jetpack / jetpack_vendor / automattic / jetpack-connection / src / class-manager.php

class-manager.php in Jetpack – WP Security, Backup, Speed, & Growth 16.3-beta, at jetpack_vendor/automattic/jetpack-connection/src/class-manager.php

4,045 lines 138.1 KB

Raw Download Zip

1	<?php
2	/**
3	* The Jetpack Connection manager class file.
4	*
5	* @package automattic/jetpack-connection
6	*/
7
8	namespace Automattic\Jetpack\Connection;
9
10	use Automattic\Jetpack\A8c_Mc_Stats;
11	use Automattic\Jetpack\Constants;
12	use Automattic\Jetpack\Heartbeat;
13	use Automattic\Jetpack\Identity_Crisis;
14	use Automattic\Jetpack\Partner;
15	use Automattic\Jetpack\Roles;
16	use Automattic\Jetpack\Status;
17	use Automattic\Jetpack\Status\Host;
18	use Automattic\Jetpack\Terms_Of_Service;
19	use Automattic\Jetpack\Tracking;
20	use IXR_Error;
21	use Jetpack_IXR_Client;
22	use Jetpack_Options;
23	use Jetpack_XMLRPC_Server;
24	use WP_Error;
25	use WP_User;
26
27	/**
28	* The Jetpack Connection Manager class that is used as a single gateway between WordPress.com
29	* and Jetpack.
30	*/
31	class Manager {
32	/**
33	* Prefix of the transient holding the cached WordPress.com site record. The blog ID is
34	* appended so a reconnect to a different site cannot read the previous site's record.
35	*
36	* @since 9.0.0
37	*
38	* @var string
39	*/
40	const SITE_DATA_TRANSIENT_PREFIX = 'jetpack_site_data_';
41
42	/**
43	* Why `has_protected_owner()` answered false, and what would change it.
44	*
45	* `RE_EVALUATE` is the race: the gate said false, and by the time the state was classified the
46	* owner matched after all. It is not a problem to report, it is an instruction to ask again.
47	*
48	* @since 9.4.0
49	*/
50	const PO_STATE_NOT_ELIGIBLE = 'NOT_ELIGIBLE';
51	const PO_STATE_NEEDS_CONNECT_TO_ESTABLISH = 'NEEDS_CONNECT_TO_ESTABLISH';
52	const PO_STATE_CAN_ESTABLISH = 'CAN_ESTABLISH';
53	const PO_STATE_NEEDS_OWNER_RECONNECT = 'NEEDS_OWNER_RECONNECT';
54	const PO_STATE_NEEDS_DIFFERENT_OWNER = 'NEEDS_DIFFERENT_OWNER';
55	const PO_STATE_RE_EVALUATE = 'RE_EVALUATE';
56
57	/**
58	* A copy of the raw POST data for signature verification purposes.
59	*
60	* @var string
61	*/
62	protected $raw_post_data;
63
64	/**
65	* Verification data needs to be stored to properly verify everything.
66	*
67	* @var Object
68	*/
69	private $xmlrpc_verification = null;
70
71	/**
72	* Plugin management object.
73	*
74	* @var Plugin
75	*/
76	private $plugin = null;
77
78	/**
79	* Error handler object.
80	*
81	* @var Error_Handler
82	*/
83	public $error_handler = null;
84
85	/**
86	* Jetpack_XMLRPC_Server object
87	*
88	* @var Jetpack_XMLRPC_Server
89	*/
90	public $xmlrpc_server = null;
91
92	/**
93	* Holds extra parameters that will be sent along in the register request body.
94	*
95	* Use Manager::add_register_request_param to add values to this array.
96	*
97	* @since 1.26.0
98	* @var array
99	*/
100	private static $extra_register_params = array();
101
102	/**
103	* We store ID's of users already disconnected to prevent multiple disconnect requests.
104	*
105	* @var array
106	*/
107	private static $disconnected_users = array();
108
109	/**
110	* Cached connection status.
111	*
112	* @var bool\|null True if the site is connected, false if not, null if not determined yet.
113	*/
114	private static $is_connected = null;
115
116	/**
117	* Memoized user ID of the connection owner.
118	* If undefined or invalid, set to 0.
119	*
120	* @var null\|int
121	*/
122	private static $connection_owner_id = null;
123
124	/**
125	* Tracks whether connection status invalidation hooks have been added.
126	*
127	* @var bool
128	*/
129	private static $connection_invalidators_added = false;
130
131	/**
132	* Initialize the object.
133	* Make sure to call the "Configure" first.
134	*
135	* @param string $plugin_slug Slug of the plugin using the connection (optional, but encouraged).
136	*
137	* @see \Automattic\Jetpack\Config
138	*/
139	public function __construct( $plugin_slug = null ) {
140	if ( $plugin_slug && is_string( $plugin_slug ) ) {
141	$this->set_plugin_instance( new Plugin( $plugin_slug ) );
142	}
143	}
144
145	/**
146	* Initializes required listeners. This is done separately from the constructors
147	* because some objects sometimes need to instantiate separate objects of this class.
148	*
149	* @todo Implement a proper nonce verification.
150	*/
151	public static function configure() {
152	$manager = new self();
153
154	add_filter(
155	'jetpack_constant_default_value',
156	__NAMESPACE__ . '\Utils::jetpack_api_constant_filter',
157	10,
158	2
159	);
160
161	$manager->setup_xmlrpc_handlers(
162	null,
163	$manager->has_connected_owner(),
164	$manager->verify_xml_rpc_signature()
165	);
166
167	$manager->error_handler = Error_Handler::get_instance();
168
169	if ( $manager->is_connected() ) {
170	add_filter( 'xmlrpc_methods', array( $manager, 'public_xmlrpc_methods' ) );
171	add_filter( 'shutdown', array( Package_Version_Tracker::class, 'update_on_shutdown' ) );
172	}
173
174	// This runs on priority 11 - at least one api method in the connection package is set to override a previously
175	// existing method from the Jetpack plugin. Running later than Jetpack's api init ensures the override is successful.
176	add_action( 'rest_api_init', array( $manager, 'initialize_rest_api_registration_connector' ), 11 );
177
178	( new Nonce_Handler() )->init_schedule();
179
180	add_action( 'plugins_loaded', __NAMESPACE__ . '\Plugin_Storage::configure', 100 );
181
182	add_filter( 'map_meta_cap', array( $manager, 'jetpack_connection_custom_caps' ), 1, 4 );
183
184	Heartbeat::init();
185	add_filter( 'jetpack_heartbeat_stats_array', array( $manager, 'add_stats_to_heartbeat' ) );
186	add_action( 'jetpack_verify_signature_error', array( $manager, 'track_xmlrpc_error' ) );
187
188	Webhooks::init( $manager );
189
190	add_action( 'pre_update_jetpack_option_user_tokens', array( $manager, 'unbind_wpcom_user_ids_for_new_tokens' ), 10, 2 );
191	add_action( 'jetpack_user_authorized', array( $manager, 'reconcile_protected_owner' ) );
192
193	// Unlink user before deleting the user from WP.com.
194	add_action( 'deleted_user', array( $manager, 'disconnect_user_force' ), 9, 1 );
195	add_action( 'remove_user_from_blog', array( $manager, 'disconnect_user_force' ), 9, 1 );
196
197	// Add hooks for cleaning up account mismatch transients
198	$user_account_status = new User_Account_Status();
199	add_action( 'delete_user', array( $user_account_status, 'clean_account_mismatch_transients' ), 9, 1 );
200	add_action( 'remove_user_from_blog', array( $user_account_status, 'clean_account_mismatch_transients' ), 9, 1 );
201	add_action( 'user_register', array( $user_account_status, 'clean_account_mismatch_transients' ), 9, 1 );
202	add_action( 'profile_update', array( $user_account_status, 'clean_account_mismatch_transients' ), 9, 1 );
203
204	$manager->add_connection_status_invalidation_hooks();
205
206	// Set up package version hook.
207	add_filter( 'jetpack_package_versions', __NAMESPACE__ . '\Package_Version::send_package_version_to_tracker' );
208
209	if ( defined( 'JETPACK__SANDBOX_DOMAIN' ) && JETPACK__SANDBOX_DOMAIN ) {
210	( new Server_Sandbox() )->init();
211	}
212
213	// Initialize connection notices.
214	new Connection_Notice();
215
216	// Initialize token locks.
217	new Tokens_Locks();
218
219	// Initial Partner management.
220	Partner::init();
221
222	// WP 7.0+ Connectors screen card.
223	Jetpack_Connector::init();
224
225	// Site Health integration.
226	Site_Health::init();
227	}
228
229	/**
230	* Adds hooks to invalidate the memoized connection status.
231	*/
232	private function add_connection_status_invalidation_hooks() {
233	if ( self::$connection_invalidators_added ) {
234	return;
235	}
236
237	// Force is_connected() to recompute after important actions.
238	add_action( 'jetpack_site_registered', array( $this, 'reset_connection_status' ) );
239	add_action( 'jetpack_site_disconnected', array( $this, 'reset_connection_status' ) );
240	// Deletion doesn't fire `pre_update_jetpack_option_*`; see the action's docblock in `Tokens::delete_all()`.
241	add_action( 'jetpack_connection_tokens_deleted', array( $this, 'reset_connection_status' ) );
242	add_action( 'jetpack_sync_register_user', array( $this, 'reset_connection_status' ) );
243	add_action( 'pre_update_jetpack_option_id', array( $this, 'reset_connection_status' ) );
244	add_action( 'pre_update_jetpack_option_blog_token', array( $this, 'reset_connection_status' ) );
245	add_action( 'pre_update_jetpack_option_user_token', array( $this, 'reset_connection_status' ) );
246	add_action( 'pre_update_jetpack_option_user_tokens', array( $this, 'reset_connection_status' ) );
247	add_action( 'pre_update_jetpack_option_master_user', array( $this, 'reset_connection_status' ) );
248	// phpcs:ignore WPCUT.SwitchBlog.SwitchBlog -- wpcom flags every use of switch_blog, apparently expecting valid instances to ignore or suppress the sniff.
249	add_action( 'switch_blog', array( $this, 'reset_connection_status' ) );
250	add_action( 'jetpack_external_storage_provider_registered', array( $this, 'reset_connection_status' ), 10, 0 );
251
252	self::$connection_invalidators_added = true;
253	}
254
255	/**
256	* Sets up the XMLRPC request handlers.
257	*
258	* @since 1.25.0 Deprecate $is_active param.
259	* @since 2.8.4 Deprecate $request_params param.
260	*
261	* @param array\|null $deprecated Deprecated. Not used.
262	* @param bool $has_connected_owner Whether the site has a connected owner.
263	* @param bool $is_signed whether the signature check has been successful.
264	* @param Jetpack_XMLRPC_Server $xmlrpc_server (optional) an instance of the server to use instead of instantiating a new one.
265	*/
266	public function setup_xmlrpc_handlers(
267	$deprecated,
268	$has_connected_owner,
269	$is_signed,
270	?Jetpack_XMLRPC_Server $xmlrpc_server = null
271	) {
272	add_filter( 'xmlrpc_blog_options', array( $this, 'xmlrpc_options' ), 1000, 2 );
273	if ( $deprecated !== null ) {
274	_deprecated_argument( __METHOD__, '2.8.4' );
275	}
276	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- We are using the 'for' request param to early return unless it's 'jetpack'.
277	if ( ! isset( $_GET['for'] ) \|\| 'jetpack' !== $_GET['for'] ) {
278	return false;
279	}
280
281	// Alternate XML-RPC, via ?for=jetpack&jetpack=comms.
282	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This just determines whether to handle the request as an XML-RPC request. The actual XML-RPC endpoints do the appropriate nonce checking where applicable. Plus we make sure to clear all cookies via require_jetpack_authentication called later in method.
283	if ( isset( $_GET['jetpack'] ) && 'comms' === $_GET['jetpack'] ) {
284	if ( ! Constants::is_defined( 'XMLRPC_REQUEST' ) ) {
285	// Use the real constant here for WordPress' sake.
286	define( 'XMLRPC_REQUEST', true );
287	}
288
289	add_action( 'template_redirect', array( $this, 'alternate_xmlrpc' ) );
290
291	add_filter( 'xmlrpc_methods', array( $this, 'remove_non_jetpack_xmlrpc_methods' ), 1000 );
292	}
293
294	if ( ! Constants::get_constant( 'XMLRPC_REQUEST' ) ) {
295	return false;
296	}
297
298	// Display errors can cause the XML to be not well formed.
299	// This only affects Jetpack XML-RPC endpoints received from WordPress.com servers.
300	// All other XML-RPC requests are unaffected.
301	@ini_set( 'display_errors', false ); // phpcs:ignore
302
303	if ( $xmlrpc_server ) {
304	$this->xmlrpc_server = $xmlrpc_server;
305	} else {
306	$this->xmlrpc_server = new Jetpack_XMLRPC_Server();
307	}
308
309	$this->require_jetpack_authentication();
310
311	if ( $is_signed ) {
312	// If the site is connected either at a site or user level and the request is signed, expose the methods.
