content-control / classes / Controllers / PostTypes.php

PostTypes.php in Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More 2.6.2, at classes/Controllers/PostTypes.php

275 lines 8.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Post type setup.
4	*
5	* @copyright (c) 2023, Code Atlantic LLC.
6	* @package ContentControl
7	*/
8
9	namespace ContentControl\Controllers;
10
11	use ContentControl\Base\Controller;
12
13	/**
14	* Post type controller.
15	*/
16	class PostTypes extends Controller {
17
18	/**
19	* Init controller.
20	*
21	* @return void
22	*/
23	public function init() {
24	add_action( 'init', [ $this, 'register_post_type' ] );
25	add_action( 'init', [ $this, 'register_rest_fields' ] );
26	add_action( 'save_post_cc_restriction', [ $this, 'save_post' ], 10, 3 );
27	add_filter( 'rest_pre_dispatch', [ $this, 'rest_pre_dispatch' ], 10, 3 );
28	add_filter( 'content_control/sanitize_restriction_settings', [ $this, 'sanitize_restriction_settings' ], 10, 2 );
29	add_filter( 'content_control/validate_restriction_settings', [ $this, 'validate_restriction_settings' ], 10, 2 );
30	}
31
32	/**
33	* Register `restriction` post type.
34	*
35	* @return void
36	*/
37	public function register_post_type() {
38	/**
39	* Post Type: Restrictions.
40	*/
41	$labels = [
42	'name' => __( 'Restrictions', 'content-control' ),
43	'singular_name' => __( 'Restriction', 'content-control' ),
44	];
45
46	$args = [
47	'label' => __( 'Restrictions', 'content-control' ),
48	'labels' => $labels,
49	'description' => '',
50	'public' => false,
51	'publicly_queryable' => false,
52	'show_ui' => false,
53	'show_in_rest' => true,
54	'rest_base' => 'restrictions',
55	'rest_namespace' => 'content-control/v2',
56	'has_archive' => false,
57	'show_in_menu' => false,
58	'show_in_nav_menus' => false,
59	'delete_with_user' => false,
60	'exclude_from_search' => true,
61	'map_meta_cap' => true,
62	'hierarchical' => false,
63	'can_export' => true,
64	'rewrite' => false,
65	'query_var' => false,
66	'supports' => [
67	'title',
68	'excerpt',
69	// 'editor',
70	],
71	'show_in_graphql' => false,
72	'capabilities' => [
73	'create_posts' => $this->container->get_permission( 'edit_restrictions' ),
74	'edit_posts' => $this->container->get_permission( 'edit_restrictions' ),
75	'delete_posts' => $this->container->get_permission( 'edit_restrictions' ),
76	],
77	];
78
79	register_post_type( 'cc_restriction', $args );
80	}
81
82	/**
83	* Registers custom REST API fields for cc_restrictions post type.
84	*
85	* @return void
86	*/
87	public function register_rest_fields() {
88	register_rest_field( 'cc_restriction', 'settings', [
89	'get_callback' => function ( $obj, $field, $request ) {
90	$settings = get_post_meta( $obj['id'], 'restriction_settings', true );
91
92	// Backfill from content if empty.
93	if ( empty( $settings['customMessage'] ) ) {
94	$settings['customMessage'] = get_post_field( 'post_content', $obj['id'], 'raw' );
95	}
96
97	if ( ! empty( $settings['customMessage'] ) ) {
98	// Change output based on context.
99	$settings['customMessage'] = 'edit' === $request->get_param( 'context' ) ?
100	sanitize_post_field( 'post_content', $settings['customMessage'], $obj['id'], 'raw' ) :
101	sanitize_post_field( 'post_content', $settings['customMessage'], $obj['id'], 'display' );
102	}
103
104	return $settings;
105	},
106	'update_callback' => function ( $value, $obj ) {
107	$custom_message = ! empty( $value['customMessage'] ) ? $value['customMessage'] : '';
108
109	// Save custom message to restriction content for now.
110	wp_update_post( [
111	'ID' => $obj->ID,
112	'post_content' => $custom_message,
113	] );
114
115	// Update the field/meta value.
116	update_post_meta( $obj->ID, 'restriction_settings', $value );
117	},
118	'schema' => [
119	'type' => 'object',
120	'arg_options' => [
121	'sanitize_callback' => function ( $settings, $request ) {
122	/**
123	* Sanitize the restriction settings.
124	*
125	* @param array<string,mixed> $settings The settings to sanitize.
126	* @param int $id The restriction ID.
