PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 16.3-a.1
Jetpack – WP Security, Backup, Speed, & Growth v16.3-a.1
16.3-a.3 16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 All 504 releases
← All changes | _inc/lib/core-api/wpcom-endpoints/memberships.php +224 -128 12.7.3 → 16.3-a.1 View file →
@@ -5,21 +5,31 @@
5 5 * @package Jetpack
6 6 * @since 7.3.0
7 7 */
8 8
9 -use Automattic\Jetpack\Connection\Client;
9 +use Automattic\Jetpack\Connection\Traits\WPCOM_REST_API_Proxy_Request;
10 10
11 +if ( ! defined( 'ABSPATH' ) ) {
12 + exit( 0 );
13 +}
14 +
11 15 /**
12 16 * Class WPCOM_REST_API_V2_Endpoint_Memberships
13 17 * This introduces V2 endpoints.
18 + *
19 + * @phan-constructor-used-for-side-effects
14 20 */
15 21 class WPCOM_REST_API_V2_Endpoint_Memberships extends WP_REST_Controller {
16 22
23 + use WPCOM_REST_API_Proxy_Request;
24 +
17 25 /**
18 26 * WPCOM_REST_API_V2_Endpoint_Memberships constructor.
19 27 */
20 28 public function __construct() {
21 - $this->namespace = 'wpcom/v2';
29 + $this->base_api_path = 'wpcom';
30 + $this->version = 'v2';
31 + $this->namespace = $this->base_api_path . '/' . $this->version;
22 32 $this->rest_base = 'memberships';
23 33 $this->wpcom_is_wpcom_only_endpoint = true;
24 34 $this->wpcom_is_site_specific_endpoint = true;
25 35 add_action( 'rest_api_init', array( $this, 'register_routes' ) );
@@ -57,8 +67,9 @@
57 67 'earn-newsletter',
58 68 'gutenberg',
59 69 'gutenberg-wpcom',
60 70 'launchpad',
71 + 'import-paid-subscribers',
61 72 ),
62 73 true
63 74 );
64 75 },
@@ -84,9 +95,9 @@
84 95 'type' => 'string',
85 96 'required' => true,
86 97 ),
87 98 'price' => array(
88 - 'type' => 'float',
99 + 'type' => 'number',
89 100 'required' => true,
90 101 ),
91 102 'currency' => array(
92 103 'type' => 'string',
@@ -106,8 +117,12 @@
106 117 'tier' => array(
107 118 'type' => 'integer',
108 119 'required' => false,
109 120 ),
121 + 'description' => array(
122 + 'type' => 'string',
123 + 'required' => false,
124 + ),
110 125 ),
111 126 ),
112 127 )
113 128 );
@@ -118,8 +133,22 @@
118 133 array(
119 134 'methods' => WP_REST_Server::CREATABLE,
120 135 'callback' => array( $this, 'create_products' ),
121 136 'permission_callback' => array( $this, 'can_modify_products_permission_check' ),
137 + 'args' => array(
138 + 'currency' => array(
139 + 'type' => 'string',
140 + 'required' => true,
141 + ),
142 + 'type' => array(
143 + 'type' => 'string',
144 + 'required' => true,
145 + ),
146 + 'is_editable' => array(
147 + 'type' => 'boolean',
148 + 'required' => false,
149 + ),
150 + ),
122 151 ),
123 152 array(
124 153 'methods' => WP_REST_Server::READABLE,
125 154 'callback' => array( $this, 'list_products' ),
@@ -140,9 +169,9 @@
140 169 'type' => 'string',
141 170 'required' => true,
142 171 ),
143 172 'price' => array(
144 - 'type' => 'float',
173 + 'type' => 'number',
145 174 'required' => true,
146 175 ),
147 176 'currency' => array(
148 177 'type' => 'string',
@@ -162,8 +191,12 @@
162 191 'tier' => array(
163 192 'type' => 'integer',
164 193 'required' => false,
165 194 ),
195 + 'description' => array(
196 + 'type' => 'string',
197 + 'required' => false,
198 + ),
166 199 ),
167 200 ),
168 201 array(
169 202 'methods' => WP_REST_Server::DELETABLE,
@@ -168,8 +201,14 @@
168 201 array(
169 202 'methods' => WP_REST_Server::DELETABLE,
170 203 'callback' => array( $this, 'delete_product' ),
171 204 'permission_callback' => array( $this, 'can_modify_products_permission_check' ),
205 + 'args' => array(
206 + 'cancel_subscriptions' => array(