313	// The callback is responsible to determine whether the request is signed with blog or user token and act accordingly.
314	// The actual API methods.
315	$callback = array( $this->xmlrpc_server, 'xmlrpc_methods' );
316
317	// Hack to preserve $HTTP_RAW_POST_DATA.
318	add_filter( 'xmlrpc_methods', array( $this, 'xmlrpc_methods' ) );
319
320	} elseif ( $has_connected_owner ) {
321	// The jetpack.authorize method should be available for unauthenticated users on a site with an
322	// active Jetpack connection, so that additional users can link their account.
323	$callback = array( $this->xmlrpc_server, 'authorize_xmlrpc_methods' );
324	} else {
325	// Any other unsigned request should expose the bootstrap methods.
326	$callback = array( $this->xmlrpc_server, 'bootstrap_xmlrpc_methods' );
327	new XMLRPC_Connector( $this );
328	}
329
330	add_filter( 'xmlrpc_methods', $callback );
331
332	// Now that no one can authenticate, and we're whitelisting all XML-RPC methods, force enable_xmlrpc on.
333	add_filter( 'pre_option_enable_xmlrpc', '__return_true' );
334	return true;
335	}
336
337	/**
338	* Initializes the REST API connector on the init hook.
339	*/
340	public function initialize_rest_api_registration_connector() {
341	new REST_Connector( $this );
342	}
343
344	/**
345	* Since a lot of hosts use a hammer approach to "protecting" WordPress sites,
346	* and just blanket block all requests to /xmlrpc.php, or apply other overly-sensitive
347	* security/firewall policies, we provide our own alternate XML RPC API endpoint
348	* which is accessible via a different URI. Most of the below is copied directly
349	* from /xmlrpc.php so that we're replicating it as closely as possible.
350	*
351	* @todo Tighten $wp_xmlrpc_server_class a bit to make sure it doesn't do bad things.
352	*
353	* @return never
354	*/
355	public function alternate_xmlrpc() {
356	// Some browser-embedded clients send cookies. We don't want them.
357	$_COOKIE = array();
358
359	include_once ABSPATH . 'wp-admin/includes/admin.php';
360	include_once ABSPATH . WPINC . '/class-IXR.php';
361	include_once ABSPATH . WPINC . '/class-wp-xmlrpc-server.php';
362
363	/**
364	* Filters the class used for handling XML-RPC requests.
365	*
366	* @since 1.7.0
367	* @since-jetpack 3.1.0
368	*
369	* @param string $class The name of the XML-RPC server class.
370	*/
371	$wp_xmlrpc_server_class = apply_filters( 'wp_xmlrpc_server_class', 'wp_xmlrpc_server' );
372	$wp_xmlrpc_server = new $wp_xmlrpc_server_class();
373
374	// Fire off the request.
375	nocache_headers();
376	$wp_xmlrpc_server->serve_request();
377
378	exit( 0 );
379	}
380
381	/**
382	* Removes all XML-RPC methods that are not `jetpack.*`.
383	* Only used in our alternate XML-RPC endpoint, where we want to
384	* ensure that Core and other plugins' methods are not exposed.
385	*
386	* @param array $methods a list of registered WordPress XMLRPC methods.
387	* @return array filtered $methods
388	*/
389	public function remove_non_jetpack_xmlrpc_methods( $methods ) {
390	$jetpack_methods = array();
391
392	foreach ( $methods as $method => $callback ) {
393	if ( str_starts_with( $method, 'jetpack.' ) ) {
394	$jetpack_methods[ $method ] = $callback;
395	}
396	}
397
398	return $jetpack_methods;
399	}
400
401	/**
402	* Removes all other authentication methods not to allow other
403	* methods to validate unauthenticated requests.
404	*/
405	public function require_jetpack_authentication() {
406	// Don't let anyone authenticate.
407	$_COOKIE = array();
408	remove_all_filters( 'authenticate' );
409	remove_all_actions( 'wp_login_failed' );
410
411	if ( $this->is_connected() ) {
412	// Allow Jetpack authentication.
413	add_filter( 'authenticate', array( $this, 'authenticate_jetpack' ), 10, 3 );
414	}
415	}
416
417	/**
418	* Authenticates XML-RPC and other requests from the Jetpack Server
419	*
420	* @param WP_User\|mixed $user user object if authenticated.
421	* @param string $username username.
422	* @param string $password password string.
423	* @return WP_User\|mixed authenticated user or error.
424	*/
425	public function authenticate_jetpack( $user, $username, $password ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
426	if ( is_a( $user, '\\WP_User' ) ) {
427	return $user;
428	}
429
430	$token_details = $this->verify_xml_rpc_signature();
431
432	if ( ! $token_details ) {
433	return $user;
434	}
435
436	if ( 'user' !== $token_details['type'] ) {
437	return $user;
438	}
439
440	if ( ! $token_details['user_id'] ) {
441	return $user;
442	}
443
444	nocache_headers();
445
446	return new \WP_User( $token_details['user_id'] );
447	}
448
449	/**
450	* Verifies the signature of the current request.
451	*
452	* @return false\|array
453	*/
454	public function verify_xml_rpc_signature() {
455	if ( $this->xmlrpc_verification === null ) {
456	$this->xmlrpc_verification = $this->internal_verify_xml_rpc_signature();
457
458	if ( is_wp_error( $this->xmlrpc_verification ) ) {
459	/**
460	* Action for logging XMLRPC signature verification errors. This data is sensitive.
461	*
462	* @since 1.7.0
463	* @since-jetpack 7.5.0
464	*
465	* @param WP_Error $signature_verification_error The verification error
466	*/
467	do_action( 'jetpack_verify_signature_error', $this->xmlrpc_verification );
468
469	Error_Handler::get_instance()->report_error( $this->xmlrpc_verification );
470
471	}
472	}
473
474	return is_wp_error( $this->xmlrpc_verification ) ? false : $this->xmlrpc_verification;
475	}
476
477	/**
478	* Verifies the signature of the current request.
479	*
480	* This function has side effects and should not be used. Instead,
481	* use the memoized version `->verify_xml_rpc_signature()`.
482	*
483	* @internal
484	* @todo Refactor to use proper nonce verification.
485	*/
486	private function internal_verify_xml_rpc_signature() {
487	// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
488	// It's not for us.
489	if ( ! isset( $_GET['token'] ) \|\| empty( $_GET['signature'] ) ) {
490	return false;
491	}
492
493	// Skip XML-RPC signature verification for OAuth authorization flow.
494	// OAuth uses GET requests without body-hash and has its own
495	// signature verification in Authorize_Json_Api class.
496	if ( isset( $_GET['action'] ) && $_GET['action'] === 'jetpack_json_api_authorization' ) {
497	return false;
498	}
499
500	$signature_details = array(
501	'token' => isset( $_GET['token'] ) ? wp_unslash( $_GET['token'] ) : '',
502	'timestamp' => isset( $_GET['timestamp'] ) ? wp_unslash( $_GET['timestamp'] ) : '',
503	'nonce' => isset( $_GET['nonce'] ) ? wp_unslash( $_GET['nonce'] ) : '',
504	'body_hash' => isset( $_GET['body-hash'] ) ? wp_unslash( $_GET['body-hash'] ) : '',
505	'method' => isset( $_SERVER['REQUEST_METHOD'] ) ? wp_unslash( $_SERVER['REQUEST_METHOD'] ) : null,
506	'url' => wp_unslash( ( $_SERVER['HTTP_HOST'] ?? null ) . ( $_SERVER['REQUEST_URI'] ?? null ) ), // Temp - will get real signature URL later.
507	'signature' => isset( $_GET['signature'] ) ? wp_unslash( $_GET['signature'] ) : '',
508	);
509
510	// Transport of the incoming request being verified. This signature-verification path
511	// serves both XML-RPC requests and signed REST requests (REST_Authentication funnels
512	// REST authentication into verify_xml_rpc_signature()), so the stored error type is
513	// derived from the actual request context rather than hardcoded.
514	$error_type = $this->get_current_request_transport();
515	$error_direction = 'incoming'; // Matches Error_Handler::DIRECTION_INCOMING — see build_connection_error_data() for why the constant is not referenced.
516
517	// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
518	@list( $token_key, $version, $user_id ) = explode( ':', wp_unslash( $_GET['token'] ) );
519	// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
520
521	$jetpack_api_version = Constants::get_constant( 'JETPACK__API_VERSION' );
522
523	if (
524	empty( $token_key )
525	\|\| empty( $version )
526	\|\| (string) $jetpack_api_version !== $version
527	) {
528	return new \WP_Error( 'malformed_token', 'Malformed token in request', $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
529	}
530
531	if ( '0' === $user_id ) {
532	$token_type = 'blog';
533	$user_id = 0;
534	} else {
535	$token_type = 'user';
536	if ( empty( $user_id ) \|\| ! ctype_digit( $user_id ) ) {
537	return new \WP_Error(
538	'malformed_user_id',
539	'Malformed user_id in request',
540	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
541	);
542	}
543	$user_id = (int) $user_id;
544
545	$user = new \WP_User( $user_id );
546	if ( ! $user->exists() ) {
547	return new \WP_Error(
548	'unknown_user',
549	sprintf( 'User %d does not exist', $user_id ),
550	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
551	);
552	}
553	}
554
555	$token = $this->get_tokens()->get_access_token( $user_id, $token_key, false );
556	if ( is_wp_error( $token ) ) {
557	$token->add_data( $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
558	return $token;
559	} elseif ( ! $token ) {
560	// `get_access_token()` explains itself for every case but one: it returns a bare
561	// `false` when the tokens are locked (Tokens::is_locked()). The lock is
562	// one-shot and self-healing.
563	return new \WP_Error(
564	'tokens_locked',
565	sprintf( 'Tokens are locked; %s:%s:%d could not be verified', $token_key, $version, $user_id ),
566	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
567	);
568	}
569
570	$jetpack_signature = new \Jetpack_Signature( $token->secret, (int) \Jetpack_Options::get_option( 'time_diff' ) );
571	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Used to verify a cryptographic signature of the post data. Also a nonce is verified later in the function.
572	if ( isset( $_POST['_jetpack_is_multipart'] ) ) {
573	$post_data = $_POST; // We need all of $_POST in order to verify a cryptographic signature of the post data.
574	$file_hashes = array();
575	foreach ( $post_data as $post_data_key => $post_data_value ) {
576	if ( ! str_starts_with( $post_data_key, '_jetpack_file_hmac_' ) ) {
577	continue;
578	}
579	$post_data_key = substr( $post_data_key, strlen( '_jetpack_file_hmac_' ) );
580	$file_hashes[ $post_data_key ] = $post_data_value;
581	}
582
583	foreach ( $file_hashes as $post_data_key => $post_data_value ) {
584	unset( $post_data[ "_jetpack_file_hmac_{$post_data_key}" ] );
585	$post_data[ $post_data_key ] = $post_data_value;
586	}
587
588	ksort( $post_data );
589
590	$body = http_build_query( stripslashes_deep( $post_data ) );
591	} elseif ( $this->raw_post_data === null ) {
592	$body = file_get_contents( 'php://input' );
593	} else {
594	$body = null;
595	}
596	// phpcs:enable
597
598	$signature = $jetpack_signature->sign_current_request(
599	array( 'body' => $body === null ? $this->raw_post_data : $body )
600	);
601
602	$signature_details['url'] = $jetpack_signature->current_request_url;
603
604	// This path currently can't ever be true, unless a new path is added resulting
605	// in $signature 'false', null or an empty string. Leaving for additional security.
606	if ( ! $signature ) {
607	return new \WP_Error(
608	'could_not_sign',
609	'Unknown signature error',
610	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
611	);
612	} elseif ( is_wp_error( $signature ) ) {
613	// Jetpack_Signature errors carry their own signature_details (or, for some codes,
614	// no data at all) but never a type or direction; normalize them into the standard
615	// error data shape so Error_Handler can attribute and store them.
616	$signature_error_data = $signature->get_error_data();
617	if ( isset( $signature_error_data['signature_details'] ) && is_array( $signature_error_data['signature_details'] ) ) {
618	$signature_details = array_merge( $signature_details, $signature_error_data['signature_details'] );
619	}
620	$signature->add_data( $this->build_connection_error_data( $signature_details, $error_type, $error_direction ) );
621	return $signature;
622	}
623
624	// phpcs:disable WordPress.Security.NonceVerification.Recommended
625	$timestamp = (int) $_GET['timestamp'];
626	$nonce = wp_unslash( (string) $_GET['nonce'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- WP Core doesn't sanitize nonces either.
627	// phpcs:enable WordPress.Security.NonceVerification.Recommended
628
629	// Use up the nonce regardless of whether the signature matches.
630	if ( ! ( new Nonce_Handler() )->add( $timestamp, $nonce ) ) {
631	return new \WP_Error(
632	'invalid_nonce',
633	'Could not add nonce',
634	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
635	);
636	}
637
638	// Be careful about what you do with this debugging data.
639	// If a malicious requester has access to the expected signature,
640	// bad things might be possible.
