ApiRoute.php — Advanced Access Manager – Access Governance for WordPress trunk

advanced-access-manager / application / Restful / ApiRoute.php

advanced-access-manager / application / Restful Last commit date

AccessDeniedRedirect.php 1 year ago AdminToolbar.php 1 year ago ApiRoute.php 1 year ago BackendMenu.php 1 year ago BackwardCompatibility.php 1 year ago Capability.php 1 year ago Configs.php 5 months ago Content.php 1 year ago Identity.php 1 year ago Jwt.php 5 months ago LoginRedirect.php 1 year ago LogoutRedirect.php 1 year ago Metabox.php 1 year ago Mu.php 1 year ago NotFoundRedirect.php 1 year ago Policies.php 1 year ago Roles.php 1 year ago SecureLogin.php 1 year ago SecurityAudit.php 1 year ago ServiceTrait.php 1 year ago Settings.php 1 year ago Urls.php 1 year ago Users.php 1 year ago Widgets.php 1 year ago

ApiRoute.php

343 lines

1	<?php
2
3	/**
4	* ======================================================================
5	* LICENSE: This file is subject to the terms and conditions defined in *
6	* file 'license.txt', which is part of this source code package. *
7	* ======================================================================
8	*/
9
10	/**
11	* RESTful API for the API route service
12	*
13	* @package AAM
14	* @version 7.0.0
15	*/
16	class AAM_Restful_ApiRoute
17	{
18
19	use AAM_Restful_ServiceTrait;
20
21	/**
22	* Necessary permissions to access endpoint
23	*
24	* @version 7.0.0
25	*/
26	const PERMISSIONS = [
27	'aam_manager',
28	'aam_manage_api_routes'
29	];
30
31	/**
32	* Constructor
33	*
34	* @return void
35	* @access protected
36	*
37	* @version 7.0.0
38	*/
39	protected function __construct()
40	{
41	// Register API endpoint
42	add_action('rest_api_init', function() {
43	// Get the list of routes
44	$this->_register_route('/api-routes', array(
45	'methods' => WP_REST_Server::READABLE,
46	'callback' => array($this, 'get_items')
47	), self::PERMISSIONS);
48
49	// Get a route
50	$this->_register_route('/api-route/(?P<id>[A-Za-z0-9\/\+=]+)', array(
51	'methods' => WP_REST_Server::READABLE,
52	'callback' => array($this, 'get_item'),
53	'args' => array(
54	'id' => array(
55	'description' => 'Based64 encoded API route + method',
56	'type' => 'string',
57	'required' => true,
58	'validate_callback' => function ($value) {
59	return $this->_validate_base64($value);
60	}
61	)
62	)
63	), self::PERMISSIONS);
64
65	// Update a route permission
66	$this->_register_route('/api-route/(?P<id>[A-Za-z0-9\/\+=]+)', array(
67	'methods' => WP_REST_Server::EDITABLE,
68	'callback' => array($this, 'update_item_permissions'),
69	'args' => array(
70	'id' => array(
71	'description' => 'Based64 encoded API route + method',
72	'type' => 'string',
73	'required' => true,
74	'validate_callback' => function ($value) {
75	return $this->_validate_base64($value);
76	}
77	),
78	'effect' => array(
79	'description' => 'Either route is restricted or not',
80	'type' => 'string',
81	'default' => 'deny',
82	'enum' => [ 'allow', 'deny' ]
83	)
84	)
85	), self::PERMISSIONS);
86
87	// Delete a route permission
88	$this->_register_route('/api-route/(?P<id>[A-Za-z0-9\/\+=]+)', array(
89	'methods' => WP_REST_Server::DELETABLE,
90	'callback' => array($this, 'reset_item_permissions'),
91	'args' => array(
92	'id' => array(
93	'description' => 'Based64 encoded API route + method',
94	'type' => 'string',
95	'required' => true,
96	'validate_callback' => function ($value) {
97	return $this->_validate_base64($value);
98	}
99	)
100	)
101	), self::PERMISSIONS);
102
103	// Reset all routes' permissions
104	$this->_register_route('/api-routes', array(
105	'methods' => WP_REST_Server::DELETABLE,
106	'callback' => array($this, 'reset_permissions')
107	), self::PERMISSIONS);
108	});
109	}
110
111	/**
112	* Get list of all API routes with permissions
113	*
114	* @param WP_REST_Request $request
115	*
116	* @return WP_REST_Response
117	* @access public
118	*
119	* @version 7.0.0
120	*/
121	public function get_items(WP_REST_Request $request)
122	{
123	try {
124	$result = $this->_get_route_list($this->_get_service($request));
125	} catch (Exception $e) {
126	$result = $this->_prepare_error_response($e);
127	}
128
129	return rest_ensure_response($result);
130	}
131
132	/**
133	* Get a route
134	*
135	* @param WP_REST_Request $request
136	*
137	* @return WP_REST_Response
138	* @access public
139	*
140	* @version 7.0.0
141	*/
142	public function get_item(WP_REST_Request $request)
