| 1 |
<?php |
| 2 |
|
| 3 |
class MeowKit_MWCODE_Rest { |
| 4 |
private $namespace = 'meow-common/v1'; |
| 5 |
public static $instance = null; |
| 6 |
|
| 7 |
public static function init_once() { |
| 8 |
if ( !MeowKit_MWCODE_Rest::$instance ) { |
| 9 |
MeowKit_MWCODE_Rest::$instance = new self(); |
| 10 |
} |
| 11 |
} |
| 12 |
|
| 13 |
private function __construct() { |
| 14 |
add_action( 'rest_api_init', [ $this, 'rest_api_init' ] ); |
| 15 |
} |
| 16 |
|
| 17 |
/** |
| 18 |
* Capability gate for plugin admin endpoints. Defaults to manage_options but |
| 19 |
* honours a per-plugin filter so a site can grant access to other roles |
| 20 |
* without re-implementing every permission_callback. The filter name is |
| 21 |
* derived from the class name (`MeowKit_<PREFIX>_Rest` => `<prefix>_allow_setup`), |
| 22 |
* so each plugin gets its own filter automatically after Nekofy substitution. |
| 23 |
*/ |
| 24 |
private function can_setup() { |
| 25 |
static $filter = null; |
| 26 |
if ( $filter === null ) { |
| 27 |
$parts = explode( '_', __CLASS__ ); |
| 28 |
$prefix = isset( $parts[1] ) ? strtolower( $parts[1] ) : ''; |
| 29 |
$filter = $prefix !== '' ? $prefix . '_allow_setup' : ''; |
| 30 |
} |
| 31 |
$default = current_user_can( 'manage_options' ); |
| 32 |
return $filter !== '' ? apply_filters( $filter, $default ) : $default; |
| 33 |
} |
| 34 |
|
| 35 |
public function rest_api_init() { |
| 36 |
if ( !$this->can_setup() ) { |
| 37 |
return; |
| 38 |
} |
| 39 |
$permission = function () { |
| 40 |
return $this->can_setup(); |
| 41 |
}; |
| 42 |
register_rest_route( $this->namespace, '/empty_request/', [ |
| 43 |
'methods' => 'POST', |
| 44 |
'permission_callback' => $permission, |
| 45 |
'callback' => [ $this, 'empty_request' ] |
| 46 |
] ); |
| 47 |
register_rest_route( $this->namespace, '/file_operation/', [ |
| 48 |
'methods' => 'POST', |
| 49 |
'permission_callback' => $permission, |
| 50 |
'callback' => [ $this, 'file_operation' ] |
| 51 |
] ); |
| 52 |
register_rest_route( $this->namespace, '/sql_request/', [ |
| 53 |
'methods' => 'POST', |
| 54 |
'permission_callback' => $permission, |
| 55 |
'callback' => [ $this, 'sql_request' ] |
| 56 |
] ); |
| 57 |
register_rest_route( $this->namespace, '/error_logs/', [ |
| 58 |
'methods' => 'POST', |
| 59 |
'permission_callback' => $permission, |
| 60 |
'callback' => [ $this, 'rest_error_logs' ] |
| 61 |
] ); |
| 62 |
register_rest_route( $this->namespace, '/all_settings/', [ |
| 63 |
'methods' => 'POST', |
| 64 |
'permission_callback' => $permission, |
| 65 |
'callback' => [ $this, 'rest_all_settings' ] |
| 66 |
] ); |
| 67 |
register_rest_route( $this->namespace, '/update_option/', [ |
| 68 |
'methods' => 'POST', |
| 69 |
'permission_callback' => $permission, |
| 70 |
'callback' => [ $this, 'rest_update_option' ] |
| 71 |
] ); |
| 72 |
register_rest_route( $this->namespace, '/installed_plugins/', [ |
| 73 |
'methods' => 'POST', |
| 74 |
'permission_callback' => $permission, |
| 75 |
'callback' => [ $this, 'rest_installed_plugins' ] |
| 76 |
] ); |
| 77 |
// The analysis needs PHP for one reason: $mwai is a PHP global, so the AI |
| 78 |
// call cannot be made from the dashboard's JavaScript. Everything it |
| 79 |
// analyses is gathered in the browser and posted here. |
| 80 |
register_rest_route( $this->namespace, '/analysis_status/', [ |
| 81 |
'methods' => 'POST', |
| 82 |
'permission_callback' => $permission, |
| 83 |
'callback' => [ $this, 'rest_analysis_status' ] |
| 84 |
] ); |
| 85 |
register_rest_route( $this->namespace, '/analysis_run/', [ |
| 86 |
'methods' => 'POST', |
| 87 |
'permission_callback' => $permission, |
| 88 |