207 + 'type' => 'boolean',
208 + 'required' => false,
209 + ),
210 + ),
172 211 ),
173 212 )
174 213 );
175 214 }
@@ -203,8 +242,9 @@
203 242 $is_editable = isset( $request['is_editable'] ) ? (bool) $request['is_editable'] : null;
204 243
205 244 if ( $this->is_wpcom() ) {
206 245 require_lib( 'memberships' );
246 + Memberships_Store_Sandbox::get_instance()->init( true );
207 247
208 248 $result = Memberships_Product::generate_default_products( get_current_blog_id(), $request['type'], $request['currency'], $is_editable );
209 249
210 250 if ( is_wp_error( $result ) ) {
@@ -212,39 +252,9 @@
212 252 return new WP_Error( $result->get_error_code(), $result->get_error_message(), array( 'status' => $status ) );
213 253 }
214 254 return $result;
215 255 } else {
216 - $payload = array(
217 - 'type' => $request['type'],
218 - 'currency' => $request['currency'],
219 - );
220 -
221 - // If we pass directly is_editable as null, it would break API argument validation.
222 - if ( null !== $is_editable ) {
223 - $payload['is_editable'] = $is_editable;
224 - }
225 -
226 - $blog_id = Jetpack_Options::get_option( 'id' );
227 - $response = Client::wpcom_json_api_request_as_user(
228 - "/sites/$blog_id/{$this->rest_base}/products",
229 - 'v2',
230 - array(
231 - 'method' => 'POST',
232 - ),
233 - $payload
234 - );
235 - if ( is_wp_error( $response ) ) {
236 - if ( $response->get_error_code() === 'missing_token' ) {
237 - return new WP_Error( 'missing_token', __( 'Please connect your user account to WordPress.com', 'jetpack' ), 404 );
238 - }
239 - return new WP_Error( 'wpcom_connection_error', __( 'Could not connect to WordPress.com', 'jetpack' ), 404 );
240 - }
241 - $data = isset( $response['body'] ) ? json_decode( $response['body'], true ) : null;
242 - // If endpoint returned error, we have to detect it.
243 - if ( 200 !== $response['response']['code'] && $data['code'] ) {
244 - return new WP_Error( $data['code'], $data['message'] ? $data['message'] : '', 401 );
245 - }
246 - return $data;
256 + return $this->proxy_request_to_wpcom_as_user( $request, 'products' );
247 257 }
248 258
249 259 return $request;
250 260 }
@@ -257,9 +267,9 @@
257 267 * @return WP_Error|array ['products']
258 268 */
259 269 public function list_products( WP_REST_Request $request ) {
260 270 $is_editable = isset( $request['is_editable'] ) ? (bool) $request['is_editable'] : null;
261 - $type = isset( $request['type'] ) ? $request['type'] : null;
271 + $type = $request['type'] ?? null;
262 272
263 273 if ( ( defined( 'IS_WPCOM' ) && IS_WPCOM ) ) {
264 274 require_lib( 'memberships' );
265 275 require_once JETPACK__PLUGIN_DIR . '/modules/memberships/class-jetpack-memberships.php';
@@ -268,19 +278,10 @@
268 278 } catch ( \Exception $e ) {
269 279 return array( 'error' => $e->getMessage() );
270 280 }
271 281 } else {
272 - $query_parts = array();
273 - if ( $type !== null ) {
274 - $query_parts[] = 'type=' . $type;
275 - }
276 - if ( $is_editable !== null ) {
277 - $query_parts[] = 'is_editable=' . $is_editable;
278 - }
279 - if ( ! empty( $query_parts ) ) {
280 - $query = '?' . implode( '&', $query_parts );
281 - }
282 - return $this->proxy_request_to_wpcom( "products$query", 'GET' );
282 +
283 + return $this->proxy_request_to_wpcom_as_user( $request, 'products' );
283 284 }
284 285 }
285 286
286 287 /**
@@ -292,8 +293,12 @@
292 293 */
293 294 public function create_product( WP_REST_Request $request ) {
294 295 $payload = $this->get_payload_for_product( $request );
295 296
297 + if ( is_wp_error( $payload ) ) {
298 + return $payload;