641	$signature_details['expected'] = $signature;
642
643	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
644	if ( ! hash_equals( $signature, wp_unslash( $_GET['signature'] ) ) ) {
645	return new \WP_Error(
646	'signature_mismatch',
647	'Signature mismatch',
648	$this->build_connection_error_data( $signature_details, $error_type, $error_direction )
649	);
650	}
651
652	/**
653	* Action for additional token checking.
654	*
655	* @since 1.7.0
656	* @since-jetpack 7.7.0
657	*
658	* @param array $post_data request data.
659	* @param array $token_data token data.
660	*/
661	return apply_filters(
662	'jetpack_signature_check_token',
663	array(
664	'type' => $token_type,
665	'token_key' => $token_key,
666	'user_id' => $token->external_user_id,
667	),
668	$token,
669	$this->raw_post_data
670	);
671	}
672
673	/**
674	* Determines the transport of the incoming request currently being verified.
675	*
676	* @since 8.9.0
677	*
678	* @return string Error_Handler::ERROR_TYPE_XMLRPC or Error_Handler::ERROR_TYPE_REST.
679	*/
680	private function get_current_request_transport() {
681	$is_xmlrpc = defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST;
682
683	// XMLRPC_REQUEST covers both /xmlrpc.php and the alternate XML-RPC endpoint, which
684	// defines the constant itself (see setup_xmlrpc_handlers). Outside those, signed REST
685	// requests are detected via the REST dispatch state. Anything else (e.g. signed
686	// requests verified on the 'authenticate' filter for regular URLs) keeps the historic
687	// XML-RPC label rather than guessing at a transport.
688	$is_rest = ! $is_xmlrpc && ( function_exists( 'wp_is_rest_endpoint' ) ? wp_is_rest_endpoint() : ( defined( 'REST_REQUEST' ) && REST_REQUEST ) );
689
690	// Signature verification can run before REST dispatch is set up: REST_Authentication
691	// hooks `determine_current_user`, which any plugin can trigger early (e.g. by calling
692	// wp_get_current_user() on plugins_loaded), before the REST_REQUEST constant exists.
693	// In that window, recognize REST requests by their URL: the REST prefix in the path,
694	// or the rest_route query argument used by sites without pretty permalinks.
695	if ( ! $is_xmlrpc && ! $is_rest ) {
696	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only used to classify the request transport.
697	$has_rest_route_arg = isset( $_GET['rest_route'] );
698	$request_path = (string) wp_parse_url( isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( $_SERVER['REQUEST_URI'] ) : '', PHP_URL_PATH ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Parsed for path comparison only.
699	$is_rest = $has_rest_route_arg \|\| false !== strpos( $request_path, '/' . rest_get_url_prefix() . '/' );
700	}
701
702	// The literals match Error_Handler::ERROR_TYPE_REST / ERROR_TYPE_XMLRPC — see
703	// build_connection_error_data() for why the constants are not referenced.
704	return $is_rest ? 'rest' : 'xmlrpc';
705	}
706
707	/**
708	* Builds the standardized connection error data attached to signature-verification errors.
709	*
710	* Wraps `Error_Handler::build_connection_error_data()`, falling back to the legacy
711	* error-data shape when the loaded Error_Handler predates that method: during a plugin
712	* update, an older version of the class can already be in memory while this file is the
713	* new one, and a mid-update request must never fatal. For the same reason, code in this
714	* class must not reference Error_Handler constants introduced along with that method
715	* ('xmlrpc', 'rest', 'local_state', 'incoming', 'outgoing') — use the literal values.
716	*
717	* @since 8.10.0
718	*
719	* @param array $signature_details Details of the request signature being verified.
720	* @param string $error_type The transport of the request: 'xmlrpc' or 'rest'.
721	* @param string $error_direction The direction of the request: 'incoming' or 'outgoing'.
722	* @return array Error data for `WP_Error`.
723	*/
724	private function build_connection_error_data( $signature_details, $error_type, $error_direction ) {
725	if ( ! method_exists( Error_Handler::class, 'build_connection_error_data' ) ) {
726	return compact( 'signature_details', 'error_type' );
727	}
728	return Error_Handler::build_connection_error_data( $signature_details, $error_type, $error_direction );
729	}
730
731	/**
732	* Returns true if the current site is connected to WordPress.com and has the minimum requirements to enable Jetpack UI.
733	*
734	* This method is deprecated since version 1.25.0 of this package. Please use has_connected_owner instead.
735	*
736	* Since this method has a wide spread use, we decided not to throw any deprecation warnings for now.
737	*
738	* @deprecated 1.25.0
739	* @see Manager::has_connected_owner
740	* @return bool is the site connected?
741	*/
742	public function is_active() {
743	return (bool) $this->get_tokens()->get_access_token( true );
744	}
745
746	/**
747	* Obtains an instance of the Tokens class.
748	*
749	* @return Tokens the Tokens object
750	*/
751	public function get_tokens() {
752	return new Tokens();
753	}
754
755	/**
756	* Returns true if the site has both a token and a blog id, which indicates a site has been registered.
757	*
758	* @access public
759	* @deprecated 1.12.1 Use is_connected instead
760	* @see Manager::is_connected
761	*
762	* @return bool
763	*/
764	public function is_registered() {
765	_deprecated_function( __METHOD__, '1.12.1' );
766	return $this->is_connected();
767	}
768
769	/**
770	* Returns true if the site has both a token and a blog id, which indicates a site has been connected.
771	*
772	* @access public
773	* @since 1.21.1
774	*
775	* @return bool
776	*/
777	public function is_connected() {
778	if ( self::$is_connected === null ) {
779	if ( ! self::$connection_invalidators_added ) {
780	$this->add_connection_status_invalidation_hooks();
781	}
782
783	$has_blog_id = (bool) \Jetpack_Options::get_option( 'id' );
784	if ( $has_blog_id ) {
785	self::$is_connected = (bool) $this->get_tokens()->get_access_token();
786	} else {
787	// Short-circuit, no need to check for tokens if there's no blog ID.
788	self::$is_connected = false;
789	}
790	}
791	return self::$is_connected;
792	}
793
794	/**
795	* Resets the memoized connection status.
796	* This will force the connection status to be recomputed on the next check.
797	*
798	* @since 5.0.0
799	*/
800	public function reset_connection_status() {
801	self::$is_connected = null;
802	self::$connection_owner_id = null;
803	}
804
805	/**
806	* Returns true if the site has at least one connected administrator.
807	*
808	* @access public
809	* @since 1.21.1
810	*
811	* @return bool
812	*/
813	public function has_connected_admin() {
814	return (bool) count( $this->get_connected_users( 'manage_options' ) );
815	}
816
817	/**
818	* Returns true if the site has any connected user.
819	*
820	* @access public
821	* @since 1.21.1
822	*
823	* @return bool
824	*/
825	public function has_connected_user() {
826	return (bool) count( $this->get_connected_users( 'any', 1 ) );
827	}
828
829	/**
830	* Returns an array of users that have user tokens for communicating with wpcom.
831	* Able to select by specific capability.
832	*
833	* @since 9.9.1 Added $limit parameter.
834	*
835	* @param string $capability The capability of the user.
836	* @param int\|null $limit How many connected users to get before returning.
837	* @return WP_User[] Array of WP_User objects if found.
838	*/
839	public function get_connected_users( $capability = 'any', $limit = null ) {
840	$connected_users = array();
841	$user_tokens = $this->get_tokens()->get_user_tokens();
842
843	if ( ! is_array( $user_tokens ) \|\| empty( $user_tokens ) ) {
844	return $connected_users;
845	}
846	$connected_user_ids = array_keys( $user_tokens );
847
848	if ( ! empty( $connected_user_ids ) ) {
849	foreach ( $connected_user_ids as $id ) {
850	// Check for capability.
851	if ( 'any' !== $capability && ! user_can( $id, $capability ) ) {
852	continue;
853	}
854
855	$user_data = get_userdata( $id );
856	if ( $user_data instanceof \WP_User ) {
857	$connected_users[] = $user_data;
858	if ( $limit && count( $connected_users ) >= $limit ) {
859	return $connected_users;
860	}
861	}
862	}
863	}
864
865	return $connected_users;
866	}
867
868	/**
869	* Returns true if the site has a connected Blog owner (master_user).
870	*
871	* @access public
872	* @since 1.21.1
873	*
874	* @return bool
875	*/
876	public function has_connected_owner() {
877	return (bool) $this->get_connection_owner_id();
878	}
879
880	/**
881	* Returns true if the site is connected only at a site level.
882	*
883	* Note that we are explicitly checking for the existence of the master_user option in order to account for cases where we don't have any user tokens (user-level connection) but the master_user option is set, which could be the result of a problematic user connection.
884	*
885	* @access public
886	* @since 1.25.0
887	* @deprecated 1.27.0
888	*
889	* @return bool
890	*/
891	public function is_userless() {
892	_deprecated_function( __METHOD__, '1.27.0', 'Automattic\\Jetpack\\Connection\\Manager::is_site_connection' );
893	return $this->is_site_connection();
894	}
895
896	/**
897	* Returns true if the site is connected only at a site level.
898	*
899	* Note that we are explicitly checking for the existence of the master_user option in order to account for cases where we don't have any user tokens (user-level connection) but the master_user option is set, which could be the result of a problematic user connection.
900	*
901	* @access public
902	* @since 1.27.0
903	*
904	* @return bool
905	*/
906	public function is_site_connection() {
907	return $this->is_connected() && ! $this->has_connected_user() && ! \Jetpack_Options::get_option( 'master_user' );
908	}
909
910	/**
911	* Checks to see if the connection owner of the site is missing.
912	*
913	* @return bool
914	*/
915	public function is_missing_connection_owner() {
916	$connection_owner = $this->get_connection_owner_id();
917	if ( ! get_user_by( 'id', $connection_owner ) ) {
918	return true;
919	}
920
921	return false;
922	}
923
924	/**
925	* Returns true if the user with the specified identifier is connected to
926	* WordPress.com.
927	*
928	* @param int $user_id the user identifier. Default is the current user.
929	* @return bool Boolean is the user connected?
930	*/
931	public function is_user_connected( $user_id = false ) {
932	$user_id = false === $user_id ? get_current_user_id() : absint( $user_id );
933	if ( ! $user_id ) {
934	return false;
935	}
936
937	return (bool) $this->get_tokens()->get_access_token( $user_id );
938	}
939
940	/**
941	* Returns the local user ID of the connection owner.
942	*
943	* @return bool\|int Returns the ID of the connection owner or False if no connection owner found.
944	*/
945	public function get_connection_owner_id() {
946	// Check if the memoized value is available.
947	if ( null === self::$connection_owner_id ) {
948	$owner = $this->get_connection_owner();
949	self::$connection_owner_id = $owner instanceof \WP_User ? $owner->ID : 0;
950	}
951
952	// If the ID is set to 0, there's no valid connection owner.
953	return self::$connection_owner_id > 0 ? self::$connection_owner_id : false;
954	}
955
956	/**
957	* Get the wpcom user data of the current\|specified connected user.
958	*
959	* Fetches the data from the WordPress.com `jetpack-wpcom-user-data` REST endpoint
960	* with a signed request as the connected user. Routing this through
961	* Client::remote_request() (rather than the legacy `wpcom.getUser` XML-RPC method)
962	* ensures any connection errors are captured by the Error_Handler.
963	*
964	* @since 8.8.1 Fetch the data over REST instead of the `wpcom.getUser` XML-RPC method.
965	*
966	* @param int\|null $user_id the user identifier.
967	* @return bool\|array An array with the WPCOM user data on success, false otherwise.
968	*/
969	public function get_connected_user_data( $user_id = null ) {
970	if ( ! $user_id ) {
971	$user_id = get_current_user_id();
972	}
973
974	// Check if the user is connected and return false otherwise.
975	if ( ! $this->is_user_connected( $user_id ) ) {
976	return false;
977	}
978
979	$transient_key = "jetpack_connected_user_data_$user_id";
980	$cached_user_data = get_transient( $transient_key );
981
982	if ( 'error' === $cached_user_data ) {
983	return false;
984	}
985
986	if ( $cached_user_data ) {
987	return $cached_user_data;
988	}
989
990	$blog_id = (int) \Jetpack_Options::get_option( 'id' );
991
992	// Build a signed request as the connected user. We can't use
993	// Client::wpcom_json_api_request_as_user() because it always signs as the
994	// current user, whereas this method may be called for an arbitrary $user_id.
995	$args = Client::validate_args_for_wpcom_json_api_request(
996	"/sites/{$blog_id}/jetpack-wpcom-user-data",
997	'2',
998	array( 'method' => 'GET' )
999	);
1000	$args['user_id'] = $user_id;
1001
1002	$response = Client::remote_request( $args );
1003
1004	if ( is_wp_error( $response ) \|\| 200 !== wp_remote_retrieve_response_code( $response ) ) {
1005	// Cache errors briefly so a failing remote request doesn't result in
1006	// a blocking request on every call, e.g. on each admin page
1007	// load via Initial_State::set_connection_script_data().
