content-control / vendor-prefixed / trustedlogin / client / src / SiteAccess.php

SiteAccess.php in Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More 2.0.2, at vendor-prefixed/trustedlogin/client/src/SiteAccess.php

223 lines 5.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Class SiteAccess
4	*
5	* @package ContentControl\Vendor\TrustedLogin\Client
6	*
7	* @copyright 2021 Katz Web Services, Inc.
8	*
9	* @license GPL-2.0-or-later
10	* Modified by code-atlantic on 18-September-2023 using Strauss.
11	* @see https://github.com/BrianHenryIE/strauss
12	*/
13
14	namespace ContentControl\Vendor\TrustedLogin;
15
16	use \WP_Error;
17
18	class SiteAccess {
19
20	/**
21	* @var Config $config
22	*/
23	private $config;
24
25	/**
26	* @var Logging $logging
27	*/
28	private $logging;
29
30	/**
31	* @var string[] Valid action types to use when syncing to TrustedLogin.
32	*/
33	private static $sync_actions = array(
34	'create',
35	'extend'
36	);
37
38	/**
39	*
40	*/
41	public function __construct( Config $config, Logging $logging ) {
42	$this->config = $config;
43	$this->logging = $logging;
44	}
45
46	/**
47	* Handles the syncing of newly generated support access to the TrustedLogin servers.
48	*
49	* @param string $secret_id The unique identifier for this TrustedLogin authorization. {@see Endpoint::generate_secret_id}
50	* @param string $site_identifier_hash The unique identifier for the WP_User created {@see Encryption::get_random_hash()}
51	* @param string $action The type of sync this is. Options can be 'create', 'extend'.
52	*
53	* @return true\|WP_Error True if successfully created secret on TrustedLogin servers; WP_Error if failed.
54	*/
55	public function sync_secret( $secret_id, $site_identifier_hash, $action = 'create' ) {
56
57	$logging = new Logging( $this->config );
58	$remote = new Remote( $this->config, $logging );
59	$encryption = new Encryption( $this->config, $remote, $logging );
60
61	if ( ! in_array( $action, self::$sync_actions, true ) ) {
62	return new \WP_Error( 'param_error', __( 'Unexpected action value', 'trustedlogin' ) );
63	}
64
65	$access_key = $this->get_access_key();
66
67	if ( is_wp_error( $access_key ) ) {
68	return $access_key;
69	}
70
71	// Ping SaaS and get back tokens.
72	$envelope = new Envelope( $this->config, $encryption );
73
74	$sealed_envelope = $envelope->get( $secret_id, $site_identifier_hash, $access_key );
75
76	if ( is_wp_error( $sealed_envelope ) ) {
77	return $sealed_envelope;
78	}
79
80	$api_response = $remote->send( 'sites', $sealed_envelope, 'POST' );
81
82	if ( is_wp_error( $api_response ) ) {
83	return $api_response;
84	}
85
86	$response_json = $remote->handle_response( $api_response, array( 'success' ) );
87
88	if ( is_wp_error( $response_json ) ) {
89	return $response_json;
90	}
91
92	if ( empty( $response_json['success'] ) ) {
93	return new \WP_Error( 'sync_error', __( 'Could not sync to TrustedLogin server', 'trustedlogin' ) );
94	}
95
96	do_action( 'trustedlogin/' . $this->config->ns() . '/secret/synced', array(
97	'url' => get_site_url(),
98	'action' => $action,
99	) );
100
101	return true;
102	}
103
104	/**
105	* Gets the shareable access key
106	*
107	* - For licensed plugins or themes, a hashed customer's license key is the access key.
108	* - For plugins or themes without license keys, the accessKey is generated for the site.
109	*
110	* @uses SiteAccess::get_license_key()
111	* @uses SiteAccess::generate_access_key()
112	*
113	* @since 1.0.0
114	*
115	* @return string\|WP_Error $access_key, if exists. Either a hashed license key or a generated hash. If error occurs, returns null.
116	*/
117	public function get_access_key() {
118
119	// If there's a license, return a hash of the license.
120	$license_key = $this->get_license_key( true );
121
122	if ( $license_key && ! is_wp_error( $license_key ) ) {
123	return $license_key;
124	}
125
126	return $this->generate_access_key();
127	}
128
129	/**
130	* Get the license key for the current user.
131	*
132	* @since 1.0.0
133	*
134	* @param bool $hashed Should the value be hashed using SHA256?
135	*
136	* @return string\|null\|WP_Error License key (hashed if $hashed is true) or null if not found. Returns WP_Error if error occurs.
137	*/
138	public function get_license_key( $hashed = false ) {
139
140	// If no license key is provided
141	$license_key_config = $this->config->get_setting( 'auth/license_key', null );
142
143	/**
144	* Filter: Allow for over-riding the 'accessKey' sent to SaaS platform.
145	*
146	* @since 1.0.0
147	* @since 1.4.0 Fixed typo in filter name.
148	*
149	* @param string\|null $license_key
150	*/
151	$license_key = apply_filters( 'trustedlogin/' . $this->config->ns() . '/license_key', $license_key_config );
152
153	if ( empty( $license_key ) ) {
154	return null;
155	}
156
157	if ( ! is_string( $license_key ) ) {
158
159	$this->logging->log( '', '', 'error', array(
160	'$license from Config' => $license_key_config,
161	'$license after filter: ' => $license_key,
162	) );
163
164	return new \WP_Error( 'invalid_license_key', 'License key was not a string.' );
165	}
166
167	if ( $hashed && $license_key ) {
168	return hash( 'sha256', $license_key );
169	}
170
171	return $license_key;
172	}
173
174	/**
175	* Generates an accessKey that can be copy-pasted to support to give them access via TrustedLogin
176	*
177	* Access Keys can only be used by authenticated support agents to request logged access to a site via their TrustedLogin plugin.
178	*
179	* @since 1.0.0
180	*
181	* @return string\|WP_Error Access Key prepended with TL, or something went wrong.
182	*/
183	private function generate_access_key() {
184	return Encryption::hash( get_current_blog_id() . get_site_url() . $this->config->get_setting( 'auth/api_key' ), 32 );
185	}
186
187	/**
188	* Revoke a site in TrustedLogin
189	*
190	* @param string $secret_id ID of site secret identifier to be removed from TrustedLogin
191	* @param Remote $remote
192	*
193	* @return true\|\WP_Error Was the sync to TrustedLogin successful
194	*/
195	public function revoke( $secret_id, Remote $remote ) {
196
197	if ( ! $this->config->meets_ssl_requirement() ) {
198	$this->logging->log( 'Not notifying TrustedLogin about revoked site due to SSL requirements.', __METHOD__, 'info' );
199
200	return true;
201	}
202
203	$body = array(
204	'publicKey' => $this->config->get_setting( 'auth/api_key' ),
205	);
206
207	$api_response = $remote->send( 'sites/' . $secret_id, $body, 'DELETE' );
208
209	if ( is_wp_error( $api_response ) ) {
210	return $api_response;
211	}
212
213	$response = $remote->handle_response( $api_response );
214
215	if ( is_wp_error( $response ) ) {
216	return $response;
217	}
218
219	return true;
220	}
221
222	}
223