service-api-keys.php — Jetpack – WP Security, Backup, Speed, & Growth 13.5.2

jetpack / _inc / lib / core-api / wpcom-endpoints / service-api-keys.php

jetpack / _inc / lib / core-api / wpcom-endpoints Last commit date

service-api-keys.php

336 lines

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Get and save API keys for a site.
4	*
5	* @package automattic/jetpack
6	*/
7
8	/**
9	* Service API Keys: Exposes 3rd party api keys that are used on a site.
10	*
11	* [
12	* { # Availability Object. See schema for more detail.
13	* code: (string) Displays success if the operation was successfully executed and an error code if it was not
14	* service: (string) The name of the service in question
15	* service_api_key: (string) The API key used by the service empty if one is not set yet
16	* service_api_key_source: (string) The source of the API key, defaults to "site"
17	* message: (string) User friendly message
18	* },
19	* ...
20	* ]
21	*
22	* @since 6.9
23	*/
24	class WPCOM_REST_API_V2_Endpoint_Service_API_Keys extends WP_REST_Controller {
25
26	/**
27	* Constructor.
28	*/
29	public function __construct() {
30	$this->namespace = 'wpcom/v2';
31	$this->rest_base = 'service-api-keys';
32
33	add_action( 'rest_api_init', array( $this, 'register_routes' ) );
34	}
35
36	/**
37	* Register endpoint routes.
38	*/
39	public function register_routes() {
40	register_rest_route(
41	'wpcom/v2',
42	'/service-api-keys/(?P<service>[a-z\-_]+)',
43	array(
44	array(
45	'methods' => WP_REST_Server::READABLE,
46	'callback' => array( __CLASS__, 'get_service_api_key' ),
47	'permission_callback' => '__return_true',
48	),
49	array(
50	'methods' => WP_REST_Server::EDITABLE,
51	'callback' => array( __CLASS__, 'update_service_api_key' ),
52	'permission_callback' => array( __CLASS__, 'edit_others_posts_check' ),
53	'args' => array(
54	'service_api_key' => array(
55	'required' => true,
56	'type' => 'string',
57	),
58	),
59	),
60	array(
61	'methods' => WP_REST_Server::DELETABLE,
62	'callback' => array( __CLASS__, 'delete_service_api_key' ),
63	'permission_callback' => array( __CLASS__, 'edit_others_posts_check' ),
64	),
65	)
66	);
67	}
68
69	/**
70	* Permission check.
71	*/
72	public static function edit_others_posts_check() {
73	if ( current_user_can( 'edit_others_posts' ) ) {
74	return true;
75	}
76
77	$user_permissions_error_msg = esc_html__(
78	'You do not have the correct user permissions to perform this action.
79	Please contact your site admin if you think this is a mistake.',
80	'jetpack'
81	);
82
83	return new WP_Error( 'invalid_user_permission_edit_others_posts', $user_permissions_error_msg, rest_authorization_required_code() );
84	}
85
86	/**
87	* Return the available Gutenberg extensions schema
88	*
89	* @return array Service API Key schema
90	*/
91	public function get_public_item_schema() {
92	$schema = array(
93	'$schema' => 'http://json-schema.org/draft-04/schema#',
94	'title' => 'service-api-keys',
95	'type' => 'object',
96	'properties' => array(
97	'code' => array(
98	'description' => __( 'Displays success if the operation was successfully executed and an error code if it was not', 'jetpack' ),
99	'type' => 'string',
100	),
101	'service' => array(
102	'description' => __( 'The name of the service in question', 'jetpack' ),
103	'type' => 'string',
104	),
105	'service_api_key' => array(
106	'description' => __( 'The API key used by the service. Empty if none has been set yet', 'jetpack' ),
107	'type' => 'string',
108	),
109	'service_api_key_source' => array(
110	'description' => __( 'The source of the API key. Defaults to "site"', 'jetpack' ),
111	'type' => 'string',
112	),
113	'message' => array(
114	'description' => __( 'User friendly message', 'jetpack' ),