1008	set_transient( $transient_key, 'error', 5 * MINUTE_IN_SECONDS );
1009
1010	return false;
1011	}
1012
1013	$user_data = json_decode( wp_remote_retrieve_body( $response ), true );
1014
1015	if ( ! is_array( $user_data ) \|\| empty( $user_data ) ) {
1016	set_transient( $transient_key, 'error', 5 * MINUTE_IN_SECONDS );
1017
1018	return false;
1019	}
1020
1021	set_transient( $transient_key, $user_data, DAY_IN_SECONDS );
1022
1023	return $user_data;
1024	}
1025
1026	/**
1027	* Returns the WordPress.com user ID of a connected user.
1028	*
1029	* Answers only for a user who currently holds a token: the binding outlives any one token, so
1030	* connectedness is checked here rather than inferred from a row existing. Resolving an unbound
1031	* user costs a blocking request to WordPress.com, so this is not safe to call per row.
1032	*
1033	* @since 9.2.0
1034	*
1035	* @param int\|false $user_id The local user identifier. Default is the current user.
1036	* @return int The WordPress.com user ID, or 0 if it could not be determined.
1037	*/
1038	public function resolve_wpcom_user_id( $user_id = false ) {
1039	$user_id = $user_id ? absint( $user_id ) : get_current_user_id();
1040
1041	// The binding outlives the token, unlike the transient behind `get_connected_user_data()`,
1042	// so connectedness is checked here rather than left to the lookup below.
1043	if ( ! $user_id \|\| ! $this->is_user_connected( $user_id ) ) {
1044	return 0;
1045	}
1046
1047	$bound = Utils::get_wpcom_user_id( $user_id );
1048
1049	if ( $bound ) {
1050	return $bound;
1051	}
1052
1053	$user_data = $this->get_connected_user_data( $user_id );
1054
1055	// Callers must read 0 as "unknown", never as "no match": a failed lookup lands here too.
1056	if ( empty( $user_data['ID'] ) ) {
1057	return 0;
1058	}
1059
1060	Utils::set_wpcom_user_id( $user_id, (int) $user_data['ID'] );
1061
1062	return (int) $user_data['ID'];
1063	}
1064
1065	/**
1066	* Unbind the WordPress.com user ID of any user whose token is new.
1067	*
1068	* Every path that changes a user's token writes the `user_tokens` option, so this covers
1069	* authorize, remote connect and the REST endpoint alike. A token that is added or replaced can
1070	* name a different WordPress.com account, so any binding it would answer with is unverified. A
1071	* token merely removed leaves the binding correct, and other subsystems store their own meaning
1072	* in the same meta, so removals are left alone.
1073	*
1074	* @internal Hooked on `pre_update_jetpack_option_user_tokens`, which fires before the write.
1075	* @since 9.2.0
1076	*
1077	* @param string $name The option name.
1078	* @param mixed $value The tokens about to be written.
1079	*/
1080	public function unbind_wpcom_user_ids_for_new_tokens( $name, $value ) {
1081	if ( ! is_array( $value ) ) {
1082	return;
1083	}
1084
1085	// A site disconnect deletes the option outright, so the first write back has nothing to
1086	// diff against — treat that as every token being new rather than skipping the check.
1087	$previous = \Jetpack_Options::get_option( 'user_tokens' );
1088	$previous = is_array( $previous ) ? $previous : array();
1089
1090	// Iterating the incoming tokens covers a token being added as well as replaced, and skips
1091	// removal for free: a user absent from the new set is never visited.
1092	foreach ( $value as $user_id => $token ) {
1093	if ( ( $previous[ $user_id ] ?? null ) !== $token ) {
1094	Utils::delete_wpcom_user_id( $user_id );
1095	}
1096	}
1097	}
1098
1099	/**
1100	* Drop the cached WordPress.com site record.
1101	*
1102	* A caller that fetched the record by another route holds something newer than the cache can,
1103	* and `jetpack_site_data_fetched` fires on a cached read too. The cached copy has to go, or it
1104	* keeps announcing the older record and undoes what that caller stored.
1105	*
1106	* @since 9.0.0
1107	*
1108	* @return void
1109	*/
1110	public static function delete_cached_site_data() {
1111	$site_id = \Jetpack_Options::get_option( 'id' );
1112
1113	if ( $site_id ) {
1114	delete_transient( self::SITE_DATA_TRANSIENT_PREFIX . $site_id );
1115	}
1116	}
1117
1118	/**
1119	* Fetch the site's own record from the WordPress.com `/sites/%d` endpoint.
1120	*
1121	* The result is cached briefly. Every plugin that bundles this package serves this route, and
1122	* the Jetpack dashboard requests it on mount, so an uncached read means a blocking round trip
1123	* per render.
1124	*
1125	* @since 8.10.0
1126	*
1127	* @return object\|WP_Error The decoded site record, or an error describing the failure.
1128	*/
1129	public function get_connected_site_data() {
1130	$site_id = \Jetpack_Options::get_option( 'id' );
1131
1132	if ( ! $site_id ) {
1133	return new WP_Error( 'site_id_missing', '', array( 'api_error_code' => 'site_id_missing' ) );
1134	}
1135
1136	$sandbox_secret = null;
1137
1138	// An array cookie (`store_sandbox[]=`) carries no secret to send, and `filter_var()` turns
1139	// it into `false`.
1140	if ( isset( $_COOKIE['store_sandbox'] ) && is_string( $_COOKIE['store_sandbox'] ) ) {
1141	// Keep only RFC 6265 cookie-octets so the value cannot break out of the Cookie header.
1142	$sandbox_secret = preg_replace( '/[^\x21-\x7E]\|[";,\\\\]/', '', filter_var( wp_unslash( $_COOKIE['store_sandbox'] ) ) );
1143
1144	// An empty cookie, or one the sanitizer strips to nothing, is not a sandbox secret.
1145	// Counting it as one opts the request out of the cache with no sandbox to reach.
1146	if ( '' === $sandbox_secret ) {
1147	$sandbox_secret = null;
1148	}
1149	}
1150
1151	// A sandboxed request must neither read the shared cache nor seed it with sandbox data.
1152	$sandboxed = null !== $sandbox_secret;
1153	$transient_key = self::SITE_DATA_TRANSIENT_PREFIX . $site_id;
1154
1155	// WordPress.com itself requests this route right after a purchase, for the side effect of
1156	// the `jetpack_site_data_fetched` consumers storing the new plan. Those requests arrive
1157	// signed with a connection token, which no browser request carries. A cached read would
1158	// hand that refresh the pre-purchase record and turn it into a no-op, so a signed request
1159	// always reads from WordPress.com and replaces the cache with the record it fetched.
1160	$signed = Rest_Authentication::is_signed_with_blog_token() \|\| Rest_Authentication::is_signed_with_user_token();
1161
1162	$result = ( $sandboxed \|\| $signed ) ? false : get_transient( $transient_key );
1163
1164	// Only the array shape stored below can be served. A `pre_transient_*` filter or a damaged
1165	// object cache entry can hand back anything, and a non-array would throw on
1166	// `$result['body']` for every request until the entry expired, so it reads as a miss.
1167	if ( ! is_array( $result ) ) {
1168	$result = $this->fetch_connected_site_data( $site_id, $sandbox_secret );
1169
1170	// A signed read that failed must not replace a still-usable cached record with the failure.
1171	if ( ! $sandboxed && ! ( $signed && isset( $result['error'] ) ) ) {
1172	// Failures expire sooner so an outage recovers without waiting out a full success window.
1173	set_transient(
1174	$transient_key,
1175	$result,
1176	isset( $result['error'] ) ? 2 * MINUTE_IN_SECONDS : 5 * MINUTE_IN_SECONDS
1177	);
1178	}
1179	}
1180
1181	if ( isset( $result['error'] ) ) {
1182	return new WP_Error( 'site_data_fetch_failed', '', $result['error'] );
1183	}
1184
1185	/**
1186	* Fires after the site record was served, whether it was fetched or read from the cache.
1187	*
1188	* Consumers that cache anything derived from the record, such as the current plan,
1189	* can refresh it here.
1190	*
1191	* This fires on a cached read too, so a consumer stays in step with every request that
1192	* serves the record rather than only the ones that reached WordPress.com.
1193	*
1194	* The record is passed as an array rather than the object this method returns, so that a
1195	* listener cannot mutate the instance that becomes the REST response.
1196	*
1197	* @since 9.0.0
1198	*
1199	* @param array $record The decoded site record from the WordPress.com `/sites/%d` endpoint.
1200	*/
1201	do_action( 'jetpack_site_data_fetched', json_decode( $result['body'], true ) );
1202
1203	return json_decode( $result['body'] );
1204	}
1205
1206	/**
1207	* Request the site record from WordPress.com.
1208	*
1209	* Returns a cacheable array rather than the decoded record so that both outcomes survive a
1210	* round trip through a transient.
1211	*
1212	* @since 9.0.0
1213	*
1214	* @param int $site_id The WordPress.com blog ID.
1215	* @param string\|null $sandbox_secret Sanitized store sandbox cookie value, or null when not sandboxed.
1216	* @return array Either `array( 'body' => string )` or `array( 'error' => array )`.
1217	*/
1218	private function fetch_connected_site_data( $site_id, $sandbox_secret ) {
1219	$args = array( 'headers' => array() );
1220
1221	// Allow use a store sandbox. Internal ref: PCYsg-IA-p2.
1222	if ( null !== $sandbox_secret ) {
1223	$args['headers']['Cookie'] = "store_sandbox=$sandbox_secret;";
1224	}
1225
1226	$response = Client::wpcom_json_api_request_as_blog( sprintf( '/sites/%d', $site_id ) . '?force=wpcom', '1.1', $args );
1227	$body = wp_remote_retrieve_body( $response );
1228	$data = $body ? json_decode( $body ) : null;
1229
1230	if ( 200 !== wp_remote_retrieve_response_code( $response ) ) {
1231	$error_info = array(
1232	'api_error_code' => null,
1233	'api_http_code' => wp_remote_retrieve_response_code( $response ),
1234	);
1235
1236	if ( is_wp_error( $response ) ) {
1237	$error_info['api_error_code'] = $response->get_error_code() ? wp_strip_all_tags( $response->get_error_code() ) : null;
1238	} elseif ( $data && ! empty( $data->error ) ) {
1239	$error_info['api_error_code'] = is_string( $data->error ) ? wp_strip_all_tags( $data->error ) : null;
1240	}
1241
1242	return array( 'error' => $error_info );
1243	}
1244
1245	if ( ! is_object( $data ) ) {
1246	return array(
1247	'error' => array(
1248	'api_error_code' => 'invalid_body',
1249	'api_http_code' => 200,
1250	),
1251	);
1252	}
1253
1254	return array( 'body' => $body );
1255	}
1256
1257	/**
1258	* Returns a user object of the connection owner.
1259	*
1260	* @return WP_User\|false False if no connection owner found.
1261	*/
1262	public function get_connection_owner() {
1263	$user_id = \Jetpack_Options::get_option( 'master_user' );
1264	if ( ! $user_id ) {
1265	return false;
1266	}
1267
1268	// Make sure user is connected.
1269	$user_token = $this->get_tokens()->get_access_token( $user_id );
1270
1271	$connection_owner = false;
1272
1273	if ( $user_token && is_object( $user_token ) && isset( $user_token->external_user_id ) ) {
1274	$connection_owner = get_userdata( $user_token->external_user_id );
1275	}
1276
1277	// Reporting is best-effort and must never fatal a request running mid-plugin-update:
1278	// skip it when the already-loaded Error_Handler is a stale version predating the factory.
1279	if ( $connection_owner === false && method_exists( Error_Handler::class, 'build_connection_wp_error' ) ) {
1280	Error_Handler::get_instance()->report_error(
1281	Error_Handler::build_connection_wp_error(
1282	'invalid_connection_owner',
1283	'Invalid connection owner',
1284	array( 'token' => '' ),
1285	'local_state', // Error_Handler::ERROR_TYPE_LOCAL_STATE.
1286	'', // Local-state errors describe the site's database, not a request, so they have no direction.
1287	array(
1288	'user_id' => $user_id,
1289	'has_user_token' => (bool) $user_token,
1290	)
1291	),
1292	false,
1293	true
1294	);
1295	}
1296
1297	return $connection_owner;
1298	}
1299
1300	/**
1301	* Returns true if the provided user is the Jetpack connection owner.
1302	* If user ID is not specified, the current user will be used.
1303	*
1304	* @param int\|bool $user_id the user identifier. False for current user.
1305	* @return bool True the user the connection owner, false otherwise.
1306	*/
1307	public function is_connection_owner( $user_id = false ) {
1308	if ( ! $user_id ) {
1309	$user_id = get_current_user_id();
1310	}
1311
1312	return ( (int) $user_id ) === $this->get_connection_owner_id();
1313	}
1314
1315	/**
1316	* Determines whether the connection ownership can be transferred to another user.
1317	*
1318	* The default Jetpack connection uses a transferable ownership model. A set protected owner
1319	* anchor locks it outright; otherwise a consumer can declare ownership locked by returning
1320	* `false` from the `jetpack_connection_ownership_transferable` filter. This is the single
1321	* chokepoint used both when deciding which connection-error CTA to surface and (eventually)
1322	* when performing an ownership change.
