elementor / vendor / elementor / elementor-mcp-composer / src / Admin / ConsentController.php

ConsentController.php in Elementor Website Builder – more than just a page builder 4.3.0, at vendor/elementor/elementor-mcp-composer/src/Admin/ConsentController.php

150 lines 3.1 KB

Raw Download Zip

1	<?php
2
3	namespace Elementor\MCP\Composer\Admin;
4
5	use WP_Error;
6	use WP_REST_Request;
7	use WP_REST_Response;
8
9	if ( ! defined( 'ABSPATH' ) ) {
10	exit; // Exit if accessed directly.
11	}
12
13	/**
14	* Handles consent persistence for the onboarding flow.
15	*/
16	class ConsentController extends RestController {
17	const META_KEY = 'elementor_mcp_consent';
18
19	/**
20	* Register the consent route.
21	*
22	* @return void
23	*/
24	public function register_routes(): void {
25	\register_rest_route(
26	$this->get_namespace(),
27	'/mcp-consent',
28	[
29	'methods' => 'POST',
30	'callback' => [ $this, 'save_consent' ],
31	'permission_callback' => [ $this, 'check_permission' ],
32	'args' => [
33	'allowed' => [
34	'required' => true,
35	'type' => 'boolean',
36	'sanitize_callback' => 'rest_sanitize_boolean',
37	],
38	],
39	]
40	);
41	}
42
43	/**
44	* Validate the caller for consent mutations.
45	*
46	* @param WP_REST_Request $request Request instance.
47	* @return true\|WP_Error
48	*/
49	public function check_permission( WP_REST_Request $request ) {
50	$nonce = $request->get_header( 'X-WP-Nonce' );
51
52	if ( ! $nonce \|\| ! \wp_verify_nonce( $nonce, 'wp_rest' ) ) {
53	return new WP_Error(
54	'invalid_nonce',
55	__( 'The request nonce is invalid.', 'elementor' ),
56	[ 'status' => 403 ]
57	);
58	}
59
60	if ( ! \current_user_can( 'manage_options' ) ) {
61	return new WP_Error(
62	'forbidden',
63	__( 'You are not allowed to update consent.', 'elementor' ),
64	[ 'status' => 403 ]
65	);
66	}
67
68	return true;
69	}
70
71	/**
72	* Persist the consent payload.
73	*
74	* @param WP_REST_Request $request Request instance.
75	* @return WP_REST_Response\|WP_Error
76	*/
77	public function save_consent( WP_REST_Request $request ) {
78	if ( ! McpSettingsController::is_enabled() ) {
79	return new WP_Error(
80	'mcp_disabled',
81	__( 'Elementor MCP is currently disabled for this site.', 'elementor' ),
82	[ 'status' => 403 ]
83	);
84	}
85
86	$user_id = \get_current_user_id();
87
88	if ( ! $user_id ) {
89	return new WP_Error(
90	'user_not_found',
91	__( 'User not found.', 'elementor' ),
92	[ 'status' => 403 ]
93	);
94	}
95
96	$consent_data = [
97	'allowed' => (bool) $request->get_param( 'allowed' ),
98	'timestamp' => time(),
99	];
100
101	$updated = \update_user_meta( $user_id, self::META_KEY, $consent_data );
102
103	if ( ! $updated && self::get_consent( $user_id ) !== $consent_data ) {
104	return new WP_Error(
105	'save_failed',
106	__( 'Failed to save consent.', 'elementor' ),
107	[ 'status' => 500 ]
108	);
109	}
110
111	return new WP_REST_Response(
112	[
113	'success' => true,
114	'data' => $consent_data,
115	],
116	200
117	);
118	}
119
120	/**
121	* Read the stored consent settings.
122	*
123	* @param int\|null $user_id User ID. Defaults to current user.
124	* @return array<string, bool\|int\|null>
125	*/
126	public static function get_consent( ?int $user_id = null ): array {
127	if ( null === $user_id ) {
128	$user_id = \get_current_user_id();
129	}
130
131	if ( ! $user_id ) {
132	return [
133	'allowed' => null,
134	'timestamp' => null,
135	];
136	}
137
138	$consent = \get_user_meta( $user_id, self::META_KEY, true );
139
140	if ( ! is_array( $consent ) ) {
141	return [
142	'allowed' => null,
143	'timestamp' => null,
144	];
145	}
146
147	return $consent;
148	}
149	}
150