jetpack / json-endpoints / class.wpcom-json-api-update-user-endpoint.php

class.wpcom-json-api-update-user-endpoint.php in Jetpack – WP Security, Backup, Speed, & Growth 16.3-a.5, at json-endpoints/class.wpcom-json-api-update-user-endpoint.php

203 lines 6.0 KB

Raw Download Zip

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Update site users API endpoint.
4	*
5	* Endpoint: /sites/%s/users/%d/delete
6	*/
7
8	if ( ! defined( 'ABSPATH' ) ) {
9	exit( 0 );
10	}
11
12	new WPCOM_JSON_API_Update_User_Endpoint(
13	array(
14	'description' => 'Deletes or removes a user of a site.',
15	'group' => 'users',
16	'stat' => 'users:delete',
17
18	'method' => 'POST',
19	'path' => '/sites/%s/users/%d/delete',
20	'path_labels' => array(
21	'$site' => '(int\|string) The site ID or domain.',
22	'$user_ID' => '(int) The user\'s ID',
23	),
24
25	'request_format' => array(
26	'reassign' => '(int) An optional id of a user to reassign posts to.',
27	),
28
29	'response_format' => array(
30	'success' => '(bool) Was the deletion of user successful?',
31	),
32
33	'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/82974409/users/1/delete',
34	'example_request_data' => array(
35	'headers' => array(
36	'authorization' => 'Bearer YOUR_API_TOKEN',
37	),
38	),
39
40	'example_response' => '
41	{
42	"success": true
43	}',
44	)
45	);
46
47	/**
48	* Update site users API class.
49	*
50	* @phan-constructor-used-for-side-effects
51	*/
52	class WPCOM_JSON_API_Update_User_Endpoint extends WPCOM_JSON_API_Endpoint {
53	/**
54	* Update site users API callback.
55	*
56	* @param string $path API path.
57	* @param int $blog_id Blog ID.
58	* @param int $user_id User ID.
59	*/
60	public function callback( $path = '', $blog_id = 0, $user_id = 0 ) {
61	$blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) );
62	if ( is_wp_error( $blog_id ) ) {
63	return $blog_id;
64	}
65
66	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
67	if ( (int) wpcom_get_blog_owner( $blog_id ) === (int) $user_id ) {
68	return new WP_Error( 'forbidden', 'A site owner cannot be removed through this endpoint.', 403 );
69	}
70	}
71
72	if ( $this->api->ends_with( $path, '/delete' ) ) {
73	return $this->delete_or_remove_user( $user_id );
74	}
75
76	return false;
77	}
78
79	/**
80	* Checks if a user exists by checking to see if a WP_User object exists for a user ID.
81	*
82	* @param int $user_id User ID.
83	* @return bool
84	*/
85	public function user_exists( $user_id ) {
86	$user = get_user_by( 'id', $user_id );
87
88	return false !== $user && is_a( $user, 'WP_User' );
89	}
90
91	/**
92	* Return the domain name of a subscription.
93	*
94	* @param Store_Subscription $subscription Subscription object.
95	* @return string
96	*/
97	protected function get_subscription_domain_name( $subscription ) {
98	return $subscription->meta;
99	}
100
101	/**
102	* Get a list of the domains owned by the given user.
103	*
104	* @param int $user_id User ID.
105	* @return array
106	*/
107	protected function domain_subscriptions_for_site_owned_by_user( $user_id ) {
108	$subscriptions = WPCOM_Store::get_subscriptions( get_current_blog_id(), $user_id, domains::get_domain_products() );
109
110	$domains = array_unique( array_map( array( $this, 'get_subscription_domain_name' ), $subscriptions ) );
111
112	return array_values( $domains );
113	}
114
115	/**
116	* Validates user input and then decides whether to remove or delete a user.
117	*
118	* @param int $user_id User ID.
119	* @return array\|WP_Error
120	*/
121	public function delete_or_remove_user( $user_id ) {
122	if ( 0 === (int) $user_id ) {
123	return new WP_Error( 'invalid_input', 'A valid user ID must be specified.', 400 );
124	}
125
126	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
127	$domains = $this->domain_subscriptions_for_site_owned_by_user( $user_id );
128	if ( ! empty( $domains ) ) {
129	$error = new WP_Error( 'user_owns_domain_subscription', implode( ', ', $domains ) );
130	$error->add_data( $domains, 'additional_data' );
131	return $error;
132	}
133
134	$active_user_subscriptions = WPCOM_Store::get_user_subscriptions( $user_id, get_current_blog_id() );
135	if ( ! empty( $active_user_subscriptions ) ) {
136	$product_names = array_values( wp_list_pluck( $active_user_subscriptions, 'product_name' ) );
137	$error = new WP_Error( 'user_has_active_subscriptions', 'User has active subscriptions' );
138	$error->add_data( $product_names, 'additional_data' );
139	return $error;
140	}
141	}
142
143	if ( ! $this->user_exists( $user_id ) ) {
144	return new WP_Error( 'invalid_input', 'A user does not exist with that ID.', 400 );
145	}
146
147	return is_multisite() ? $this->remove_user( $user_id ) : $this->delete_user( $user_id );
148	}
149
150	/**
151	* Removes a user from the current site.
152	*
153	* @param int $user_id User ID.
154	* @return array\|WP_Error
155	*/
156	public function remove_user( $user_id ) {
157	// Skip the check if the user is removing themselves.
158	if ( ! current_user_can( 'remove_users' ) && get_current_user_id() !== (int) $user_id ) {
159	return new WP_Error( 'unauthorized', 'User cannot remove users for specified site.', 403 );
160	}
161
162	if ( ! is_user_member_of_blog( $user_id, get_current_blog_id() ) ) {
163	return new WP_Error( 'invalid_input', 'User is not a member of the specified site.', 400 );
164	}
165
166	return array(
167	'success' => remove_user_from_blog( $user_id, get_current_blog_id() ),
168	);
169	}
170
171	/**
172	* Deletes a user and optionally reassigns posts to another user.
173	*
174	* @param int $user_id User ID.
175	* @return array\|WP_Error
176	*/
177	public function delete_user( $user_id ) {
178	// Skip the check if the user is deleting themselves.
179	if ( ! current_user_can( 'delete_users' ) && get_current_user_id() !== (int) $user_id ) {
180	return new WP_Error( 'unauthorized', 'User cannot delete users for specified site.', 403 );
181	}
182
183	$input = (array) $this->input();
184	$reassign = isset( $input['reassign'] ) ? (int) $input['reassign'] : null;
185
186	if ( $reassign !== null ) {
187	if ( (int) $user_id === $reassign ) {
188	return new WP_Error( 'invalid_input', 'Cannot reassign posts to user being deleted.', 400 );
189	}
190
191	if ( ! $this->user_exists( $reassign ) ) {
192	return new WP_Error( 'invalid_input', 'User specified in reassign argument is not a member of the specified site.', 400 );
193	}
194	}
195
196	$success = $reassign !== null ? wp_delete_user( $user_id, $reassign ) : wp_delete_user( $user_id );
197
198	return array(
199	'success' => $success,
200	);
201	}
202	}
203