1323	*
1324	* @since 8.8.0
1325	* @since 9.3.0 A locked protected owner anchor makes ownership non-transferable.
1326	*
1327	* @return bool True if ownership can be transferred, false if it is locked.
1328	*/
1329	public function is_ownership_transferable() {
1330	// Keyed on the anchor, never on has_protected_owner(): an owner who does not match the
1331	// anchor is exactly when ownership must stay locked.
1332	if ( Protected_Owner::is_locked() ) {
1333	return false;
1334	}
1335
1336	/**
1337	* Filters whether the Jetpack connection ownership can be transferred.
1338	*
1339	* Return `false` to lock ownership so it can never be taken over.
1340	*
1341	* @since 8.8.0
1342	*
1343	* @param bool $transferable Whether ownership can be transferred. Default true.
1344	*/
1345	return (bool) apply_filters( 'jetpack_connection_ownership_transferable', true );
1346	}
1347
1348	/**
1349	* Whether a protected owner is required right now.
1350	*
1351	* Evaluated at the moment of the request, not as a standing declaration: a consumer may
1352	* legitimately answer false while it is installed and active — running in test mode, say —
1353	* and true only at the lifecycle moment that binds something to the owner's identity.
1354	*
1355	* @since 9.3.0
1356	*
1357	* @return bool True if a protected owner is required at this moment. Default false.
1358	*/
1359	public function requires_protected_owner() {
1360	/**
1361	* Filters whether a protected owner is required at this moment.
1362	*
1363	* Return `true` at the point a feature is about to bind to the connection owner's
1364	* identity. Answering false at other times is expected and supported.
1365	*
1366	* @since 9.3.0
1367	*
1368	* @param bool $required Whether a protected owner is required. Default false.
1369	*/
1370	return (bool) apply_filters( 'jetpack_connection_requires_protected_owner', false );
1371	}
1372
1373	/**
1374	* Whether the connection owner is the protected owner the anchor names.
1375	*
1376	* This is the question consumers gate on before binding anything to the owner's identity.
1377	*
1378	* Reads the binding of the current owner rather than searching for whoever holds the anchored
1379	* ID, so a row on any other user cannot affect the answer. Requiring the owner to hold a live
1380	* token on top of that is what keeps a row written by another subsystem from ever satisfying
1381	* this: both halves are load-bearing, and there are tests for each.
1382	*
1383	* @since 9.3.0
1384	*
1385	* @return bool
1386	*/
1387	public function has_protected_owner() {
1388	$anchor = Protected_Owner::get_locked();
1389
1390	if ( ! $anchor ) {
1391	return false;
1392	}
1393
1394	$owner_id = $this->get_connection_owner_id();
1395
1396	if ( ! $owner_id ) {
1397	return false;
1398	}
1399
1400	return $this->resolve_wpcom_user_id( $owner_id ) === (int) $anchor['wpcom_user_id'];
1401	}
1402
1403	/**
1404	* Classify why `has_protected_owner()` answered false, and what would change it.
1405	*
1406	* Deliberately inspects only what the gate inspects — the anchor and the current connection
1407	* owner — so the two can never disagree about the same site. Anything needing a user search or
1408	* a reachability probe is a different question and is not answered here.
1409	*
1410	* `is_current_user_the_po` reads the current user's own stored binding, never a search for
1411	* whoever holds the anchored ID, so it cannot be confused by a second user carrying the same
1412	* meta, and never costs a network call. It is a hint for copy, not a gate.
1413	*
1414	* @since 9.4.0
1415	*
1416	* @return array{status: string, is_current_user_the_po: bool}
1417	*/
1418	public function resolve_protected_owner_state() {
1419	$anchor = Protected_Owner::get_locked();
1420	$current_id = get_current_user_id();
1421
1422	// Only meaningful against an anchor: with none, there is nothing for the user to be.
1423	// Reads the stored binding rather than resolving it, so classifying a state never costs a
1424	// WordPress.com round trip. An unbound user reads as false and gets the generic copy.
1425	$is_current_user_the_po = $anchor
1426	&& Utils::get_wpcom_user_id( $current_id ) === (int) $anchor['wpcom_user_id'];
1427
1428	if ( ! $anchor ) {
1429	$roles = new Roles();
1430
1431	if ( ! current_user_can( 'jetpack_connect' ) \|\| ! current_user_can( $roles->translate_role_to_cap( 'administrator' ) ) ) {
1432	// Eligibility is being an admin, not holding the master slot.
1433	$status = self::PO_STATE_NOT_ELIGIBLE;
1434	} elseif ( ! $this->is_user_connected( $current_id ) ) {
1435	// A WordPress.com identity has to exist before it can be confirmed and locked.
1436	$status = self::PO_STATE_NEEDS_CONNECT_TO_ESTABLISH;
1437	} else {
1438	$status = self::PO_STATE_CAN_ESTABLISH;
1439	}
1440	} else {
1441	$owner_id = $this->get_connection_owner_id();
1442	$owner_wpcom_id = $owner_id ? $this->resolve_wpcom_user_id( $owner_id ) : 0;
1443
1444	if ( ! $owner_wpcom_id ) {
1445	// A zero is "could not determine", never "does not match", so an owner whose
1446	// identity cannot be confirmed is reported as needing to reconnect, not replaced.
1447	$status = self::PO_STATE_NEEDS_OWNER_RECONNECT;
1448	} elseif ( $owner_wpcom_id !== (int) $anchor['wpcom_user_id'] ) {
1449	// Legitimate, not broken: the first admin to connect takes a vacant master slot,
1450	// so an agency can hold it while the protected owner is away.
1451	$status = self::PO_STATE_NEEDS_DIFFERENT_OWNER;
1452	} else {
1453	$status = self::PO_STATE_RE_EVALUATE;
1454	}
1455	}
1456
1457	return array(
1458	'status' => $status,
1459	'is_current_user_the_po' => $is_current_user_the_po,
1460	);
1461	}
1462
1463	/**
1464	* Reconcile this site's protected owner against WordPress.com, which is the owner of record.
1465	*
1466	* Runs at connect, when the site has a fresh user token and an answer is cheap, and only once
1467	* something is anchored: a site with no protected owner asks nothing and behaves as it did
1468	* before this existed. One answer settles the rest — whether an owner still exists, whether
1469	* the anchor names them, and whether the user connecting is them — so the anchor, the binding
1470	* and the master slot are decided together rather than from two calls that could disagree.
1471	*
1472	* Only an answer moves anything. Unreachable, refused, unimplemented and malformed leave the
1473	* anchor exactly as it was: it was confirmed once, and a request that never arrived is no
1474	* evidence against it.
1475	*
1476	* @internal Hooked on `jetpack_user_authorized`.
1477	* @since 9.8.0
1478	*
1479	* @return bool Whether WordPress.com confirmed the anchored identity.
1480	*/
1481	public function reconcile_protected_owner() {
1482	$user_id = get_current_user_id();
1483
1484	if ( ! $user_id ) {
1485	return false;
1486	}
1487
1488	$anchor = Protected_Owner::get();
1489
1490	// Nothing anchored is nothing to reconcile, and a site with no protected owner must behave
1491	// exactly as it did before this existed — including making no request. Such a site reaches
1492	// an owner through the claim instead, which is where confirming belongs.
1493	if ( ! $anchor ) {
1494	return false;
1495	}
1496
1497	$record = $this->query_protected_owner_record( (int) $anchor['wpcom_user_id'] );
1498
1499	// Silence is not an answer. Unreachable, refused and unimplemented leave the anchor exactly
1500	// as it was: it was confirmed once, and a request that never arrived is no evidence against
1501	// it. Dropping a good lock because WordPress.com had a bad minute costs a merchant their
1502	// payouts until the owner happens to connect again.
1503	if ( ! is_array( $record ) \|\| ! isset( $record['has_owner'] ) ) {
1504	return false;
1505	}
1506
1507	// WordPress.com no longer has an owner of record, so neither does this site. Support
1508	// clearing it at that end is how a wrongly anchored site recovers.
1509	if ( ! $record['has_owner'] ) {
1510	Protected_Owner::clear();
1511
1512	return false;
1513	}
1514
1515	$caller_wpcom_user_id = (int) ( $record['caller_wpcom_user_id'] ?? 0 );
1516
1517	// The identity is disclosed only to the owner it names, so this is the one branch that can
1518	// learn it — and what it settles is which account the anchor should name, since
1519	// WordPress.com may have moved the owner since this site last asked.
1520	if ( ! empty( $record['is_caller'] ) ) {
1521	return $this->adopt_protected_owner( $user_id, $caller_wpcom_user_id, $anchor );
1522	}
1523
1524	// Connecting cleared this, and it is the caller's own identity rather than the owner's, so
1525	// it is written whoever they are. Nothing is anchored on this path, so an early write
1526	// cannot strand a half-finished lock.
1527	if ( $caller_wpcom_user_id ) {
1528	Utils::set_wpcom_user_id( $user_id, $caller_wpcom_user_id );
1529	}
1530
1531	// Somebody else is connecting. WordPress.com confirms the anchored identity rather than
1532	// naming the owner, so the answer is the same whoever asks.
1533	if ( empty( $record['matches'] ) ) {
1534	Protected_Owner::clear();
1535
1536	return false;
1537	}
1538
1539	return true;
1540	}
1541
1542	/**
1543	* Take WordPress.com's word that the connecting user owns this site.
1544	*
1545	* @since 9.8.0
1546	*
1547	* @param int $user_id The connecting local user.
1548	* @param int $wpcom_user_id The connecting user's WordPress.com identity, which this
1549	* branch has just been told is the owner of record.
1550	* @param array\|null $anchor What this site has anchored, if anything.
1551	* @return bool Whether the anchor now names that identity.
1552	*/
1553	private function adopt_protected_owner( $user_id, $wpcom_user_id, $anchor ) {
1554	// An owner without an identity is a malformed answer, and trusting it would lock the site
1555	// to nobody.
1556	if ( ! $wpcom_user_id ) {
1557	return false;
1558	}
1559
1560	// Anchored before the binding, so a failed write leaves nothing behind for a later
1561	// connection to build on. Re-pointing only moves the cached local ID, so it is right only
1562	// while the anchored identity is the one WordPress.com just confirmed.
1563	if ( $anchor && (int) $anchor['wpcom_user_id'] === $wpcom_user_id ) {
1564	Protected_Owner::repoint( $user_id );
1565	} elseif ( ! Protected_Owner::set( $wpcom_user_id, $user_id ) ) {
1566	return false;
1567	}
1568
1569	// Connecting clears the binding, so this writes back the one the answer just confirmed.
1570	Utils::set_wpcom_user_id( $user_id, $wpcom_user_id );
1571
1572	// Eligibility for the master slot is being an administrator here, which the owner of record
1573	// need not be.
1574	if ( user_can( $user_id, ( new Roles() )->translate_role_to_cap( 'administrator' ) )
1575	&& (int) \Jetpack_Options::get_option( 'master_user' ) !== $user_id ) {
1576	\Jetpack_Options::update_option( 'master_user', $user_id );
1577	}
1578
1579	return true;
1580	}
1581
1582	/**
1583	* Ask WordPress.com whether it still holds the anchored identity as this site's owner.
1584	*
1585	* Split from `reconcile_protected_owner()` so the decision it drives can be exercised without a
1586	* network, which is the half worth testing: every branch of it changes whether a site gates a
1587	* live feature. The anchored ID is sent so the answer confirms rather than discloses.
1588	*
1589	* @since 9.8.0
1590	*
1591	* @param int $anchored_wpcom_user_id The WordPress.com identity this site has anchored.
1592	* @return array\|null The record, or null when WordPress.com could not answer.
1593	*/
1594	protected function query_protected_owner_record( $anchored_wpcom_user_id ) {
1595	return $this->request_protected_owner_record(
1596	'/reconcile',
1597	array( 'anchored_wpcom_user_id' => (int) $anchored_wpcom_user_id )
1598	);
1599	}
1600
1601	/**
1602	* Claim this site's protected ownership for the current user with WordPress.com.
1603	*
1604	* Split from `set_protected_owner()` so the decision it drives can be exercised without a
1605	* network. The identity travels in the signature rather than the payload, so nothing is sent.
1606	*
1607	* @since 9.8.0
1608	*
1609	* @return array\|null The record, or null when WordPress.com could not answer.
1610	*/
1611	protected function assert_protected_owner_record() {
1612	return $this->request_protected_owner_record();
1613	}
1614
1615	/**
1616	* Give up this site's protected ownership with WordPress.com.
1617	*
1618	* Split from `release_protected_owner()` so the decision it drives can be exercised without a
1619	* network. The identity travels in the signature rather than the payload, so WordPress.com
1620	* decides whether the caller is the owner it holds.
1621	*
1622	* @since 9.9.0
1623	*
1624	* @return array\|null The record, or null when WordPress.com could not answer.
1625	*/
1626	protected function relinquish_protected_owner_record() {
1627	return $this->request_protected_owner_record( '/release' );
1628	}
1629
1630	/**
1631	* Call this site's protected-owner resource on WordPress.com, signed as the current user.