299 + }
300 +
296 301 if ( $this->is_wpcom() ) {
297 302 require_lib( 'memberships' );
298 303 try {
299 304 return $this->create_product_from_wpcom( $payload );
@@ -300,9 +305,9 @@
300 305 } catch ( \Exception $e ) {
301 306 return array( 'error' => $e->getMessage() );
302 307 }
303 308 } else {
304 - return $this->proxy_request_to_wpcom( 'product', 'POST', $payload );
309 + return $this->proxy_request_to_wpcom_as_user( $request, 'product' );
305 310 }
306 311 }
307 312
308 313 /**
@@ -315,8 +320,12 @@
315 320 public function update_product( \WP_REST_Request $request ) {
316 321 $product_id = $request->get_param( 'product_id' );
317 322 $payload = $this->get_payload_for_product( $request );
318 323
324 + if ( is_wp_error( $payload ) ) {
325 + return $payload;
326 + }
327 +
319 328 if ( $this->is_wpcom() ) {
320 329 require_lib( 'memberships' );
321 330 try {
322 331 return array( 'product' => $this->update_product_from_wpcom( $product_id, $payload ) );
@@ -323,9 +332,9 @@
323 332 } catch ( \Exception $e ) {
324 333 return array( 'error' => $e->getMessage() );
325 334 }
326 335 } else {
327 - return $this->proxy_request_to_wpcom( "product/$product_id", 'POST', $payload );
336 + return $this->proxy_request_to_wpcom_as_user( $request, "product/$product_id" );
328 337 }
329 338 }
330 339
331 340 /**
@@ -335,19 +344,20 @@
335 344 *
336 345 * @return array|WP_Error
337 346 */
338 347 public function delete_product( \WP_REST_Request $request ) {
339 - $product_id = $request->get_param( 'product_id' );
348 + $product_id = $request->get_param( 'product_id' );
349 + $cancel_subscriptions = $request->get_param( 'cancel_subscriptions' );
340 350 if ( $this->is_wpcom() ) {
341 351 require_lib( 'memberships' );
342 352 try {
343 - $this->delete_product_from_wpcom( $product_id );
353 + $this->delete_product_from_wpcom( $product_id, $cancel_subscriptions );
344 354 return array( 'deleted' => true );
345 355 } catch ( \Exception $e ) {
346 356 return array( 'error' => $e->getMessage() );
347 357 }
348 358 } else {
349 - return $this->proxy_request_to_wpcom( "product/$product_id", 'DELETE' );
359 + return $this->proxy_request_to_wpcom_as_user( $request, "product/$product_id" );
350 360 }
351 361 }
352 362
353 363 /**
@@ -358,87 +368,48 @@
358 368 * @return WP_Error|array ['products','connected_account_id','connect_url']
359 369 */
360 370 public function get_status( \WP_REST_Request $request ) {
361 371 $product_type = $request['type'];
362 - $source = $request['source'];
363 - $is_editable = ! isset( $request['is_editable'] ) ? null : (bool) $request['is_editable'];
364 372
373 + if ( ! empty( $request['source'] ) ) {
374 + $source = sanitize_text_field( wp_unslash( $request['source'] ) );
375 + } else {
376 + $source = 'gutenberg';
377 + }
378 +
379 + $is_editable = ! isset( $request['is_editable'] ) ? null : (bool) $request['is_editable'];
380 +
365 381 if ( $this->is_wpcom() ) {
366 382 require_lib( 'memberships' );
367 - $blog_id = get_current_blog_id();
368 - return (array) get_memberships_settings_for_site( $blog_id, $product_type, $is_editable, $source );
369 - } else {
370 - $payload = array(
371 - 'type' => $request['type'],
372 - 'source' => $source,
373 - );
383 + Memberships_Store_Sandbox::get_instance()->init( true );
384 + $blog_id = get_current_blog_id();
385 + $membership_settings = get_memberships_settings_for_site( $blog_id, $product_type, $is_editable, $source );
374 386
375 - // If we pass directly is_editable as null, it would break API argument validation.
