| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentBoards\App\Services; |
| 4 |
|
| 5 |
class PublicAccessService |
| 6 |
{ |
| 7 |
const TOKEN_DELIMITER = '|'; |
| 8 |
|
| 9 |
public static function generateAccessToken($boardId) |
| 10 |
{ |
| 11 |
$boardId = absint($boardId); |
| 12 |
if (!$boardId) { |
| 13 |
return ''; |
| 14 |
} |
| 15 |
|
| 16 |
$signature = self::signature($boardId); |
| 17 |
$payload = $boardId . self::TOKEN_DELIMITER . $signature; |
| 18 |
|
| 19 |
return rtrim(strtr(base64_encode($payload), '+/', '-_'), '='); |
| 20 |
} |
| 21 |
|
| 22 |
public static function validateAccessToken($boardId, $token) |
| 23 |
{ |
| 24 |
$boardId = absint($boardId); |
| 25 |
$token = sanitize_text_field($token); |
| 26 |
|
| 27 |
if (!$boardId || !$token) { |
| 28 |
return false; |
| 29 |
} |
| 30 |
|
| 31 |
$decoded = base64_decode(strtr($token, '-_', '+/'), true); |
| 32 |
if (!$decoded || strpos($decoded, self::TOKEN_DELIMITER) === false) { |
| 33 |
return false; |
| 34 |
} |
| 35 |
|
| 36 |
[$tokenBoardId, $tokenSignature] = explode(self::TOKEN_DELIMITER, $decoded, 2); |
| 37 |
$tokenBoardId = absint($tokenBoardId); |
| 38 |
if (!$tokenBoardId || $tokenBoardId !== $boardId) { |
| 39 |
return false; |
| 40 |
} |
| 41 |
|
| 42 |
return hash_equals(self::signature($boardId), $tokenSignature); |
| 43 |
} |
| 44 |
|
| 45 |
public static function sanitizeUsers($users) |
| 46 |
{ |
| 47 |
$sanitizedUsers = []; |
| 48 |
|
| 49 |
foreach ((array)$users as $user) { |
| 50 |
if (!is_object($user) || empty($user->ID)) { |
| 51 |
continue; |
| 52 |
} |
| 53 |
|
| 54 |
$role = 'Member'; |
| 55 |
if (isset($user->pivot) && isset($user->pivot->settings)) { |
| 56 |
$settings = maybe_unserialize($user->pivot->settings); |
| 57 |
if (is_array($settings)) { |
| 58 |
if (!empty($settings['is_admin'])) { |
| 59 |
$role = 'Admin'; |
| 60 |
} elseif (!empty($settings['is_viewer_only'])) { |
| 61 |
$role = 'Viewer'; |
| 62 |
} |
| 63 |
} |
| 64 |
} |
| 65 |
|
| 66 |
$displayName = isset($user->display_name) ? $user->display_name : ''; |
| 67 |
|
| 68 |
$sanitizedUsers[] = [ |
| 69 |
'ID' => (int)$user->ID, |
| 70 |
'display_name' => $displayName, |
| 71 |
'photo' => fluent_boards_user_avatar($user->user_email ?? '', $displayName), |
| 72 |
'role' => $role |
| 73 |
]; |
| 74 |
} |
| 75 |
|
| 76 |
return $sanitizedUsers; |
| 77 |
} |
| 78 |
|
| 79 |
private static function signature($boardId) |
| 80 |
{ |
| 81 |
$secret = self::getSecretForBoard($boardId); |
| 82 |
|
| 83 |
return hash_hmac('sha256', 'fluent_boards_public_board_' . absint($boardId), $secret); |
| 84 |
} |
| 85 |
|
| 86 |
private static function getSecretForBoard($boardId) |
| 87 |
{ |
| 88 |
$board = \FluentBoards\App\Models\Board::find($boardId); |
| 89 |
$perBoardSalt = $board ? $board->getMetaByKey('public_token_salt') : ''; |
| 90 |
|
| 91 |
return wp_salt('auth') . $perBoardSalt; |
| 92 |
} |
| 93 |
|
| 94 |
public static function revokeAccessToken($boardId) |
| 95 |
{ |
| 96 |
$board = \FluentBoards\App\Models\Board::find($boardId); |
| 97 |
if ($board) { |
| 98 |
$board->updateMeta('public_token_salt', wp_generate_password(32, true, true)); |
| 99 |
} |
| 100 |
} |
| 101 |
} |
| 102 |
|
| 103 |
|
