Capability.php — Advanced Access Manager – Access Governance for WordPress trunk

advanced-access-manager / application / Restful / Capability.php

advanced-access-manager / application / Restful Last commit date

AccessDeniedRedirect.php 1 year ago AdminToolbar.php 1 year ago ApiRoute.php 1 year ago BackendMenu.php 1 year ago BackwardCompatibility.php 1 year ago Capability.php 1 year ago Configs.php 5 months ago Content.php 1 year ago Identity.php 1 year ago Jwt.php 5 months ago LoginRedirect.php 1 year ago LogoutRedirect.php 1 year ago Metabox.php 1 year ago Mu.php 1 year ago NotFoundRedirect.php 1 year ago Policies.php 1 year ago Roles.php 1 year ago SecureLogin.php 1 year ago SecurityAudit.php 1 year ago ServiceTrait.php 1 year ago Settings.php 1 year ago Urls.php 1 year ago Users.php 1 year ago Widgets.php 1 year ago

Capability.php

406 lines

1	<?php
2
3	/**
4	* ======================================================================
5	* LICENSE: This file is subject to the terms and conditions defined in *
6	* file 'license.txt', which is part of this source code package. *
7	* ======================================================================
8	*/
9
10	/**
11	* RESTful API for the Capabilities service
12	*
13	* @package AAM
14	* @version 7.0.0
15	*/
16	class AAM_Restful_Capability
17	{
18
19	use AAM_Restful_ServiceTrait;
20
21	/**
22	* Necessary permissions to access endpoint
23	*
24	* @version 7.0.0
25	*/
26	const PERMISSIONS = [
27	'aam_manager',
28	'aam_manage_capabilities'
29	];
30
31	/**
32	* Constructor
33	*
34	* @return void
35	* @access protected
36	*
37	* @version 7.0.0
38	*/
39	protected function __construct()
40	{
41	// Register API endpoint
42	add_action('rest_api_init', function() {
43	// Get list of all registered capabilities
44	$this->_register_route('/capabilities', array(
45	'methods' => WP_REST_Server::READABLE,
46	'callback' => array($this, 'get_list'),
47	'args' => array(
48	'fields' => array(
49	'description' => 'List of additional fields to return',
50	'type' => 'string'
51	),
52	'list_all' => array(
53	'description' => 'List all capabilities or not',
54	'type' => 'boolean',
55	'default' => false
56	)
57	)
58	), self::PERMISSIONS, [
59	AAM_Framework_Type_AccessLevel::ROLE,
60	AAM_Framework_Type_AccessLevel::USER
61	]);
62
63	// Create new capability
64	$this->_register_route('/capabilities', array(
65	'methods' => WP_REST_Server::EDITABLE,
66	'callback' => array($this, 'create_capability'),
67	'args' => array(
68	'slug' => array(
69	'description' => 'Capability slug',
70	'type' => 'string',
71	'required' => true
72	),
73	'ignore_format' => [
74	'description' => 'Bypass the recommended by WP core standard',
75	'type' => 'boolean',
76	'default' => false
77	],
78	'is_granted' => [
79	'description' => 'Grant this cap to current access level',
80	'type' => 'boolean',
81	'default' => true
82	]
83	)
84	), self::PERMISSIONS, [
85	AAM_Framework_Type_AccessLevel::ROLE,
86	AAM_Framework_Type_AccessLevel::USER
87	]);
88
89	// Update existing capability
90	$this->_register_route('/capability/(?P<capability>.+)', [
91	'methods' => WP_REST_Server::EDITABLE,
92	'callback' => [ $this, 'update_capability' ],
93	'args' => [
94	'capability' => [
95	'description' => 'Existing capability slug',
96	'type' => 'string',
97	'required' => true
98	],
99	'slug' => [
100	'description' => 'New capability slug',
101	'type' => 'string',
102	'required' => true
103	],
104	'ignore_format' => [
105	'description' => 'Bypass the recommended by WP core standard',
106	'type' => 'boolean',
107	'default' => false
108	],
109	'globally' => [
110	'description' => 'Wether this change affect only this access level or all',
111	'type' => 'boolean',
112	'default' => false
113	]
114	]
