	149	+ $normalized[] = self::READ;
	150	+ continue;
	151	+ }
	152	+
	153	+ if ( 0 === \strpos( $scope, 'activitypub:write:' ) ) {
	154	+ $normalized[] = self::WRITE;
	155	+ continue;
	156	+ }
	157	+
	158	+ $normalized[] = $scope;
	159	+ }
	160	+
	161	+ return $normalized;
	162	+ }
	163	+
	164	+ /**
	165	+ * Return the scope identifiers advertised in OAuth authorization-server metadata.
	166	+ *
	167	+ * Includes the plugin's internal scopes plus the SWICG Basic Profile
	168	+ * canonical aliases so spec-aware clients can discover them.
	169	+ *
	170	+ * @since 9.0.0
	171	+ *
	172	+ * @return array Scope identifiers.
	173	+ */
	174	+ public static function supported() {
	175	+ return \array_merge( self::ALL, self::CANONICAL_ALIASES );
	176	+ }
	177	+
	178	+ /**
104	179	* Parse a space-separated scope string to array.
105	180	*
106	181	* @param string $scope_string Space-separated scopes.
107	182	* @return array Scope array.
		@@ -106,15 +181,15 @@
106	181	* @param string $scope_string Space-separated scopes.
107	182	* @return array Scope array.
108	183	*/
109	184	public static function parse( $scope_string ) {
110		- if ( empty( $scope_string ) || ! is_string( $scope_string ) ) {
	185	+ if ( empty( $scope_string ) || ! \is_string( $scope_string ) ) {
111	186	return array();
112	187	}
113	188
114		- $scopes = preg_split( '/\s+/', trim( $scope_string ) );
	189	+ $scopes = \preg_split( '/\s+/', \trim( $scope_string ) );
115	190
116		- return array_filter( array_map( 'trim', $scopes ) );
	191	+ return \array_filter( \array_map( 'trim', $scopes ) );
117	192	}
118	193
119	194	/**
120	195	* Convert scopes array to space-separated string.
		@@ -122,13 +197,13 @@
122	197	* @param array $scopes The scopes array.
123	198	* @return string Space-separated scope string.
124	199	*/
125	200	public static function to_string( $scopes ) {
126		- if ( ! is_array( $scopes ) ) {
	201	+ if ( ! \is_array( $scopes ) ) {
127	202	return '';
128	203	}
129	204
130		- return implode( ' ', $scopes );
	205	+ return \implode( ' ', $scopes );
131	206	}
132	207
133	208	/**
134	209	* Check if a scope is valid.
		@@ -136,9 +211,9 @@
136	211	* @param string $scope The scope to check.
137	212	* @return bool True if valid, false otherwise.
138	213	*/
139	214	public static function is_valid( $scope ) {
140		- return in_array( $scope, self::ALL, true );
	215	+ return \in_array( $scope, self::ALL, true );
141	216	}
142	217
143	218	/**
144	219	* Get the description for a scope.
		@@ -166,9 +241,9 @@
166	241	* @param string $scope The scope to look for.
167	242	* @return bool True if the scope is present.
168	243	*/
169	244	public static function contains( $scopes, $scope ) {
170		- return is_array( $scopes ) && in_array( $scope, $scopes, true );
	245	+ return \is_array( $scopes ) && \in_array( $scope, $scopes, true );
171	246	}
172	247
173	248	/**
174	249	* Sanitize callback for scope storage.
		@@ -176,13 +251,13 @@
176	251	* @param mixed $value The value to sanitize.
177	252	* @return array Sanitized scopes array.
178	253	*/
179	254	public static function sanitize( $value ) {
180		- if ( is_string( $value ) ) {
	255	+ if ( \is_string( $value ) ) {
181	256	$value = self::parse( $value );
182	257	}
183	258
184		- if ( ! is_array( $value ) ) {
	259	+ if ( ! \is_array( $value ) ) {
185	260	return array();
186	261	}
187	262
188	263	return self::validate( $value );