'callback' => [ $this, 'rest_analysis_run' ] |
| 89 |
] ); |
| 90 |
register_rest_route( $this->namespace, '/analysis_forget/', [ |
| 91 |
'methods' => 'POST', |
| 92 |
'permission_callback' => $permission, |
| 93 |
'callback' => [ $this, 'rest_analysis_forget' ] |
| 94 |
] ); |
| 95 |
} |
| 96 |
|
| 97 |
/** |
| 98 |
* Throw away the stored analysis and the consent that went with it. |
| 99 |
* |
| 100 |
* The analysis writes a verdict about this site into the options table and |
| 101 |
* keeps it. That is what makes it survive a reload, but it also means a |
| 102 |
* description of your server's weaknesses, written by a third-party model, |
| 103 |
* sits there indefinitely with nothing to remove it. Somebody should be able |
| 104 |
* to take it back, and clearing the consent means the panel explaining what |
| 105 |
* gets sent is shown again before anything is sent a second time. |
| 106 |
*/ |
| 107 |
public function rest_analysis_forget() { |
| 108 |
delete_option( 'meowapps_analysis_last' ); |
| 109 |
delete_option( 'meowapps_analysis_consented' ); |
| 110 |
return new WP_REST_Response( [ 'success' => true ], 200 ); |
| 111 |
} |
| 112 |
|
| 113 |
/** |
| 114 |
* Whether an analysis can be run, and the last one if there is one. |
| 115 |
* |
| 116 |
* Three states matter and they are not the same: AI Engine absent, AI Engine |
| 117 |
* present but with no API key configured, and ready. Telling the second from |
| 118 |
* the first is what lets the dashboard say "finish setting it up" rather than |
| 119 |
* "install this", which would be wrong and mildly insulting. |
| 120 |
*/ |
| 121 |
public function rest_analysis_status() { |
| 122 |
global $mwai; |
| 123 |
$installed = !empty( $mwai ); |
| 124 |
$ready = $installed && method_exists( $mwai, 'hasAI' ) && $mwai->hasAI(); |
| 125 |
return new WP_REST_Response( [ 'success' => true, 'data' => [ |
| 126 |
'installed' => $installed, |
| 127 |
'ready' => $ready, |
| 128 |
'consented' => (bool) get_option( 'meowapps_analysis_consented', false ), |
| 129 |
'last' => get_option( 'meowapps_analysis_last', null ), |
| 130 |
] ], 200 ); |
| 131 |
} |
| 132 |
|
| 133 |
public function rest_analysis_run( $request ) { |
| 134 |
global $mwai; |
| 135 |
if ( empty( $mwai ) || !method_exists( $mwai, 'simpleJsonQuery' ) ) { |
| 136 |
return new WP_REST_Response( [ 'success' => false, |
| 137 |
'message' => 'AI Engine is not available on this site.' ], 200 ); |
| 138 |
} |
| 139 |
if ( !method_exists( $mwai, 'hasAI' ) || !$mwai->hasAI() ) { |
| 140 |
return new WP_REST_Response( [ 'success' => false, |
| 141 |
'message' => 'AI Engine has no AI environment configured yet.' ], 200 ); |
| 142 |
} |
| 143 |
|
| 144 |
$params = $request->get_json_params(); |
| 145 |
$facts = isset( $params['facts'] ) ? $params['facts'] : []; |
| 146 |
|
| 147 |
// Consent is recorded when a run is actually asked for, so the panel is |
| 148 |
// shown once rather than on every visit. |
| 149 |
update_option( 'meowapps_analysis_consented', '1' ); |
| 150 |
|
| 151 |
try { |
| 152 |
$reply = $mwai->simpleJsonQuery( $this->analysis_prompt( $facts ) ); |
| 153 |
} |
| 154 |
catch ( Exception $e ) { |
| 155 |
return new WP_REST_Response( [ 'success' => false, 'message' => $e->getMessage() ], 200 ); |
| 156 |
} |
| 157 |
|
| 158 |
$verdict = is_string( $reply ) ? json_decode( $reply, true ) : $reply; |
| 159 |
if ( empty( $verdict ) || !is_array( $verdict ) ) { |
| 160 |
return new WP_REST_Response( [ 'success' => false, |
| 161 |
'message' => 'The AI reply could not be read as JSON.' ], 200 ); |
| 162 |
} |
| 163 |
|
| 164 |
$verdict['ranAt'] = current_time( 'mysql' ); |
| 165 |