1632	*
1633	* @since 9.8.1
1634	*
1635	* @param string $route The route below the resource, empty for the resource itself.
1636	* @param array\|null $body The request body, or null to send none.
1637	* @return array\|null The record, or null when WordPress.com could not answer.
1638	*/
1639	private function request_protected_owner_record( $route = '', $body = null ) {
1640	$path = sprintf(
1641	'/sites/%d/jetpack-protected-owner%s',
1642	(int) \Jetpack_Options::get_option( 'id' ),
1643	$route
1644	);
1645
1646	$response = Client::wpcom_json_api_request_as_user( $path, '2', array( 'method' => 'POST' ), $body );
1647
1648	// Anything but a 200 is silence rather than an answer: unreachable, refused, or a
1649	// WordPress.com that does not implement the route. Every caller fails closed on null.
1650	if ( is_wp_error( $response ) \|\| 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
1651	return null;
1652	}
1653
1654	$record = json_decode( wp_remote_retrieve_body( $response ), true );
1655
1656	return is_array( $record ) ? $record : null;
1657	}
1658
1659	/**
1660	* Record a user as the protected owner and promote them to connection owner.
1661	*
1662	* Gated on `jetpack_connect` rather than on a role: a host can narrow that capability and
1663	* multisite does. It is false while the package is unconfigured, so a caller that has not
1664	* registered the connection's capabilities is refused rather than trusted.
1665	*
1666	* @since 9.3.0
1667	* @since 9.6.0 No longer takes how the owner was confirmed.
1668	* @since 9.8.0 WordPress.com records the owner before anything is anchored here.
1669	*
1670	* @param int $user_id The local user to anchor.
1671	* @return true\|WP_Error True on success, WP_Error otherwise.
1672	*/
1673	public function set_protected_owner( $user_id ) {
1674	// Authorization precedes validation, so an unauthorized caller cannot use the argument
1675	// errors below to learn which users are administrators or hold a token.
1676	if ( ! current_user_can( 'jetpack_connect' ) ) {
1677	return new WP_Error(
1678	'protected_owner_forbidden',
1679	__( 'You do not have permission to manage the protected owner.', 'jetpack-connection' ),
1680	array( 'status' => 403 )
1681	);
1682	}
1683
1684	$user_id = absint( $user_id );
1685	$roles = new Roles();
1686
1687	if ( ! user_can( $user_id, $roles->translate_role_to_cap( 'administrator' ) ) ) {
1688	return new WP_Error(
1689	'protected_owner_not_admin',
1690	__( 'The protected owner must be an administrator.', 'jetpack-connection' ),
1691	array( 'status' => 400 )
1692	);
1693	}
1694
1695	// The claim is signed as the current user, so it can only ever anchor the current user.
1696	// Anchoring somebody else would be an owner assignment they never agreed to.
1697	if ( $user_id !== get_current_user_id() ) {
1698	return new WP_Error(
1699	'protected_owner_not_self',
1700	__( 'A protected owner can only be recorded by the user confirming it.', 'jetpack-connection' ),
1701	array( 'status' => 400 )
1702	);
1703	}
1704
1705	// A stored binding that already disagrees with the anchor is enough to refuse. WordPress.com
1706	// is still asked when this user has no binding, because that answer is what names them.
1707	if ( $this->local_anchor_names_someone_else( (int) Utils::get_wpcom_user_id( $user_id ) ) ) {
1708	return $this->protected_owner_claimed_by_other();
1709	}
1710
1711	// WordPress.com is asked before anything is written here. It owns the record, so a claim it
1712	// has not accepted must not leave a locked anchor behind on this site.
1713	$record = $this->assert_protected_owner_record();
1714
1715	// Fail closed: unreachable, refused, or a WordPress.com that does not implement the call.
1716	// A site that cannot get an answer must not end up protecting anybody on its own say-so.
1717	if ( ! is_array( $record ) \|\| empty( $record['status'] ) ) {
1718	return new WP_Error(
1719	'protected_owner_unconfirmed',
1720	__( 'Could not reach WordPress.com to confirm the protected owner.', 'jetpack-connection' ),
1721	array( 'status' => 503 )
1722	);
1723	}
1724
1725	// Somebody else already holds this site. Beyond support there is no way past this, which is
1726	// the point: an owner that could be overwritten by the next claimant protects nobody.
1727	if ( 'locked_to_other' === $record['status'] ) {
1728	return $this->protected_owner_claimed_by_other();
1729	}
1730
1731	// Only an accepted claim is anchored: any other verdict is refused, even one carrying an ID.
1732	if ( ! in_array( $record['status'], array( 'recorded', 'already_yours' ), true ) \|\| empty( $record['wpcom_user_id'] ) ) {
1733	return new WP_Error(
1734	'protected_owner_not_verified',
1735	__( 'Could not confirm the protected owner with WordPress.com.', 'jetpack-connection' ),
1736	array( 'status' => 400 )
1737	);
1738	}
1739
1740	// A `recorded` answer must not replace an anchor that already names a different account.
1741	if ( $this->local_anchor_names_someone_else( (int) $record['wpcom_user_id'] ) ) {
1742	return $this->protected_owner_claimed_by_other();
1743	}
1744
1745	// Store the binding the anchor will be compared against, so the gate reads local state from
1746	// here on. Routed through the deduping writer, which clears the ID off any previous holder.
1747	Utils::set_wpcom_user_id( $user_id, (int) $record['wpcom_user_id'] );
1748
1749	if ( ! Protected_Owner::set( (int) $record['wpcom_user_id'], $user_id ) ) {
1750	return new WP_Error(
1751	'protected_owner_not_stored',
1752	__( 'Could not store the protected owner.', 'jetpack-connection' ),
1753	array( 'status' => 500 )
1754	);
1755	}
1756
1757	// Written directly rather than through update_connection_owner(): that round-trips to
1758	// WordPress.com first, and its ownership-change guard will refuse the anchor just set here.
1759	\Jetpack_Options::update_option( 'master_user', $user_id );
1760
1761	return true;
1762	}
1763
1764	/**
1765	* Release the protected owner, leaving ownership open to any connected administrator.
1766	*
1767	* WordPress.com holds the record, so it is cleared there first. An anchor dropped only here
1768	* would leave WordPress.com refusing every later claim as `locked_to_other`, locking the site
1769	* to nobody rather than unlocking it.
1770	*
1771	* Leaves `master_user` alone: releasing the lock does not change who the owner is.
1772	*
1773	* @since 9.9.0
1774	*
1775	* @return true\|WP_Error True on success, WP_Error otherwise.
1776	*/
1777	public function release_protected_owner() {
1778	// Authorization precedes everything else, so an unauthorized caller cannot use the
1779	// refusals below to learn whether this site is protected or by whom.
1780	if ( ! current_user_can( 'jetpack_connect' ) ) {
1781	return new WP_Error(
1782	'protected_owner_forbidden',
1783	__( 'You do not have permission to manage the protected owner.', 'jetpack-connection' ),
1784	array( 'status' => 403 )
1785	);
1786	}
1787
1788	// Nothing anchored is already released, so repeating the call is not an error. It can also
1789	// be an anchor lost while WordPress.com kept its record, which this site cannot tell apart
1790	// and cannot recover from alone — hence a warning rather than silence.
1791	$anchor = Protected_Owner::get_locked();
1792
1793	if ( ! $anchor ) {
1794	wp_trigger_error(
1795	__METHOD__,
1796	'Released with no protected owner on record. If WordPress.com still holds one, this site can no longer claim it back.',
1797	E_USER_WARNING
1798	);
1799
1800	return true;
1801	}
1802
1803	// A local hint that spares an obvious refusal a round trip. WordPress.com is asked anyway
1804	// whenever this passes, and its answer is the one that decides.
1805	if ( Utils::get_wpcom_user_id( get_current_user_id() ) !== (int) $anchor['wpcom_user_id'] ) {
1806	return $this->protected_owner_release_refused();
1807	}
1808
1809	$record = $this->relinquish_protected_owner_record();
1810
1811	// Fail closed: unreachable, refused, or a WordPress.com that does not implement the call.
1812	// Clearing on silence would unlock a site WordPress.com still holds.
1813	if ( ! is_array( $record ) \|\| empty( $record['status'] ) ) {
1814	return new WP_Error(
1815	'protected_owner_unreleased',
1816	__( 'Could not reach WordPress.com to release the protected owner.', 'jetpack-connection' ),
1817	array( 'status' => 503 )
1818	);
1819	}
1820
1821	if ( 'not_owner' === $record['status'] ) {
1822	return $this->protected_owner_release_refused();
1823	}
1824
1825	// `no_owner` is WordPress.com reporting it holds nothing to release, which is the state
1826	// this call asks for, so the stale anchor here clears alongside an accepted release.
1827	if ( ! in_array( $record['status'], array( 'released', 'no_owner' ), true ) ) {
1828	return new WP_Error(
1829	'protected_owner_not_released',
1830	__( 'Could not release the protected owner with WordPress.com.', 'jetpack-connection' ),
1831	array( 'status' => 400 )
1832	);
1833	}
1834
1835	$cleared = $this->clear_protected_owner();
1836
1837	// WordPress.com has already let go, so a local delete that failed is unfinished cleanup
1838	// rather than a release that did not happen. Retrying is what fixes it: reconcile only
1839	// runs when somebody authorizes, and WordPress.com now answers this call with `no_owner`.
1840	if ( is_wp_error( $cleared ) && 'protected_owner_not_cleared' === $cleared->get_error_code() ) {
1841	return new WP_Error(
1842	'protected_owner_not_cleared',
1843	__( 'Ownership was released with WordPress.com, but this site could not finish clearing it. Try again.', 'jetpack-connection' ),
1844	array( 'status' => 500 )
1845	);
1846	}
1847
1848	return $cleared;
1849	}
1850
1851	/**
1852	* The refusal for a caller who is not the owner WordPress.com holds.
1853	*
1854	* @since 9.9.0
1855	*
1856	* @return WP_Error
1857	*/
1858	private function protected_owner_release_refused() {
1859	return new WP_Error(
1860	'protected_owner_not_owner',
1861	__( 'Only the confirmed owner can release ownership of this site.', 'jetpack-connection' ),
1862	array( 'status' => 403 )
1863	);
1864	}
1865
1866	/**
1867	* Whether a WordPress.com user id would replace the stored anchor.
1868	*
1869	* Zero means this user is not named yet, so it is not a conflict.
1870	*
1871	* @since 9.9.0
1872	*
1873	* @param int $wpcom_user_id WordPress.com user the claim would anchor.
1874	* @return bool
1875	*/
1876	private function local_anchor_names_someone_else( $wpcom_user_id ) {
1877	$anchor = Protected_Owner::get_locked();
1878
1879	return $anchor && $wpcom_user_id && (int) $anchor['wpcom_user_id'] !== (int) $wpcom_user_id;
1880	}
1881
1882	/**
1883	* The support path for a site a different account already protects.
1884	*
1885	* @since 9.9.0
1886	*
1887	* @return WP_Error
1888	*/
1889	private function protected_owner_claimed_by_other() {
1890	return new WP_Error(
1891	'protected_owner_claimed_by_other',
1892	__( 'This site is already protected by a different WordPress.com account. Contact support.', 'jetpack-connection' ),
1893	array( 'status' => 409 )
1894	);
1895	}
1896
1897	/**
1898	* Drop the protected owner anchor, unlocking ownership.
1899	*
1900	* Gated on `jetpack_connect` like establishing one, releasing a lock being the more
1901	* consequential half. The `@internal` tag is documentation; the capability is enforcement.
1902	*
1903	* @internal Recovery and support flows only. Consumers must not call this.
1904	* @since 9.3.0
1905	*
1906	* @return true\|WP_Error True once no anchor is set, WP_Error otherwise.
1907	*/
1908	public function clear_protected_owner() {
1909	if ( ! current_user_can( 'jetpack_connect' ) ) {
1910	return new WP_Error(
1911	'protected_owner_forbidden',
1912	__( 'You do not have permission to manage the protected owner.', 'jetpack-connection' ),
1913	array( 'status' => 403 )
1914	);
1915	}
1916
1917	Protected_Owner::clear();
1918
1919	// Asked of the outcome rather than of `delete_option()`, which also reports false for an
1920	// anchor that was already absent — the state the caller asked for.
1921	if ( Protected_Owner::get() ) {
1922	return new WP_Error(
1923	'protected_owner_not_cleared',
1924	__( 'Could not clear the protected owner.', 'jetpack-connection' ),
1925	array( 'status' => 500 )
1926	);
1927	}
1928
1929	return true;
1930	}
1931
1932	/**
1933	* Connects the user with a specified ID to a WordPress.com user using the
1934	* remote login flow.
1935	*
1936	* @access public
1937	*
1938	* @param int\|null $user_id (optional) the user identifier, defaults to current user.
1939	* @param string\|null $redirect_url the URL to redirect the user to for processing, defaults to
1940	* admin_url().
1941	* @return WP_Error only in case of a failed user lookup.