115	'type' => 'string',
116	),
117	),
118	);
119
120	return $this->add_additional_fields_schema( $schema );
121	}
122
123	/**
124	* Get third party plugin API keys.
125	*
126	* @param WP_REST_Request $request {
127	* Array of parameters received by request.
128	*
129	* @type string $slug Plugin slug with the syntax 'plugin-directory/plugin-main-file.php'.
130	* }
131	*/
132	public static function get_service_api_key( $request ) {
133	$service = self::validate_service_api_service( $request['service'] );
134	if ( ! $service ) {
135	return self::service_api_invalid_service_response();
136	}
137
138	switch ( $service ) {
139	case 'mapbox':
140	if ( ! class_exists( 'Jetpack_Mapbox_Helper' ) ) {
141	require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-mapbox-helper.php';
142	}
143	$mapbox = Jetpack_Mapbox_Helper::get_access_token();
144	$service_api_key = $mapbox['key'];
145	$service_api_key_source = $mapbox['source'];
146	break;
147	default:
148	$option = self::key_for_api_service( $service );
149	$service_api_key = Jetpack_Options::get_option( $option, '' );
150	$service_api_key_source = 'site';
151	}
152
153	$message = esc_html__( 'API key retrieved successfully.', 'jetpack' );
154
155	return array(
156	'code' => 'success',
157	'service' => $service,
158	'service_api_key' => $service_api_key,
159	'service_api_key_source' => $service_api_key_source,
160	'message' => $message,
161	);
162	}
163
164	/**
165	* Update third party plugin API keys.
166	*
167	* @param WP_REST_Request $request {
168	* Array of parameters received by request.
169	*
170	* @type string $slug Plugin slug with the syntax 'plugin-directory/plugin-main-file.php'.
171	* }
172	*/
173	public static function update_service_api_key( $request ) {
174	$service = self::validate_service_api_service( $request['service'] );
175	if ( ! $service ) {
176	return self::service_api_invalid_service_response();
177	}
178	$json_params = $request->get_json_params();
179	$params = ! empty( $json_params ) ? $json_params : $request->get_body_params();
180	$service_api_key = trim( $params['service_api_key'] );
181	$option = self::key_for_api_service( $service );
182
183	$validation = self::validate_service_api_key( $service_api_key, $service );
184	if ( ! $validation['status'] ) {
185	return new WP_Error( 'invalid_key', esc_html__( 'Invalid API Key', 'jetpack' ), array( 'status' => 404 ) );
186	}
187	$message = esc_html__( 'API key updated successfully.', 'jetpack' );
188	Jetpack_Options::update_option( $option, $service_api_key );
189	return array(
190	'code' => 'success',
191	'service' => $service,
192	'service_api_key' => Jetpack_Options::get_option( $option, '' ),
193	'service_api_key_source' => 'site',
194	'message' => $message,
195	);
196	}
197
198	/**
199	* Delete a third party plugin API key.
200	*
201	* @param WP_REST_Request $request {
202	* Array of parameters received by request.
203	*
204	* @type string $slug Plugin slug with the syntax 'plugin-directory/plugin-main-file.php'.
205	* }
206	*/
207	public static function delete_service_api_key( $request ) {
208	$service = self::validate_service_api_service( $request['service'] );
209	if ( ! $service ) {
210	return self::service_api_invalid_service_response();
211	}
212	$option = self::key_for_api_service( $service );
213	Jetpack_Options::delete_option( $option );
214	$message = esc_html__( 'API key deleted successfully.', 'jetpack' );
215
216	switch ( $service ) {
217	case 'mapbox':
218	// After deleting a custom Mapbox key, try to revert to the WordPress.com one if available.
219	if ( ! class_exists( 'Jetpack_Mapbox_Helper' ) ) {
220	require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-mapbox-helper.php';