115	], self::PERMISSIONS, [
116	AAM_Framework_Type_AccessLevel::ROLE,
117	AAM_Framework_Type_AccessLevel::USER
118	]);
119
120	// Delete existing capability
121	$this->_register_route('/capability/(?P<slug>.+)', array(
122	'methods' => WP_REST_Server::DELETABLE,
123	'callback' => array($this, 'delete_capability'),
124	'args' => [
125	'globally' => [
126	'description' => 'Wether this change affect only this access level or all',
127	'type' => 'boolean',
128	'default' => false
129	]
130	]
131	), self::PERMISSIONS, [
132	AAM_Framework_Type_AccessLevel::ROLE,
133	AAM_Framework_Type_AccessLevel::USER
134	]);
135	});
136	}
137
138	/**
139	* Get list of all capabilities
140	*
141	* @param WP_REST_Request $request
142	*
143	* @return WP_REST_Response
144	* @access public
145	*
146	* @version 7.0.0
147	*/
148	public function get_list(WP_REST_Request $request)
149	{
150	try {
151	$access_level = $this->_determine_access_level($request);
152
153	if ($access_level->type === AAM_Framework_Type_AccessLevel::USER) {
154	$caps = AAM::api()->caps->get_all_caps($access_level->ID);
155	} else {
156	$caps = AAM::api()->caps->get_all_caps();
157	}
158
159	// Return a pure and enriched array of capabilities
160	$result = [];
161
162	foreach($caps as $capability) {
163	array_push($result, $this->_prepare_output($capability, $request));
164	}
165	} catch (Exception $e) {
166	$result = $this->_prepare_error_response($e);
167	}
168
169	return rest_ensure_response($result);
170	}
171
172	/**
173	* Create new capability
174	*
175	* @param WP_REST_Request $request
176	*
177	* @return WP_REST_Response
178	* @access public
179	*
180	* @version 7.0.0
181	*/
182	public function create_capability(WP_REST_Request $request)
183	{
184	try {
185	$capability = urldecode($request->get_param('slug'));
186	$ignore_format = $request->get_param('ignore_format');
187	$is_granted = $request->get_param('is_granted');
188
189	// Step #1. Let's create the capability and automatically assign it to
190	// the administrator role
191	if (wp_roles()->is_role('administrator')) {
192	AAM::api()->capabilities('role:administrator')->allow(
193	$capability, $ignore_format
194	);
195	}
196
197	// Step #2. Assign the newly created capability to current access level
198	$this->_get_service($request)->add(
199	$capability, $is_granted, $ignore_format
200	);
201
202	// Step #3. Prepare the output
203	$result = $this->_prepare_output($capability, $request);
204	} catch (Exception $e) {
205	$result = $this->_prepare_error_response($e);
206	}
207
208	return rest_ensure_response($result);
209	}
210
211	/**
212	* Update existing capability
213	*
214	* @param WP_REST_Request $request
215	*
216	* @return WP_REST_Response
217	* @access public
218	*
219	* @version 7.0.0
220	*/
221	public function update_capability(WP_REST_Request $request)
222	{
223	try {
224	$capability = urldecode($request->get_param('capability'));
225	$slug = $request->get_param('slug');
226	$ignore_format = $request->get_param('ignore_format');
227	$globally = $request->get_param('globally');
228
229	if ($globally) {
230	// Iterating over the list of all roles and replace capabilities
231	foreach(array_keys(wp_roles()->role_names) as $role_slug) {
232	AAM::api()->capabilities('role:' . $role_slug)->replace(
233	$capability, $slug, $ignore_format
234	);
235	}
236	}
237
238	// Finally update the capability for given access level
239	$this->_get_service($request)->replace(
240	$capability, $slug, $ignore_format
241	);
242
243	$result = $this->_prepare_output($slug, $request);
244	} catch (Exception $e) {
245	$result = $this->_prepare_error_response($e);
246	}
247
248	return rest_ensure_response($result);
249	}
250
251	/**
252	* Delete existing capability
253	*