376 - // This also needs to be converted to int because boolean false is ignored by add_query_arg.
377 - if ( null !== $is_editable ) {
378 - $payload['is_editable'] = (int) $is_editable;
379 - }
387 + if ( is_wp_error( $membership_settings ) ) {
388 + // Get error messages from the $membership_settings.
389 + $error_codes = $membership_settings->get_error_codes();
390 + $error_messages = array();
380 391
381 - $blog_id = Jetpack_Options::get_option( 'id' );
382 - $path = "/sites/$blog_id/{$this->rest_base}/status";
383 - if ( $product_type ) {
384 - $path = add_query_arg(
385 - $payload,
386 - $path
387 - );
388 - }
389 - $response = Client::wpcom_json_api_request_as_user( $path, 'v2' );
390 - if ( is_wp_error( $response ) ) {
391 - if ( $response->get_error_code() === 'missing_token' ) {
392 - return new WP_Error( 'missing_token', __( 'Please connect your user account to WordPress.com', 'jetpack' ), 404 );
392 + foreach ( $error_codes as $code ) {
393 + $messages = $membership_settings->get_error_messages( $code );
394 + foreach ( $messages as $message ) {
395 + // Sanitize error message
396 + $error_messages[] = esc_html( $message );
397 + }
393 398 }
394 - return new WP_Error( 'wpcom_connection_error', __( 'Could not connect to WordPress.com', 'jetpack' ), 404 );
395 - }
396 - $data = isset( $response['body'] ) ? json_decode( $response['body'], true ) : null;
397 - if ( 200 !== $response['response']['code'] && $data['code'] && $data['message'] ) {
398 - return new WP_Error( $data['code'], $data['message'], 401 );
399 - }
400 - return $data;
401 - }
402 - }
403 399
404 - /**
405 - * Proxy a request to WPCOM, look for errors and return a response or a WP_Error.
406 - *
407 - * @param string $uri Whatever would go at the end of the url after /sites/$blog_id/$this->rest_base/. This is usually `product`, `products`, or `product/$product_id`.
408 - * @param string $method The HTTP method being used.
409 - * @param array|null $payload An optional payload to be sent with the request.
410 - * @return string The response from WPCOM
411 - */
412 - private function proxy_request_to_wpcom( $uri, $method, $payload = null ) {
413 - // get blog id
414 - $blog_id = Jetpack_Options::get_option( 'id' );
400 + $error_messages_string = implode( ' ', $error_messages );
401 + // translators: %s is a list of error messages.
402 + $base_message = __( 'Could not get the membership settings due to the following error(s): %s', 'jetpack' );
403 + $full_message = sprintf( $base_message, $error_messages_string );
415 404
416 - // proxy request to wpcom
417 - $response = Client::wpcom_json_api_request_as_user(
418 - "/sites/$blog_id/{$this->rest_base}/$uri",
419 - 'v2',
420 - array(
421 - 'method' => strtoupper( $method ),
422 - ),
423 - $payload
424 - );
425 - if ( is_wp_error( $response ) ) {
426 - if ( $response->get_error_code() === 'missing_token' ) {
427 - return new WP_Error( 'missing_token', __( 'Please connect your user account to WordPress.com', 'jetpack' ), 404 );
405 + return new WP_Error( 'membership_settings_error', $full_message, array( 'status' => 404 ) );
428 406 }
429 - return new WP_Error( 'wpcom_connection_error', __( 'Could not connect to WordPress.com', 'jetpack' ), 404 );
430 - }
431 407
432 - // decode response
433 - $data = isset( $response['body'] ) ? json_decode( $response['body'], true ) : null;
434 - // If endpoint returned error, we have to detect it.
