faustwp / includes / rest / callbacks.php

callbacks.php in Faust.js 0.7.1, at includes/rest/callbacks.php

189 lines 5.6 KB

Raw Download Zip

1	<?php
2	/**
3	* REST related callbacks.
4	*
5	* @package FaustWP
6	*/
7
8	namespace WPE\FaustWP\REST;
9
10	use function WPE\FaustWP\Auth\{
11	get_user_from_access_token,
12	get_user_from_refresh_token,
13	get_user_from_authorization_code,
14	generate_refresh_token,
15	generate_access_token
16	};
17	use function WPE\FaustWP\Settings\get_secret_key;
18
19	if ( ! defined( 'ABSPATH' ) ) {
20	exit;
21	}
22
23	add_filter( 'determine_current_user', __NAMESPACE__ . '\\rest_determine_current_user', 20 );
24	/**
25	* Callback for WordPress 'determine_current_user' filter.
26	*
27	* Determine the current user based on authentication token from http header.
28	* Runs during GraphQL, REST and plain requests.
29	*
30	* @link https://developer.wordpress.org/reference/hooks/determine_current_user/
31	*
32	* @param int\|bool $user_id User ID if one has been determined, false otherwise.
33	*
34	* @return int\|bool User ID if one has been determined, false otherwise.
35	*/
36	function rest_determine_current_user( $user_id ) {
37	if ( $user_id ) {
38	return $user_id;
39	}
40
41	if ( ! isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
42	return $user_id;
43	}
44
45	$parts = explode( ' ', trim( $_SERVER['HTTP_AUTHORIZATION'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
46	if ( count( $parts ) < 2 ) {
47	return $user_id;
48	}
49
50	$wp_user = get_user_from_access_token( $parts[1] );
51	if ( $wp_user ) {
52	$user_id = $wp_user->ID;
53	}
54
55	return $user_id;
56	}
57
58	add_action( 'rest_api_init', __NAMESPACE__ . '\\register_rest_routes' );
59	/**
60	* Callback for WordPress 'rest_api_init' action.
61	*
62	* Register the POST /faustwp/v1/authorize endpoint.
63	*
64	* @link https://developer.wordpress.org/reference/functions/register_rest_route/
65	* @link https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/
66	*
67	* @return void
68	*/
69	function register_rest_routes() {
70	register_rest_route(
71	'faustwp/v1',
72	'/authorize',
73	array(
74	'methods' => 'POST',
75	'callback' => __NAMESPACE__ . '\\handle_rest_authorize_callback',
76	'permission_callback' => __NAMESPACE__ . '\\rest_authorize_permission_callback',
77	)
78	);
79
80	/**
81	* Faust.js packages now use `faustwp/v1/authorize`.
82	*
83	* @deprecated
84	*/
85	register_rest_route(
86	'wpac/v1',
87	'/authorize',
88	array(
89	'methods' => 'POST',
90	'callback' => __NAMESPACE__ . '\\handle_rest_authorize_callback',
91	'permission_callback' => __NAMESPACE__ . '\\wpac_authorize_permission_callback',
92	)
93	);
94	}
95
96	/**
97	* Callback for WordPress register_rest_route() 'callback' parameter.
98	*
99	* Handle POST /faustwp/v1/authorize response.
100	*
101	* Use the 'code' (authorization code) parameter to generate a new access token.
102	*
103	* @link https://developer.wordpress.org/reference/functions/register_rest_route/
104	* @link https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/#endpoint-callback
105	*
106	* @param \WP_REST_Request $request Current WP_REST_Request object.
107	*
108	* @return mixed A WP_REST_Response, array, or WP_Error.
109	*/
110	function handle_rest_authorize_callback( \WP_REST_Request $request ) {
111	$code = trim( $request->get_param( 'code' ) );
112	$refresh_token = trim( $request->get_param( 'refreshToken' ) );
113
114	if ( ! $code && ! $refresh_token ) {
115	return new \WP_Error( 'invalid_request', 'Missing authorization code or refresh token.' );
116	}
117
118	if ( $refresh_token ) {
119	$user = get_user_from_refresh_token( $refresh_token );
120	} else {
121	$user = get_user_from_authorization_code( $code );
122	}
123
124	if ( ! $user ) {
125	return new \WP_Error( 'invalid_request', 'Invalid authorization code or refresh token.' );
126	}
127
128	$refresh_token_expiration = WEEK_IN_SECONDS * 2;
129	$access_token_expiration = MINUTE_IN_SECONDS * 5;
130
131	$access_token = generate_access_token( $user, $access_token_expiration );
132	$refresh_token = generate_refresh_token( $user, $refresh_token_expiration );
133
134	return array(
135	'accessToken' => $access_token,
136	'accessTokenExpiration' => ( time() + $access_token_expiration ),
137	'refreshToken' => $refresh_token,
138	'refreshTokenExpiration' => ( time() + $refresh_token_expiration ),
139	);
140	}
141
142	/**
143	* Callback to check permissions for requests to `faustwp/v1/authorize`.
144	*
145	* Authorized if the 'secret_key' settings value and http header 'x-faustwp-secret' match.
146	*
147	* @link https://developer.wordpress.org/reference/functions/register_rest_route/
148	* @link https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/#permissions-callback
149	*
150	* @param \WP_REST_Request $request The current WP_REST_Request object.
151	*
152	* @return bool True if current user can, false if else.
153	*/
154	function rest_authorize_permission_callback( \WP_REST_Request $request ) {
155	$secret_key = get_secret_key();
156	$header_key = $request->get_header( 'x-faustwp-secret' );
157
158	if ( $secret_key && $header_key ) {
159	return $secret_key === $header_key;
160	}
161
162	return false;
163	}
164
165	/**
166	* Callback to check permissions for requests to `wpac/v1/authorize`.
167	*
168	* Authorized if the 'secret_key' settings value and http header 'x-wpe-headless-secret' match.
169	*
170	* @deprecated The `wpac/v1/authorize` route is deprecated. Use `faustwp/v1/authorize` instead.
171	*
172	* @link https://developer.wordpress.org/reference/functions/register_rest_route/
173	* @link https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/#permissions-callback
174	*
175	* @param \WP_REST_Request $request The current WP_REST_Request object.
176	*
177	* @return bool True if current user can, false if else.
178	*/
179	function wpac_authorize_permission_callback( \WP_REST_Request $request ) {
180	$secret_key = get_secret_key();
181	$header_key = $request->get_header( 'x-wpe-headless-secret' );
182
183	if ( $secret_key && $header_key ) {
184	return $secret_key === $header_key;
185	}
186
187	return false;
188	}
189