254	* @param WP_REST_Request $request
255	*
256	* @return WP_REST_Response
257	* @access public
258	*
259	* @version 7.0.0
260	*/
261	public function delete_capability(WP_REST_Request $request)
262	{
263	try {
264	$capability = urldecode($request->get_param('slug'));
265	$globally = $request->get_param('globally');
266
267	if ($globally) {
268	// Iterating over the list of all roles and replace capabilities
269	foreach(array_keys(wp_roles()->role_names) as $role_slug) {
270	AAM::api()->capabilities('role:' . $role_slug)->remove(
271	$capability
272	);
273	}
274	}
275
276	// Finally remove the capability for a given access level
277	$this->_get_service($request)->remove($capability);
278
279	$result = [ 'success' => true ];
280	} catch (Exception $e) {
281	$result = $this->_prepare_error_response($e);
282	}
283
284	return rest_ensure_response($result);
285	}
286
287	/**
288	* Get service
289	*
290	* @param WP_REST_Request $request
291	*
292	* @return AAM_Framework_Service_Capabilities
293	* @access private
294	*
295	* @version 7.0.0
296	*/
297	private function _get_service(WP_REST_Request $request)
298	{
299	return AAM::api()->capabilities(
300	$this->_determine_access_level($request),
301	[ 'error_handling' => 'exception' ]
302	);
303	}
304
305	/**
306	* Prepare the output
307	*
308	* @param string $capability
309	* @param WP_Rest_Request $request
310	*
311	* @return array
312	* @access private
313	*
314	* @version 7.0.0
315	*/
316	private function _prepare_output($capability, $request)
317	{
318	$service = $this->_get_service($request);
319	$fields = $this->_determine_fields($request);
320
321	// Prepare the output model
322	$output = [
323	'slug' => $capability,
324	'description' => apply_filters(
325	'aam_capability_description_filter', null, $capability
326	),
327	'permissions' => $this->_prepare_permissions($capability, $service),
328	'is_granted' => $service->is_allowed($capability)
329	];
330
331	// Prepare the final output
332	$result = [];
333
334	foreach($fields as $field) {
335	if (array_key_exists($field, $output)) {
336	$result[$field] = $output[$field];
337	}
338	}
339
340	return $result;
341	}
342
343	/**
344	* Prepare permissions for give capability model
345	*
346	* @param string $capability
347	* @param AAM_Framework_Service_Capabilities $service
348	*
349	* @return array
350	* @access private
351	*
352	* @version 7.0.0
353	*/
354	private function _prepare_permissions($capability, $service)
355	{
356	$result = [];
357
358	$manage = AAM::api()->config->get('service.capability.edit_caps');
359	$update = apply_filters('aam_cap_can_filter', true, $capability, 'update');
360	$delete = apply_filters('aam_cap_can_filter', true, $capability, 'delete');
361	$toggle = apply_filters('aam_cap_can_filter', true, $capability, 'toggle');
362
363	// Adding the permissions data as well
364	if ($manage && $update !== false) {
365	array_push($result, 'allow_update');
366	}
367
368	if ($manage && $delete !== false) {
369	// Additional validation
370	if ($service->exists($capability)) {
371	array_push($result, 'allow_delete');
372	} else {
373	array_push($result, 'allow_delete');
374	}
375	}
376
377	if ($toggle !== false) {
378	array_push($result, 'allow_toggle');
379	}
380
381	return $result;
382	}
383
384	/**
385	* Determine list of additional fields to return
386	*
387	* @param WP_REST_Request $request
388	*
389	* @return array
390	* @access private
391	*
392	* @version 7.0.0
393	*/
394	private function _determine_fields(WP_REST_Request $request)
395	{
396	$result = [ 'slug' ];
397	$fields = $request->get_param('fields');
398
399	if (!empty($fields) && is_string($fields)) {
400	$result = array_merge($result, wp_parse_list($fields));
401	}
402
403	return array_unique($result);
404	}
405
406	}