1942	*/
1943	public function connect_user( $user_id = null, $redirect_url = null ) {
1944	$user = null;
1945	if ( null === $user_id ) {
1946	$user = wp_get_current_user();
1947	} else {
1948	$user = get_user_by( 'ID', $user_id );
1949	}
1950
1951	if ( empty( $user ) ) {
1952	return new \WP_Error( 'user_not_found', 'Attempting to connect a non-existent user.' );
1953	}
1954
1955	if ( null === $redirect_url ) {
1956	$redirect_url = admin_url();
1957	}
1958
1959	// Using wp_redirect intentionally because we're redirecting outside.
1960	wp_redirect( $this->get_authorization_url( $user, $redirect_url ) ); // phpcs:ignore WordPress.Security.SafeRedirect
1961	exit( 0 );
1962	}
1963
1964	/**
1965	* Force user disconnect.
1966	*
1967	* @param int $user_id Local (external) user ID.
1968	* @param bool $disconnect_all_users Whether to disconnect all users before disconnecting the primary user.
1969	*
1970	* @return bool
1971	*/
1972	public function disconnect_user_force( $user_id, $disconnect_all_users = false ) {
1973	if ( ! (int) $user_id ) {
1974	// Missing user ID.
1975	return false;
1976	}
1977	// If we are disconnecting the primary user we may need to disconnect all other users first
1978	if ( $user_id === $this->get_connection_owner_id() && $disconnect_all_users && ! $this->disconnect_all_users_except_primary() ) {
1979	return false;
1980	}
1981
1982	return $this->disconnect_user( $user_id, true, true );
1983	}
1984
1985	/**
1986	* Disconnects all users except the primary user.
1987	*
1988	* @return bool
1989	*/
1990	public function disconnect_all_users_except_primary() {
1991
1992	$all_connected_users = $this->get_connected_users();
1993
1994	foreach ( $all_connected_users as $user ) {
1995	// Skip the primary.
1996	if ( $user->ID === $this->get_connection_owner_id() ) {
1997	continue;
1998	}
1999	$disconnected = $this->disconnect_user( $user->ID, false, true );
2000	// If we fail to disconnect any user, we should not proceed with disconnecting the primary user.
2001	if ( ! $disconnected ) {
2002	return false;
2003	}
2004	}
2005
2006	return true;
2007	}
2008
2009	/**
2010	* Unlinks the current user from the linked WordPress.com user.
2011	*
2012	* @access public
2013	* @static
2014	*
2015	* @todo Refactor to properly load the XMLRPC client independently.
2016	*
2017	* @param int\|null $user_id the user identifier.
2018	* @param bool $can_overwrite_primary_user Allow for the primary user to be disconnected.
2019	* @param bool $force_disconnect_locally Disconnect user locally even if we were unable to disconnect them from WP.com.
2020	* @return bool Whether the disconnection of the user was successful.
2021	*/
2022	public function disconnect_user( $user_id = null, $can_overwrite_primary_user = false, $force_disconnect_locally = false ) {
2023	$user_id = empty( $user_id ) ? get_current_user_id() : (int) $user_id;
2024	$is_primary_user = Jetpack_Options::get_option( 'master_user' ) === $user_id;
2025
2026	if ( $is_primary_user && ! $can_overwrite_primary_user ) {
2027	return false;
2028	}
2029
2030	if ( in_array( $user_id, self::$disconnected_users, true ) ) {
2031	// The user is already disconnected.
2032	return false;
2033	}
2034
2035	// Attempt to disconnect the user from WordPress.com.
2036	$is_disconnected_from_wpcom = $this->unlink_user_from_wpcom( $user_id );
2037
2038	$is_disconnected_locally = false;
2039	if ( $is_disconnected_from_wpcom \|\| $force_disconnect_locally ) {
2040	// Get the WordPress.com email before disconnecting the user
2041	$wpcom_user_data = $this->get_connected_user_data( $user_id );
2042	$wpcom_email = $wpcom_user_data['email'] ?? null;
2043
2044	// Disconnect the user locally.
2045	$is_disconnected_locally = $this->get_tokens()->disconnect_user( $user_id );
2046
2047	if ( $is_disconnected_locally ) {
2048	// Delete cached connected user data.
2049	$transient_key = "jetpack_connected_user_data_$user_id";
2050	delete_transient( $transient_key );
2051
2052	// Clean up account mismatch transients for this user
2053	if ( $wpcom_email ) {
2054	$user_account_status = new User_Account_Status();
2055	$user_account_status->clean_account_mismatch_transients( $wpcom_email );
2056	}
2057
2058	/**
2059	* Fires after the current user has been unlinked from WordPress.com.
2060	*
2061	* @since 1.7.0
2062	* @since-jetpack 4.1.0
2063	*
2064	* @param int $user_id The current user's ID.
2065	*/
2066	do_action( 'jetpack_unlinked_user', $user_id );
2067
2068	if ( $is_primary_user ) {
2069	Jetpack_Options::delete_option( 'master_user' );
2070
2071	// Clear the memoized connection owner ID since it changed
2072	self::$connection_owner_id = null;
2073	}
2074	}
2075	}
2076
2077	self::$disconnected_users[] = $user_id;
2078
2079	return $is_disconnected_from_wpcom && $is_disconnected_locally;
2080	}
2081
2082	/**
2083	* Request to wpcom for a user to be unlinked from their WordPress.com account
2084	*
2085	* @param int $user_id The user identifier.
2086	*
2087	* @return bool Whether the disconnection of the user was successful.
2088	*/
2089	public function unlink_user_from_wpcom( $user_id ) {
2090	// Attempt to disconnect the user from WordPress.com.
2091	$xml = new Jetpack_IXR_Client();
2092
2093	$xml->query( 'jetpack.unlink_user', $user_id );
2094	if ( $xml->isError() ) {
2095	return false;
2096	}
2097
2098	return (bool) $xml->getResponse();
2099	}
2100
2101	/**
2102	* Update the connection owner.
2103	*
2104	* @since 1.29.0
2105	* @since 9.3.0 Refused while ownership is locked.
2106	* @since 9.9.0 The anchored owner passes the lock, and moving the site off them
2107	* releases the anchor.
2108	*
2109	* @param int $new_owner_id The ID of the user to become the connection owner.
2110	*
2111	* @return true\|WP_Error True if owner successfully changed, WP_Error otherwise.
2112	*/
2113	public function update_connection_owner( $new_owner_id ) {
2114	// Answered before the arguments are validated: no candidate is valid while ownership is
2115	// locked, and an argument error would suggest a retry that cannot work.
2116	if ( ! $this->is_ownership_transferable() && ! $this->current_user_may_move_locked_ownership() ) {
2117	return new WP_Error(
2118	'ownership_locked',
2119	__( 'The connection owner is locked on this site.', 'jetpack-connection' ),
2120	array( 'status' => 403 )
2121	);
2122	}
2123
2124	$roles = new Roles();
2125	if ( ! user_can( $new_owner_id, $roles->translate_role_to_cap( 'administrator' ) ) ) {
2126	return new WP_Error(
2127	'new_owner_not_admin',
2128	__( 'New owner is not admin', 'jetpack-connection' ),
2129	array( 'status' => 400 )
2130	);
2131	}
2132
2133	$old_owner_id = $this->get_connection_owner_id();
2134
2135	if ( $old_owner_id === $new_owner_id ) {
2136	return new WP_Error(
2137	'new_owner_is_existing_owner',
2138	__( 'New owner is same as existing owner', 'jetpack-connection' ),
2139	array( 'status' => 400 )
2140	);
2141	}
2142
2143	if ( ! $this->is_user_connected( $new_owner_id ) ) {
2144	return new WP_Error(
2145	'new_owner_not_connected',
2146	__( 'New owner is not connected', 'jetpack-connection' ),
2147	array( 'status' => 400 )
2148	);
2149	}
2150
2151	// Notify WPCOM about the connection owner change.
2152	$owner_updated_wpcom = $this->update_connection_owner_wpcom( $new_owner_id );
2153
2154	if ( $owner_updated_wpcom ) {
2155	// Update the connection owner in Jetpack only if they were successfully updated on WPCOM.
2156	// This will ensure consistency with WPCOM.
2157	\Jetpack_Options::update_option( 'master_user', $new_owner_id );
2158
2159	// Clear the memoized connection owner ID since it changed
2160	self::$connection_owner_id = null;
2161
2162	$this->release_anchor_after_transfer( $new_owner_id, $owner_updated_wpcom );
2163
2164	// Track it.
2165	( new Tracking() )->record_user_event( 'set_connection_owner_success' );
2166
2167	return true;
2168	}
2169	return new WP_Error(
2170	'error_setting_new_owner',
2171	__( 'Could not confirm new owner.', 'jetpack-connection' ),
2172	array( 'status' => 500 )
2173	);
2174	}
2175
2176	/**
2177	* Whether the current user may move the connection despite a locked anchor.
2178	*
2179	* The anchor protects an identity, so the owner it names is the one person it is not against.
2180	*
2181	* A local hint rather than proof of who that is: the binding is not unique site-wide, and the
2182	* anchored owner is often not the connection owner here — taking a site back from an agency is
2183	* the point — so there is no stronger identity to check. WordPress.com decides, marking a
2184	* switch `po_signed` only when the signing token belongs to the owner of record.
2185	*
2186	* A consumer locking ownership through the filter is a separate refusal that still applies to
2187	* everybody, so it is re-read here with the anchor out of the way.
2188	*
2189	* @since 9.9.0
2190	*
2191	* @return bool
2192	*/
2193	private function current_user_may_move_locked_ownership() {
2194	$anchor = Protected_Owner::get_locked();
2195	$user_id = get_current_user_id();
2196
2197	if ( ! $anchor \|\| ! $user_id ) {
2198	return false;
2199	}
2200
2201	// Both halves, as everywhere else the binding is trusted: it outlives the token, so a
2202	// disconnected user can still carry the anchored ID.
2203	if ( ! $this->is_user_connected( $user_id ) ) {
2204	return false;
2205	}
2206
2207	// This user's own binding, never a search for whoever holds the anchored ID, which would
2208	// hand the site to the first match.
2209	if ( Utils::get_wpcom_user_id( $user_id ) !== (int) $anchor['wpcom_user_id'] ) {
2210	return false;
2211	}
2212
2213	/** This filter is documented in projects/packages/connection/src/class-manager.php */
2214	return (bool) apply_filters( 'jetpack_connection_ownership_transferable', true );
2215	}
2216
2217	/**
2218	* Drop the anchor once the site has left the owner it names.
2219	*
2220	* Do not make this clear more eagerly. An anchor dropped while WordPress.com kept its own
2221	* locks the site to nobody, and `reconcile_protected_owner()` returns before asking when
2222	* there is no local anchor left to repair it with. The reverse mistake costs nothing.
2223	*
2224	* @since 9.9.0
2225	*
2226	* @param int $new_owner_id The local user who now holds the connection.
2227	* @param true\|array $accepted What WordPress.com answered the switch with: a report of
2228	* what it did where available, otherwise a bare `true`.
2229	*/
2230	private function release_anchor_after_transfer( $new_owner_id, $accepted ) {
2231	$anchor = Protected_Owner::get_locked();
2232
2233	if ( ! $anchor ) {
2234	return;
2235	}
2236
2237	// WordPress.com resolves the new owner itself and knows what it kept, so where it reports
2238	// what it did, that report is the whole answer.
2239	if ( is_array( $accepted ) ) {
2240	if ( ! empty( $accepted['released'] ) ) {
2241	Protected_Owner::clear();
2242	}
2243
2244	return;
2245	}
2246
2247	// A bare `true` says only that the switch happened, leaving who the site went to as the
2248	// best guess available. A zero is "could not determine", which covers the owner taking the
2249	// site back — the case WordPress.com keeps its record for.
2250	$new_owner_wpcom_id = $this->resolve_wpcom_user_id( $new_owner_id );
2251
2252	if ( $new_owner_wpcom_id && $new_owner_wpcom_id !== (int) $anchor['wpcom_user_id'] ) {
2253	Protected_Owner::clear();
2254	}
2255	}
2256
2257	/**
2258	* Request to WPCOM to update the connection owner.
2259	*
2260	* @since 1.29.0
2261	* @since 9.9.0 Returns what WordPress.com answered rather than casting it, so a
2262	* report of what the switch did can be read. Still falsy on failure.
2263	*
2264	* @param int $new_owner_id The ID of the user to become the connection owner.
2265	*
2266	* @return bool\|array False if the transfer failed, otherwise what WordPress.com answered:
2267	* `true`, or a non-empty report such as `array( 'released' => bool )`.
2268	*/
2269	public function update_connection_owner_wpcom( $new_owner_id ) {
2270	// Notify WPCOM about the connection owner change.
2271	$xml = new Jetpack_IXR_Client(
2272	array(
2273	'user_id' => get_current_user_id(),
2274	)
2275	);
2276	$xml->query(
2277	'jetpack.switchBlogOwner',
2278	array(
2279	'new_blog_owner' => $new_owner_id,
2280	)
2281	);
2282	if ( $xml->isError() ) {
2283	return false;
2284	}
2285
2286	$response = $xml->getResponse();
2287
2288	// An array is the switch reporting what it did, and an empty one reports nothing rather
2289	// than refusing — a bare `true` by another name. Only a falsy non-array is a refusal.
