elasticpress / includes / classes / REST / Token.php

Token.php in ElasticPress 5.3.5, at includes/classes/REST/Token.php

123 lines 2.6 KB

Raw Download Zip

1	<?php
2	/**
3	* Token REST API Controller
4	*
5	* @since 5.0.0
6	* @package elasticpress
7	*/
8
9	namespace ElasticPress\REST;
10
11	use ElasticPress\Elasticsearch;
12
13	/**
14	* Token API controller class.
15	*
16	* @since 5.0.0
17	* @package elasticpress
18	*/
19	class Token {
20
21	/**
22	* Register routes.
23	*
24	* @return void
25	*/
26	public function register_routes() {
27	register_rest_route(
28	'elasticpress/v1',
29	'token',
30	[
31	[
32	'callback' => [ $this, 'get_token' ],
33	'permission_callback' => [ $this, 'check_permission' ],
34	'methods' => 'GET',
35	],
36	[
37	'callback' => [ $this, 'refresh_token' ],
38	'permission_callback' => [ $this, 'check_permission' ],
39	'methods' => 'POST',
40	],
41	]
42	);
43	}
44
45	/**
46	* Checks if the token API can be used.
47	*
48	* @return boolean
49	*/
50	public function check_permission() {
51	/**
52	* Filters the capability required to use the token API.
53	*
54	* @since 4.5.0
55	* @hook ep_token_capability
56	* @param {string} $capability Required capability.
57	*/
58	$capability = apply_filters( 'ep_token_capability', 'edit_others_shop_orders' );
59
60	return current_user_can( $capability );
61	}
62
63	/**
64	* Get a temporary token.
65	*
66	* @param \WP_REST_Request $request Full details about the request.
67	* @return string\|false
68	*/
69	public function get_token( \WP_REST_Request $request ) {
70	$user_id = get_current_user_id();
71
72	$credentials = get_user_meta( $user_id, 'ep_token', true );
73
74	if ( $credentials ) {
75	return $credentials;
76	}
77
78	return $this->refresh_token( $request );
79	}
80
81	/**
82	* Refresh the temporary token.
83	*
84	* @return string\|false
85	*/
86	public function refresh_token() {
87	$user_id = get_current_user_id();
88
89	$endpoint = $this->get_token_endpoint();
90	$response = Elasticsearch::factory()->remote_request( $endpoint, [ 'method' => 'POST' ] );
91
92	if ( is_wp_error( $response ) \|\| 200 !== wp_remote_retrieve_response_code( $response ) ) {
93	return false;
94	}
95
96	$response = wp_remote_retrieve_body( $response );
97	$response = json_decode( $response );
98
99	$credentials = base64_encode( "$response->username:$response->clear_password" ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
100
101	update_user_meta( $user_id, 'ep_token', $credentials );
102
103	return $credentials;
104	}
105
106	/**
107	* Get the endpoint for temporary tokens.
108	*
109	* @return string
110	*/
111	protected function get_token_endpoint() {
112	/**
113	* Filters the temporary token API endpoint.
114	*
115	* @since 4.5.0
116	* @hook ep_token_endpoint
117	* @param {string} $endpoint Endpoint path.
118	* @returns {string} Token API endpoint.
119	*/
120	return apply_filters( 'ep_token_endpoint', 'api/v1/token' );
121	}
122	}
123