update_option( 'meowapps_analysis_last', $verdict ); |
| 166 |
|
| 167 |
return new WP_REST_Response( [ 'success' => true, 'data' => $verdict ], 200 ); |
| 168 |
} |
| 169 |
|
| 170 |
/** |
| 171 |
* Written for the person who owns the site, not for a developer: somebody who |
| 172 |
* installed a plugin, not somebody who knows what max_execution_time is. |
| 173 |
* |
| 174 |
* Meow Apps plugins may be named as a remedy, but only where one genuinely |
| 175 |
* fixes the finding. An analysis that recommends its own author's plugins for |
| 176 |
* everything is an advert, and would be read as one. |
| 177 |
*/ |
| 178 |
private function analysis_prompt( $facts ) { |
| 179 |
$json = wp_json_encode( $facts, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES ); |
| 180 |
return "You are reviewing a WordPress site's health for the person who owns it.\n" |
| 181 |
. "They are not a developer: explain what something means and why it matters before saying " |
| 182 |
. "what to do, and never assume they know what a PHP directive is.\n\n" |
| 183 |
. "Here is what was measured on their site:\n\n$json\n\n" |
| 184 |
. "Reply with JSON in exactly this shape:\n" |
| 185 |
. "{\n" |
| 186 |
. ' "areas": [ { "area": "Speed|Environment|Errors", "rating": 1-5, ' |
| 187 |
. '"label": "a two or three word verdict", "summary": "one plain sentence" } ],' . "\n" |
| 188 |
. ' "findings": [ { "area": "Speed|Environment|Errors", "severity": "high|medium|low", ' |
| 189 |
. '"title": "the recommendation itself, plain, under 60 characters", ' |
| 190 |
. '"detail": "at most two short sentences on what it means and why it matters", ' |
| 191 |
. '"action": "one sentence saying what to do", ' |
| 192 |
. '"plugin": "meow plugin slug or null" } ],' . "\n" |
| 193 |
. ' "conclusion": "two short sentences tying it together"' . "\n" |
| 194 |
. "}\n\n" |
| 195 |
. "Rules:\n" |
| 196 |
. "- Rate each of the three areas from 1 (bad) to 5 (good). Do not invent an overall score.\n" |
| 197 |
. "- Only report findings genuinely worth acting on. An empty findings list is a perfectly " |
| 198 |
. "good answer for a healthy site. Do not manufacture problems.\n" |
| 199 |
. "- Order findings by how much they matter, worst first.\n" |
| 200 |
. "- Be brief. The reader sees the titles first and opens the ones they care about, so a " |
| 201 |
. "title has to work on its own and the detail must not repeat it. No preamble, no restating " |
| 202 |
. "the question, no filler.\n" |
| 203 |
. "- Set \"plugin\" to one of these Meow Apps slugs ONLY when that plugin genuinely fixes the " |
| 204 |
. "finding, otherwise null: ai-engine, code-engine, contact-form-block, database-cleaner, " |
| 205 |
. "media-cleaner, media-file-renamer, meow-gallery, meow-lightbox, meow-mailer, seo-engine, " |
| 206 |
. "social-engine, wp-retina-2x, wplr-sync.\n" |
| 207 |
. "- If an error in the log comes from a specific plugin, say which one.\n" |
| 208 |
. "- Write in the language of this site: " . get_bloginfo( 'language' ) . "."; |
| 209 |
} |
| 210 |
|
| 211 |
public function file_rand( $filesize ) { |
| 212 |
// Write the benchmark file inside a dedicated subfolder of the uploads |
| 213 |
// directory (created on demand), then remove it. wp.org forbids writing to |
| 214 |
// the plugin folder or the uploads root, only a sanctioned subfolder. |
| 215 |
$upload = wp_upload_dir(); |
| 216 |
if ( !empty( $upload['error'] ) || empty( $upload['basedir'] ) ) { return; } |
| 217 |
$dir = trailingslashit( $upload['basedir'] ) . 'meowapps'; |
| 218 |
if ( !wp_mkdir_p( $dir ) ) { return; } |
| 219 |
$path = trailingslashit( $dir ) . 'speedtest-' . wp_generate_password( 12, false ) . '.tmp'; |