435 - if ( 200 !== $response['response']['code'] && $data['code'] && $data['message'] ) {
436 - return new WP_Error( $data['code'], $data['message'], 401 );
408 + return (array) $membership_settings;
409 + } else {
410 + return $this->proxy_request_to_wpcom_as_user( $request, 'status' );
437 411 }
438 -
439 - // return response
440 - return $data;
441 412 }
442 413
443 414 /**
444 415 * This function throws an exception if it is run outside of wpcom.
@@ -456,14 +427,15 @@
456 427 * List products via the WPCOM-specific Memberships_Product class.
457 428 *
458 429 * @param WP_REST_Request $request The request for this endpoint.
459 430 * @param ?string $type The type of the products to list.
460 - * @param ?string $is_editable This string will be interpreted as a bool to determine if we are looking for editable or non-editable products.
431 + * @param ?bool $is_editable If we are looking for editable or non-editable products.
461 432 * @throws \Exception If blog is not known or if there is an error getting products.
462 433 * @return array List of products.
463 434 */
464 435 private function list_products_from_wpcom( WP_REST_Request $request, $type, $is_editable ) {
465 436 $this->prevent_running_outside_of_wpcom();
437 + Memberships_Store_Sandbox::get_instance()->init( true );
466 438 $blog_id = $request->get_param( 'blog_id' );
467 439 if ( is_wp_error( $blog_id ) ) {
468 440 throw new \Exception( 'Unknown blog' );
469 441 }
@@ -482,8 +454,9 @@
482 454 * @return object The found product.
483 455 */
484 456 private function find_product_from_wpcom( $product_id ) {
485 457 $this->prevent_running_outside_of_wpcom();
458 + Memberships_Store_Sandbox::get_instance()->init( true );
486 459 $product = Memberships_Product::get_from_post( get_current_blog_id(), $product_id );
487 460 if ( is_wp_error( $product ) ) {
488 461 throw new \Exception( $product->get_error_message() );
489 462 }
@@ -497,12 +470,13 @@
497 470 * Create a product via the WPCOM-specific Memberships_Product class.
498 471 *
499 472 * @param array $payload The request payload which contains details about the product.
500 473 * @throws \Exception When the product failed to be created.
501 - * @return object The newly created product.
474 + * @return array The newly created product.
502 475 */
503 476 private function create_product_from_wpcom( $payload ) {
504 477 $this->prevent_running_outside_of_wpcom();
478 + Memberships_Store_Sandbox::get_instance()->init( true );
505 479 $product = Memberships_Product::create( get_current_blog_id(), $payload );
506 480 if ( is_wp_error( $product ) ) {
507 481 throw new \Exception( __( 'Creating product has failed.', 'jetpack' ) );
508 482 }
@@ -517,8 +491,9 @@
517 491 * @throws \Exception When there is a problem updating the product.
518 492 * @return object The newly updated product.
519 493 */
520 494 private function update_product_from_wpcom( $product_id, $payload ) {
495 + Memberships_Store_Sandbox::get_instance()->init( true );
521 496 $product = $this->find_product_from_wpcom( $product_id ); // prevents running outside of wpcom
522 497 $updated_product = $product->update( $payload );
523 498 if ( is_wp_error( $updated_product ) ) {
524 499 throw new \Exception( $updated_product->get_error_message() );
@@ -529,14 +504,16 @@
529 504 /**
530 505 * Delete a product via the WPCOM-specific Memberships_Product class.
531 506 *
532 507 * @param string|int $product_id The ID of the product being deleted.
508 + * @param bool $cancel_subscriptions Whether to cancel subscriptions to the product as well.
533 509 * @throws \Exception When there is a problem deleting the product.