221	}
222	$mapbox = Jetpack_Mapbox_Helper::get_access_token();
223	$service_api_key = $mapbox['key'];
224	$service_api_key_source = $mapbox['source'];
225	break;
226	default:
227	$service_api_key = Jetpack_Options::get_option( $option, '' );
228	$service_api_key_source = 'site';
229	}
230
231	return array(
232	'code' => 'success',
233	'service' => $service,
234	'service_api_key' => $service_api_key,
235	'service_api_key_source' => $service_api_key_source,
236	'message' => $message,
237	);
238	}
239
240	/**
241	* Validate the service provided in /service-api-keys/ endpoints.
242	* To add a service to these endpoints, add the service name to $valid_services
243	* and add '{service name}_api_key' to the non-compact return array in get_option_names(),
244	* in class-jetpack-options.php
245	*
246	* @param string $service The service the API key is for.
247	* @return string Returns the service name if valid, null if invalid.
248	*/
249	public static function validate_service_api_service( $service = null ) {
250	$valid_services = array(
251	'mapbox',
252	);
253	return in_array( $service, $valid_services, true ) ? $service : null;
254	}
255
256	/**
257	* Error response for invalid service API key requests with an invalid service.
258	*/
259	public static function service_api_invalid_service_response() {
260	return new WP_Error(
261	'invalid_service',
262	esc_html__( 'Invalid Service', 'jetpack' ),
263	array( 'status' => 404 )
264	);
265	}
266
267	/**
268	* Validate API Key
269	*
270	* @param string $key The API key to be validated.
271	* @param string $service The service the API key is for.
272	*/
273	public static function validate_service_api_key( $key = null, $service = null ) {
274	$validation = false;
275	switch ( $service ) {
276	case 'mapbox':
277	$validation = self::validate_service_api_key_mapbox( $key );
278	break;
279	}
280	return $validation;
281	}
282
283	/**
284	* Validate Mapbox API key
285	* Based loosely on https://github.com/mapbox/geocoding-example/blob/master/php/MapboxTest.php
286	*
287	* @param string $key The API key to be validated.
288	*/
289	public static function validate_service_api_key_mapbox( $key ) {
290	$status = true;
291	$msg = null;
292	$mapbox_url = sprintf(
293	'https://api.mapbox.com?%s',
294	$key
295	);
296	$mapbox_response = wp_safe_remote_get( esc_url_raw( $mapbox_url ) );
297	$mapbox_body = wp_remote_retrieve_body( $mapbox_response );
298	if ( '{"api":"mapbox"}' !== $mapbox_body ) {
299	$status = false;
300	$msg = esc_html__( 'Can\'t connect to Mapbox', 'jetpack' );
301	return array(
302	'status' => $status,
303	'error_message' => $msg,
304	);
305	}
306	$mapbox_geocode_url = esc_url_raw(
307	sprintf(
308	'https://api.mapbox.com/geocoding/v5/mapbox.places/%s.json?access_token=%s',
309	'1+broadway+new+york+ny+usa',
310	$key
311	)
312	);
313	$mapbox_geocode_response = wp_safe_remote_get( esc_url_raw( $mapbox_geocode_url ) );
314	$mapbox_geocode_body = wp_remote_retrieve_body( $mapbox_geocode_response );
315	$mapbox_geocode_json = json_decode( $mapbox_geocode_body );
316	if ( isset( $mapbox_geocode_json->message ) \|\| ! isset( $mapbox_geocode_json->query ) ) {
317	$status = false;
318	$msg = isset( $mapbox_geocode_json->message ) ? $mapbox_geocode_json->message : 'Unknown error';
319	}
320	return array(
321	'status' => $status,
322	'error_message' => $msg,
323	);
324	}
325
326	/**
327	* Create site option key for service
328	*
329	* @param string $service The service to create key for.
330	*/
331	private static function key_for_api_service( $service ) {
332	return $service . '_api_key';
333	}
334	}
335	wpcom_rest_api_v2_load_plugin( 'WPCOM_REST_API_V2_Endpoint_Service_API_Keys' );
336