127	* @param \WP_REST_Request $request The request object.
128	*
129	* @return array<string,mixed> The sanitized settings.
130	*/
131	return apply_filters( 'content_control/sanitize_restriction_settings', $settings, $request->get_param( 'id' ), $request );
132	},
133	'validate_callback' => function ( $settings, $request ) {
134	/**
135	* Validate the restriction settings.
136	*
137	* @param array<string,mixed> $settings The settings to validate.
138	* @param int $id The restriction ID.
139	* @param \WP_REST_Request $request The request object.
140	*
141	* @return bool\|\WP_Error True if valid, WP_Error if not.
142	*/
143	return apply_filters( 'content_control/validate_restriction_settings', $settings, $request->get_param( 'id' ), $request );
144	},
145	],
146	],
147	'permission_callback' => function () {
148	return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
149	},
150	] );
151
152	register_rest_field( 'cc_restriction', 'priority', [
153	'get_callback' => function ( $obj ) {
154	return (int) get_post_field( 'menu_order', $obj['id'], 'raw' );
155	},
156	'update_callback' => function ( $value, $obj ) {
157	wp_update_post( [
158	'ID' => $obj->ID,
159	'menu_order' => $value,
160	] );
161	},
162	'permission_callback' => function () {
163	return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
164	},
165	'schema' => [
166	'type' => 'integer',
167	'arg_options' => [
168	'sanitize_callback' => function ( $priority ) {
169	return absint( $priority );
170	},
171	'validate_callback' => function ( $priority ) {
172	return is_int( $priority );
173	},
174	],
175	],
176	] );
177
178	register_rest_field( 'cc_restriction', 'data_version', [
179	'get_callback' => function ( $obj ) {
180	return get_post_meta( $obj['id'], 'data_version', true );
181	},
182	'update_callback' => function ( $value, $obj ) {
183	// Update the field/meta value.
184	update_post_meta( $obj->ID, 'data_version', $value );
185	},
186	'permission_callback' => function () {
187	return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
188	},
189	] );
190	}
191
192	/**
193	* Sanitize restriction settings.
194	*
195	* @param array<string,mixed> $settings The settings to sanitize.
196	* @param int $id The restriction ID.
197	*
198	* @return array<string,mixed> The sanitized settings.
199	*/
200	public function sanitize_restriction_settings( $settings, $id ) {
201
202	// Sanitize custom message.
203	if ( ! empty( $settings['customMessage'] ) ) {
204	$settings['customMessage'] = sanitize_post_field( 'post_content', $settings['customMessage'], $id, 'db' );
205	}
206
207	return $settings;
208	}
209
210	/**
211	* Validate restriction settings.
212	*
213	* @param array<string,mixed> $settings The settings to validate.
214	* @param int $id The restriction ID.
215	*
216	* @return bool\|\WP_Error True if valid, WP_Error if not.
217	*/
218	public function validate_restriction_settings( $settings, $id ) {
219	// TODO Validate all known settings by type.
220	return true;
221	}
222
223
224	/**
225	* Add data version meta to new restrictions.
226	*
227	* @param int $post_id Post ID.
228	* @param \WP_Post $post Post object.
229	* @param bool $update Whether this is an existing post being updated or not.
230	*
231	* @return void
232	*/
233	public function save_post( $post_id, $post, $update ) {
234	if ( $update ) {
235	return;
236	}
237
238	add_post_meta( $post_id, 'data_version', 1 );
239	}
240
241	/**
242	* Prevent access to restrictions endpoint.
243	*
244	* @param mixed $result Response to replace the requested version with.
245	* @param \WP_REST_Server $server Server instance.
246	* @param \WP_REST_Request<array<string,mixed>> $request Request used to generate the response.
247	* @return mixed
248	*/
249	public function rest_pre_dispatch( $result, $server, $request ) {
250	// Get the route being requested.
251	$route = $request->get_route();
252
253	// Only proceed if we're creating a user.
254	if ( false === strpos( $route, '/content-control/v2/restrictions' ) ) {
255	return $result;
256	}
257
258	$current_user_can = current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
259
260	// Prevent discovery of the endpoints data from unauthorized users.
261	if ( ! $current_user_can ) {
262	return new \WP_Error(
263	'rest_forbidden',
264	__( 'Access to this endpoint requires authorization.', 'content-control' ),
265	[
266	'status' => rest_authorization_required_code(),
267	]
268	);
269	}
270
271	// Return data to the client to parse.
272	return $result;
273	}
274	}
275