143	{
144	try {
145	$result = $this->_find_route_by_id(
146	$this->_get_service($request),
147	$request->get_param('id')
148	);
149
150	if (empty($result)) {
151	throw new OutOfRangeException('Route does not exist');
152	}
153	} catch (Exception $e) {
154	$result = $this->_prepare_error_response($e);
155	}
156
157	return rest_ensure_response($result);
158	}
159
160	/**
161	* Update a route permissions
162	*
163	* @param WP_REST_Request $request
164	*
165	* @return WP_REST_Response
166	* @access public
167	*
168	* @version 7.0.0
169	*/
170	public function update_item_permissions(WP_REST_Request $request)
171	{
172	try {
173	$service = $this->_get_service($request);
174	$id = $request->get_param('id');
175	$effect = $request->get_param('effect');
176
177	if ($effect === 'allow') {
178	$service->allow(base64_decode($id));
179	} else {
180	$service->deny(base64_decode($id));
181	}
182
183	$result = $this->_find_route_by_id($service, $id);
184	} catch (Exception $e) {
185	$result = $this->_prepare_error_response($e);
186	}
187
188	return rest_ensure_response($result);
189	}
190
191	/**
192	* Delete a route permissions
193	*
194	* @param WP_REST_Request $request
195	*
196	* @return WP_REST_Response
197	* @access public
198	*
199	* @version 7.0.0
200	*/
201	public function reset_item_permissions(WP_REST_Request $request)
202	{
203	try {
204	$result = [
205	'success' => $this->_get_service($request)->reset(
206	base64_decode($request->get_param('id'))
207	)
208	];
209	} catch (Exception $e) {
210	$result = $this->_prepare_error_response($e);
211	}
212
213	return rest_ensure_response($result);
214	}
215
216	/**
217	* Reset all routes' permissions
218	*
219	* @param WP_REST_Request $request
220	*
221	* @return WP_REST_Response
222	* @access public
223	*
224	* @version 7.0.0
225	*/
226	public function reset_permissions(WP_REST_Request $request)
227	{
228	try {
229	$result = [
230	'success' => $this->_get_service($request)->reset()
231	];
232	} catch (Exception $e) {
233	$result = $this->_prepare_error_response($e);
234	}
235
236	return rest_ensure_response($result);
237	}
238
239	/**
240	* Get complete list of routes
241	*
242	* @param AAM_Framework_Service_ApiRoutes $service
243	*
244	* @return array
245	* @access private
246	*
247	* @version 7.0.0
248	*/
249	private function _get_route_list($service)
250	{
251	$result = [];
252
253	// Iterating over the list of all registered API routes and compile the
254	// list
255	foreach (rest_get_server()->get_routes() as $endpoint => $handlers) {
256	$methods = [];
257
258	foreach ($handlers as $handler) {
259	$methods = array_merge(
260	$methods, array_keys($handler['methods'])
261	);
262	}
263
264	foreach (array_unique($methods) as $method) {
265	array_push($result, [
266	'endpoint' => strtolower($endpoint),
267	'method' => strtoupper($method),
268	'is_restricted' => $service->is_denied($method . ' ' . $endpoint),
269	'id' => base64_encode(strtolower(
270	"{$method} {$endpoint}"
271	))
272	]);
273	}
274	}
275
276	return $result;
277	}
278
279	/**
280	* Find API route by ID
281	*
282	* @param AAM_Framework_Service_ApiRoute $service
283	* @param string $id
284	*
285	* @return array\|null
286	* @access private
287	*
288	* @version 7.0.0
289	*/
290	private function _find_route_by_id($service, $id)
291	{
292	$routes = $this->_get_route_list($service);
293	$found = array_filter($routes, function($r) use ($id) {
294	return $r['id'] === $id;
295	});
296
297	return !empty($found) ? array_shift($found) : null;
298	}
299
300	/**
301	* Get JWT framework service
302	*
303	* @param WP_REST_Request $request
304	*
305	* @return AAM_Framework_Service_ApiRoutes
306	* @access private
307	*
308	* @version 7.0.0
309	*/
310	private function _get_service($request)
311	{
312	return AAM::api()->api_routes(
313	$this->_determine_access_level($request),
314	[ 'error_handling' => 'exception' ]
315	);
316	}
317
318	/**
319	* Validate that the string is valid base64 encoded
320	*
321	* @param string $value
322	*
323	* @return boolean\|WP_Error
324	* @access private
325	*
326	* @version 7.0.0
327	*/
328	private function _validate_base64($value)
329	{
330	$response = true;
331
332	if (!AAM::api()->misc->is_base64_encoded($value)) {
333	$response = new WP_Error(
334	'rest_invalid_param',
335	'Invalid ID',
336	[ 'status' => 400 ]
337	);
338	}
339
340	return $response;
341	}
342
343	}