jetpack / jetpack_vendor / automattic / jetpack-publicize / src / rest-api / class-base-controller.php

class-base-controller.php in Jetpack – WP Security, Backup, Speed, & Growth 16.3-a.7, at jetpack_vendor/automattic/jetpack-publicize/src/rest-api/class-base-controller.php

125 lines 3.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Base Controller class.
4	*
5	* @package automattic/jetpack-publicize
6	*/
7
8	namespace Automattic\Jetpack\Publicize\REST_API;
9
10	use Automattic\Jetpack\Publicize\Connections;
11	use Automattic\Jetpack\Publicize\Publicize_Utils;
12	use WP_Error;
13	use WP_REST_Controller;
14	use WP_REST_Request;
15	use WP_REST_Response;
16
17	/**
18	* Base controller for Publicize endpoints.
19	*/
20	abstract class Base_Controller extends WP_REST_Controller {
21
22	/**
23	* Whether to allow requests as blog.
24	*
25	* @var bool
26	*/
27	protected $allow_requests_as_blog = false;
28
29	/**
30	* Constructor.
31	*/
32	public function __construct() {
33	$this->wpcom_is_wpcom_only_endpoint = true;
34	}
35
36	/**
37	* Check if the request is authorized for the blog.
38	*
39	* @return bool
40	*/
41	protected static function is_authorized_blog_request() {
42	if ( Publicize_Utils::is_wpcom() && is_jetpack_site( get_current_blog_id() ) ) {
43
44	$jp_auth_endpoint = new \WPCOM_REST_API_V2_Endpoint_Jetpack_Auth();
45
46	return $jp_auth_endpoint->is_jetpack_authorized_for_site() === true;
47	}
48
49	return false;
50	}
51
52	/**
53	* Filters out data based on ?_fields= request parameter
54	*
55	* @param array $item Item to prepare.
56	* @param WP_REST_Request $request Full details about the request.
57	*
58	* @return WP_REST_Response filtered item
59	*/
60	public function prepare_item_for_response( $item, $request ) {
61
62	$fields = $this->get_fields_for_response( $request );
63
64	$response_data = array();
65	foreach ( $item as $field => $value ) {
66	if ( rest_is_field_included( $field, $fields ) ) {
67	$response_data[ $field ] = $value;
68	}
69	}
70
71	return rest_ensure_response( $response_data );
72	}
73
74	/**
75	* Verify that user can access Publicize data
76	*
77	* @return true\|WP_Error
78	*/
79	protected function publicize_permissions_check() {
80
81	global $publicize;
82
83	if ( ! $publicize ) {
84	return new WP_Error(
85	'publicize_not_available',
86	__( 'Sorry, Jetpack Social is not available on your site right now.', 'jetpack-publicize-pkg' ),
87	array( 'status' => rest_authorization_required_code() )
88	);
89	}
90
91	if ( $this->allow_requests_as_blog && self::is_authorized_blog_request() ) {
92	return true;
93	}
94
95	if ( $publicize->current_user_can_access_publicize_data() ) {
96	return true;
97	}
98
99	return new WP_Error(
100	'invalid_user_permission_publicize',
101	__( 'Sorry, you are not allowed to access Jetpack Social data on this site.', 'jetpack-publicize-pkg' ),
102	array( 'status' => rest_authorization_required_code() )
103	);
104	}
105
106	/**
107	* Check whether the request is allowed to manage (update/delete) a connection.
108	*
109	* @param WP_REST_Request $request Full details about the request.
110	* @return bool True if the request can manage connection, false otherwise.
111	*/
112	protected function manage_connection_permission_check( $request ) {
113	// Editors and above can manage any connection.
114	if ( current_user_can( 'edit_others_posts' ) ) {
115	return true;
116	}
117
118	$connection_id = $request->get_param( 'connection_id' );
119
120	$connection = Connections::get_by_id( $connection_id );
121
122	return Connections::user_owns_connection( $connection );
123	}
124	}
125