534 510 * @return void
535 511 */
536 - private function delete_product_from_wpcom( $product_id ) {
512 + private function delete_product_from_wpcom( $product_id, $cancel_subscriptions = false ) {
513 + Memberships_Store_Sandbox::get_instance()->init( true );
537 514 $product = $this->find_product_from_wpcom( $product_id ); // prevents running outside of wpcom
538 - $result = $product->delete();
515 + $result = $product->delete( $cancel_subscriptions ? Memberships_Product::CANCEL_SUBSCRIPTIONS : Memberships_Product::KEEP_SUBSCRIPTIONS );
539 516 if ( is_wp_error( $result ) ) {
540 517 throw new \Exception( $result->get_error_message() );
541 518 }
542 519 }
@@ -544,33 +521,152 @@
544 521 /**
545 522 * Get a payload for creating or updating products by parsing the request.
546 523 *
547 524 * @param WP_REST_Request $request The request for this endpoint, containing the details needed to build the payload.
548 - * @return array The built payload.
525 + * @return array|WP_Error The built payload or WP_Error on validation failure.
549 526 */
550 527 private function get_payload_for_product( WP_REST_Request $request ) {
551 528 $is_editable = isset( $request['is_editable'] ) ? (bool) $request['is_editable'] : null;
552 - $type = isset( $request['type'] ) ? $request['type'] : null;
529 + $type = $request['type'] ?? null;
530 + $tier = $request['tier'] ?? null;
553 531 $buyer_can_change_amount = isset( $request['buyer_can_change_amount'] ) && (bool) $request['buyer_can_change_amount'];
532 + $interval = $request['interval'];
554 533
534 + // Validate tier field usage.
535 + $tier_validation = $this->validate_tier_field( $request, $tier, $type, $interval );
536 + if ( is_wp_error( $tier_validation ) ) {
537 + return $tier_validation;
538 + }
539 +
555 540 $payload = array(
556 541 'title' => $request['title'],
557 542 'price' => $request['price'],
558 543 'currency' => $request['currency'],
559 544 'buyer_can_change_amount' => $buyer_can_change_amount,
560 - 'interval' => $request['interval'],
545 + 'interval' => $interval,
561 546 'type' => $type,
562 547 'welcome_email_content' => $request['welcome_email_content'],
563 548 'subscribe_as_site_subscriber' => $request['subscribe_as_site_subscriber'],
564 549 'multiple_per_user' => $request['multiple_per_user'],
565 - 'tier' => $request['tier'],
566 550 );
567 551
552 + if ( null !== $tier ) {
553 + $payload['tier'] = $tier;
554 + }
555 +
568 556 // If we pass directly the value "null", it will break the argument validation.
569 557 if ( null !== $is_editable ) {
570 558 $payload['is_editable'] = $is_editable;
571 559 }
560 +
561 + if ( isset( $request['description'] ) ) {
562 + $payload['description'] = $request['description'];
563 + }
564 +
572 565 return $payload;
566 + }
567 +
568 + /**
569 + * Validate tier field usage for newsletter plans.
570 + *
571 + * @param WP_REST_Request $request The request object.
572 + * @param string|null $tier The tier value to validate.
573 + * @param string|null $type The product type.
574 + * @param string $interval The product interval.
575 + * @return WP_Error|null Error object if validation fails, null if successful.
576 + */
577 + private function validate_tier_field( WP_REST_Request $request, $tier, $type, $interval ) {
578 + // Only apply tier validation for newsletter plans with type 'tier'.
579 + if ( null === $tier || 'tier' !== $type ) {
580 + return null;
581 + }
582 +
583 + // Monthly plans should not have a tier field.
584 + if ( '1 month' === $interval ) {
585 + return new WP_Error( 'invalid_tier_usage', __( 'Monthly plans should not have a tier field. The tier field is only used to link yearly plans to their corresponding monthly plans.', 'jetpack' ), array( 'status' => 400 ) );
586 + }
587 +
588 + // Yearly plans must have a valid tier that points to a monthly plan.
589 + if ( '1 year' === $interval ) {
590 + return $this->validate_yearly_tier( $request, $tier );
591 + }
592 +
593 + return null;
594 + }
595 +
596 + /**
597 + * Validate yearly tier requirements.
598 + *
599 + * @param WP_REST_Request $request The request object.