| 220 |
$fh = @fopen( $path, 'wb' ); |
| 221 |
if ( $fh === false ) { return; } |
| 222 |
fseek( $fh, $filesize - 1, SEEK_CUR ); |
| 223 |
fwrite( $fh, 'a' ); |
| 224 |
fclose( $fh ); |
| 225 |
@unlink( $path ); |
| 226 |
} |
| 227 |
|
| 228 |
public function empty_request() { |
| 229 |
return new WP_REST_Response( [ 'success' => true ], 200 ); |
| 230 |
} |
| 231 |
|
| 232 |
public function file_operation() { |
| 233 |
$this->file_rand( 1024 * 10 ); |
| 234 |
return new WP_REST_Response( [ 'success' => true ], 200 ); |
| 235 |
} |
| 236 |
|
| 237 |
public function sql_request() { |
| 238 |
global $wpdb; |
| 239 |
$count = $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->posts}" ); |
| 240 |
return new WP_REST_Response( [ 'success' => true, 'data' => $count ], 200 ); |
| 241 |
} |
| 242 |
|
| 243 |
// List all the options with their default values. |
| 244 |
public function list_options() { |
| 245 |
return [ |
| 246 |
'meowapps_hide_meowapps' => false, |
| 247 |
'force_sslverify' => false |
| 248 |
]; |
| 249 |
} |
| 250 |
|
| 251 |
public function get_all_options() { |
| 252 |
$options = $this->list_options(); |
| 253 |
$current_options = []; |
| 254 |
foreach ( $options as $option => $default ) { |
| 255 |
$current_options[$option] = get_option( $option, $default ); |
| 256 |
} |
| 257 |
return $current_options; |
| 258 |
} |
| 259 |
|
| 260 |
public function rest_all_settings() { |
| 261 |
return new WP_REST_Response( [ 'success' => true, 'data' => $this->get_all_options() ], 200 ); |
| 262 |
} |
| 263 |
|
| 264 |
public function rest_installed_plugins() { |
| 265 |
if ( !function_exists( 'get_plugins' ) ) { |
| 266 |
require_once ABSPATH . 'wp-admin/includes/plugin.php'; |
| 267 |
} |
| 268 |
$all_plugins = get_plugins(); |
| 269 |
$result = []; |
| 270 |
foreach ( $all_plugins as $plugin_file => $plugin_data ) { |
| 271 |
// Plugin file looks like "ai-engine/ai-engine.php", the slug is the |
| 272 |
// first path segment. Some plugins live at the root (single file), |
| 273 |
// those we just skip; we only care about Meow Apps directories anyway. |
| 274 |
$parts = explode( '/', $plugin_file ); |
| 275 |
if ( count( $parts ) < 2 ) { |
| 276 |
continue; |
| 277 |
} |
| 278 |
$slug = $parts[0]; |
| 279 |
$result[ $slug ] = is_plugin_active( $plugin_file ) ? 'active' : 'inactive'; |
| 280 |
} |
| 281 |
return new WP_REST_Response( [ 'success' => true, 'data' => $result ], 200 ); |
| 282 |
} |
| 283 |
|
| 284 |
public function rest_update_option( $request ) { |
| 285 |
$params = $request->get_json_params(); |
| 286 |
try { |
| 287 |
$name = $params['name']; |
| 288 |
$options = $this->list_options(); |
| 289 |
if ( !array_key_exists( $name, $options ) ) { |
| 290 |
return new WP_REST_Response( [ 'success' => false, 'message' => 'This option does not exist.' ], 200 ); |
| 291 |
} |
| 292 |
$value = is_bool( $params['value'] ) ? ( $params['value'] ? '1' : '' ) : $params['value']; |
| 293 |
$success = update_option( $name, $value ); |
| 294 |
if ( !$success ) { |
| 295 |
return new WP_REST_Response( [ 'success' => false, 'message' => 'Could not update option.' ], 200 ); |
| 296 |
} |
| 297 |
return new WP_REST_Response( [ 'success' => true, 'data' => $value ], 200 ); |
| 298 |
} |
| 299 |
catch ( Exception $e ) { |
| 300 |
return new WP_REST_Response( [ 'success' => false, 'message' => $e->getMessage() ], 500 ); |
| 301 |
} |
| 302 |
} |
| 303 |
|
| 304 |
public function rest_error_logs( $request ) { |
| 305 |
return new WP_REST_Response( [ 'success' => true, 'data' => MeowKit_MWCODE_Helpers::php_error_logs() ], 200 ); |
| 306 |
} |
| 307 |
|
| 308 |
} |
| 309 |
|