600 + * @param string|int $tier The tier value to validate.
601 + * @return WP_Error|null Error object if validation fails, null if successful.
602 + */
603 + private function validate_yearly_tier( WP_REST_Request $request, $tier ) {
604 + if ( ! is_numeric( $tier ) || $tier <= 0 ) {
605 + return new WP_Error( 'invalid_tier_id', __( 'Yearly plans must have a valid tier ID that points to an existing monthly plan.', 'jetpack' ), array( 'status' => 400 ) );
606 + }
607 +
608 + if ( ! $this->is_wpcom() ) {
609 + return null; // Validation will happen on WPCOM side.
610 + }
611 +
612 + return $this->validate_tier_references( $request, $tier );
613 + }
614 +
615 + /**
616 + * Validate that the tier references a valid monthly plan and check for duplicates.
617 + *
618 + * @param WP_REST_Request $request The request object.
619 + * @param string|int $tier The tier value to validate.
620 + * @return WP_Error|null Error object if validation fails, null if successful.
621 + */
622 + private function validate_tier_references( WP_REST_Request $request, $tier ) {
623 + require_lib( 'memberships' );
624 + Memberships_Store_Sandbox::get_instance()->init( true );
625 +
626 + // Check if the referenced monthly plan exists and is actually a monthly plan.
627 + $monthly_plan = Memberships_Product::get_from_post( get_current_blog_id(), $tier );
628 + if ( is_wp_error( $monthly_plan ) || ! $monthly_plan ) {
629 + return new WP_Error( 'tier_not_found', __( 'The specified tier ID does not correspond to an existing monthly plan.', 'jetpack' ), array( 'status' => 400 ) );
630 + }
631 +
632 + $monthly_plan_data = $monthly_plan->to_array();
633 + if ( '1 month' !== $monthly_plan_data['interval'] ) {
634 + return new WP_Error( 'invalid_tier_interval', __( 'The specified tier ID must point to a monthly plan (1 month interval).', 'jetpack' ), array( 'status' => 400 ) );
635 + }
636 +
637 + return $this->check_duplicate_tier_references( $request, $tier );
638 + }
639 +
640 + /**
641 + * Check for duplicate tier references.
642 + *
643 + * @param WP_REST_Request $request The request object.
644 + * @param string|int $tier The tier value to check.
645 + * @return WP_Error|null Error object if duplicate found, null if successful.
646 + */
647 + private function check_duplicate_tier_references( WP_REST_Request $request, $tier ) {
648 + $existing_yearly_plans = Memberships_Product::get_product_list( get_current_blog_id(), 'tier', null, false );
649 + if ( is_wp_error( $existing_yearly_plans ) ) {
650 + return new WP_Error( 'product_list_error', __( 'Could not retrieve existing products to check for duplicate tier references.', 'jetpack' ), array( 'status' => 500 ) );
651 + }
652 +
653 + // Ensure the result is iterable before foreach.
654 + if ( ! is_array( $existing_yearly_plans ) && ! $existing_yearly_plans instanceof Traversable ) {
655 + return new WP_Error( 'invalid_product_list', __( 'Unexpected error: product list is not iterable.', 'jetpack' ), array( 'status' => 500 ) );
656 + }
657 +
658 + foreach ( $existing_yearly_plans as $existing_plan ) {
659 + if ( isset( $existing_plan['tier'] ) && (string) $existing_plan['tier'] === (string) $tier && '1 year' === $existing_plan['interval'] ) {
660 + // If this is an update, allow it to reference itself.
661 + $product_id = $request->get_param( 'product_id' );
662 + if ( ! $product_id || (string) $existing_plan['id'] !== (string) $product_id ) {
663 + return new WP_Error( 'duplicate_tier_reference', __( 'Another yearly plan already references this monthly plan. Each monthly plan can only have one corresponding yearly plan.', 'jetpack' ), array( 'status' => 400 ) );
664 + }
665 + }
666 + }
667 +
668 + return null;
573 669 }
574 670
575 671 /**
576 672 * Returns true if run from WPCOM.