2290	if ( is_array( $response ) ) {
2291	return empty( $response ) ? true : $response;
2292	}
2293
2294	return (bool) $response;
2295	}
2296
2297	/**
2298	* Returns the requested Jetpack API URL.
2299	*
2300	* @param string $relative_url the relative API path.
2301	* @return string API URL.
2302	*/
2303	public function api_url( $relative_url ) {
2304	$api_base = Constants::get_constant( 'JETPACK__API_BASE' );
2305	$api_version = '/' . Constants::get_constant( 'JETPACK__API_VERSION' ) . '/';
2306
2307	/**
2308	* Filters the API URL that Jetpack uses for server communication.
2309	*
2310	* @since 1.7.0
2311	* @since-jetpack 8.0.0
2312	*
2313	* @param string $url the generated URL.
2314	* @param string $relative_url the relative URL that was passed as an argument.
2315	* @param string $api_base the API base string that is being used.
2316	* @param string $api_version the API version string that is being used.
2317	*/
2318	return apply_filters(
2319	'jetpack_api_url',
2320	rtrim( $api_base . $relative_url, '/\\' ) . $api_version,
2321	$relative_url,
2322	$api_base,
2323	$api_version
2324	);
2325	}
2326
2327	/**
2328	* Returns the Jetpack XMLRPC WordPress.com API endpoint URL.
2329	*
2330	* @return string XMLRPC API URL.
2331	*/
2332	public function xmlrpc_api_url() {
2333	$base = preg_replace(
2334	'#(https?://[^?/]+)(/?.*)?$#',
2335	'\\1',
2336	Constants::get_constant( 'JETPACK__API_BASE' )
2337	);
2338	return untrailingslashit( $base ) . '/xmlrpc.php';
2339	}
2340
2341	/**
2342	* Attempts Jetpack registration which sets up the site for connection. Should
2343	* remain public because the call to action comes from the current site, not from
2344	* WordPress.com.
2345	*
2346	* @param string $api_endpoint (optional) an API endpoint to use, defaults to 'register'.
2347	* @return true\|WP_Error The error object.
2348	*/
2349	public function register( $api_endpoint = 'register' ) {
2350	// Clean-up leftover tokens just in-case.
2351	// This fixes an edge case that was preventing users to register when the blog token was missing but
2352	// there were still leftover user tokens present.
2353	$this->delete_all_connection_tokens( true );
2354
2355	add_action( 'pre_update_jetpack_option_register', array( '\\Jetpack_Options', 'delete_option' ) );
2356	$secrets = ( new Secrets() )->generate( 'register', get_current_user_id(), 600 );
2357
2358	if ( false === $secrets ) {
2359	return new WP_Error( 'cannot_save_secrets', __( 'Jetpack experienced an issue trying to save options (cannot_save_secrets). We suggest that you contact your hosting provider, and ask them for help checking that the options table is writable on your site.', 'jetpack-connection' ) );
2360	}
2361
2362	if (
2363	empty( $secrets['secret_1'] ) \|\|
2364	empty( $secrets['secret_2'] ) \|\|
2365	empty( $secrets['exp'] )
2366	) {
2367	return new \WP_Error( 'missing_secrets' );
2368	}
2369
2370	// Better to try (and fail) to set a higher timeout than this system
2371	// supports than to have register fail for more users than it should.
2372	$timeout = $this->set_min_time_limit( 60 ) / 2;
2373
2374	$gmt_offset = get_option( 'gmt_offset' );
2375	if ( ! $gmt_offset ) {
2376	$gmt_offset = 0;
2377	}
2378
2379	$stats_options = get_option( 'stats_options' );
2380	$stats_id = $stats_options['blog_id'] ?? null;
2381
2382	/* This action is documented in src/class-package-version-tracker.php */
2383	$package_versions = apply_filters( 'jetpack_package_versions', array() );
2384
2385	$active_plugins_using_connection = Plugin_Storage::get_all();
2386
2387	/**
2388	* Filters the request body for additional property addition.
2389	*
2390	* @since 1.7.0
2391	* @since-jetpack 7.7.0
2392	*
2393	* @param array $post_data request data.
2394	* @param Array $token_data token data.
2395	*/
2396	$body = apply_filters(
2397	'jetpack_register_request_body',
2398	array_merge(
2399	array(
2400	'siteurl' => Urls::site_url(),
2401	'home' => Urls::home_url(),
2402	'gmt_offset' => $gmt_offset,
2403	'timezone_string' => (string) get_option( 'timezone_string' ),
2404	'site_name' => (string) get_option( 'blogname' ),
2405	'secret_1' => $secrets['secret_1'],
2406	'secret_2' => $secrets['secret_2'],
2407	'site_lang' => get_locale(),
2408	'timeout' => $timeout,
2409	'stats_id' => $stats_id,
2410	'state' => get_current_user_id(),
2411	'site_created' => $this->get_assumed_site_creation_date(),
2412	'jetpack_version' => Constants::get_constant( 'JETPACK__VERSION' ),
2413	'ABSPATH' => Constants::get_constant( 'ABSPATH' ),
2414	'current_user_email' => wp_get_current_user()->user_email,
2415	'connect_plugin' => $this->get_plugin() ? $this->get_plugin()->get_slug() : null,
2416	'package_versions' => $package_versions,
2417	'active_connected_plugins' => $active_plugins_using_connection,
2418	),
2419	self::$extra_register_params
2420	)
2421	);
2422
2423	$args = array(
2424	'method' => 'POST',
2425	'body' => $body,
2426	'headers' => array(
2427	'Accept' => 'application/json',
2428	),
2429	'timeout' => $timeout,
2430	);
2431
2432	$args['body'] = static::apply_activation_source_to_args( $args['body'] );
2433
2434	// TODO: fix URLs for bad hosts.
2435	$response = Client::_wp_remote_request(
2436	$this->api_url( $api_endpoint ),
2437	$args,
2438	true
2439	);
2440
2441	// Make sure the response is valid and does not contain any Jetpack errors.
2442	$registration_details = $this->validate_remote_register_response( $response );
2443
2444	if ( is_wp_error( $registration_details ) ) {
2445	return $registration_details;
2446	} elseif ( ! $registration_details ) {
2447	return new \WP_Error(
2448	'unknown_error',
2449	'Unknown error registering your Jetpack site.',
2450	wp_remote_retrieve_response_code( $response )
2451	);
2452	}
2453
2454	if ( empty( $registration_details->jetpack_secret ) \|\| ! is_string( $registration_details->jetpack_secret ) ) {
2455	return new \WP_Error(
2456	'jetpack_secret',
2457	'Unable to validate registration of your Jetpack site.',
2458	wp_remote_retrieve_response_code( $response )
2459	);
2460	}
2461
2462	if ( isset( $registration_details->jetpack_public ) ) {
2463	$jetpack_public = (int) $registration_details->jetpack_public;
2464	} else {
2465	$jetpack_public = false;
2466	}
2467
2468	Jetpack_Options::update_options(
2469	array(
2470	'id' => (int) $registration_details->jetpack_id,
2471	'public' => $jetpack_public,
2472	)
2473	);
2474
2475	update_option( Package_Version_Tracker::PACKAGE_VERSION_OPTION, $package_versions );
2476
2477	$this->get_tokens()->update_blog_token( (string) $registration_details->jetpack_secret );
2478
2479	if ( ! Jetpack_Options::get_option( 'id' ) \|\| ! $this->get_tokens()->get_access_token() ) {
2480	return new WP_Error(
2481	'connection_data_save_failed',
2482	'Failed to save connection data in the database'
2483	);
2484	}
2485
2486	$alternate_authorization_url = $registration_details->alternate_authorization_url ?? '';
2487
2488	add_filter(
2489	'jetpack_register_site_rest_response',
2490	function ( $response ) use ( $alternate_authorization_url ) {
2491	$response['alternateAuthorizeUrl'] = $alternate_authorization_url;
2492	return $response;
2493	}
2494	);
2495
2496	/**
2497	* Fires when a site is registered on WordPress.com.
2498	*
2499	* @since 1.7.0
2500	* @since-jetpack 3.7.0
2501	*
2502	* @param int $json->jetpack_id Jetpack Blog ID.
2503	* @param string $json->jetpack_secret Jetpack Blog Token.
2504	* @param int\|bool $jetpack_public Is the site public.
2505	*/
2506	do_action(
2507	'jetpack_site_registered',
2508	$registration_details->jetpack_id,
2509	$registration_details->jetpack_secret,
2510	$jetpack_public
2511	);
2512
2513	if ( isset( $registration_details->token ) ) {
2514	/**
2515	* Fires when a user token is sent along with the registration data.
2516	*
2517	* @since 1.7.0
2518	* @since-jetpack 7.6.0
2519	*
2520	* @param object $token the administrator token for the newly registered site.
2521	*/
2522	do_action( 'jetpack_site_registered_user_token', $registration_details->token );
2523	}
2524
2525	return true;
2526	}
2527
2528	/**
2529	* Attempts Jetpack registration.
2530	*
2531	* @param bool $tos_agree Whether the user agreed to TOS.
2532	*
2533	* @return bool\|WP_Error
2534	*/
2535	public function try_registration( $tos_agree = true ) {
2536	if ( $tos_agree ) {
2537	$terms_of_service = new Terms_Of_Service();
2538	$terms_of_service->agree();
2539	}
2540
2541	/**
2542	* Action fired when the user attempts the registration.
2543	*
2544	* @since 1.26.0
2545	*/
2546	$pre_register = apply_filters( 'jetpack_pre_register', null );
2547
2548	if ( is_wp_error( $pre_register ) ) {
2549	return $pre_register;
2550	}
2551
2552	$tracking_data = array();
2553
2554	if ( null !== $this->get_plugin() ) {
2555	$tracking_data['plugin_slug'] = $this->get_plugin()->get_slug();
2556	}
2557
2558	$tracking = new Tracking();
2559	$tracking->record_user_event( 'jpc_register_begin', $tracking_data );
2560
2561	add_filter( 'jetpack_register_request_body', array( Utils::class, 'filter_register_request_body' ) );
2562
2563	$result = $this->register();
2564
2565	remove_filter( 'jetpack_register_request_body', array( Utils::class, 'filter_register_request_body' ) );
2566
2567	// If there was an error with registration and the site was not registered, record this so we can show a message.
2568	if ( ! $result \|\| is_wp_error( $result ) ) {
2569	return $result;
2570	}
2571
2572	return true;
2573	}
2574
2575	/**
2576	* Adds a parameter to the register request body
2577	*
2578	* @since 1.26.0
2579	*
2580	* @param string $name The name of the parameter to be added.
2581	* @param string $value The value of the parameter to be added.
2582	*
2583	* @throws \InvalidArgumentException If supplied arguments are not strings.
2584	* @return void
2585	*/
2586	public function add_register_request_param( $name, $value ) {
2587	if ( ! is_string( $name ) \|\| ! is_string( $value ) ) {
2588	throw new \InvalidArgumentException( 'name and value must be strings' );
2589	}
2590	self::$extra_register_params[ $name ] = $value;
2591	}
2592
2593	/**
2594	* Takes the response from the Jetpack register new site endpoint and
2595	* verifies it worked properly.
2596	*
2597	* @since 1.7.0
2598	* @since-jetpack 2.6.0
2599	*
2600	* @param mixed $response the response object, or the error object.
2601	* @return string\|WP_Error A JSON object on success or WP_Error on failures
2602	**/
2603	protected function validate_remote_register_response( $response ) {
2604	if ( is_wp_error( $response ) ) {
2605	return new \WP_Error(
2606	'register_http_request_failed',
2607	$response->get_error_message()
2608	);
2609	}
2610
2611	$code = wp_remote_retrieve_response_code( $response );
2612	$entity = wp_remote_retrieve_body( $response );
2613
2614	if ( $entity ) {
2615	$registration_response = json_decode( $entity );
2616	} else {
2617	$registration_response = false;
2618	}
2619
2620	$code_type = (int) ( $code / 100 );
2621	if ( 5 === $code_type ) {
2622	return new \WP_Error( 'wpcom_5??', $code );
2623	} elseif ( 408 === $code ) {
2624	return new \WP_Error( 'wpcom_408', $code );
2625	} elseif ( ! empty( $registration_response->error ) ) {
2626	if (
2627	'xml_rpc-32700' === $registration_response->error
2628	&& ! function_exists( 'xml_parser_create' )
2629	) {
2630	$error_description = __( "PHP's XML extension is not available. Jetpack requires the XML extension to communicate with WordPress.com. Please contact your hosting provider to enable PHP's XML extension.", 'jetpack-connection' );
2631	} else {
2632	$error_description = isset( $registration_response->error_description )
2633	? (string) $registration_response->error_description
2634	: '';
2635	}
2636
2637	return new \WP_Error(
2638	(string) $registration_response->error,
2639	$error_description,
2640	$code
2641	);
2642	} elseif ( 200 !== $code ) {
2643	return new \WP_Error( 'wpcom_bad_response', $code );
2644	}
2645
2646	// Jetpack ID error block.
2647	if ( empty( $registration_response->jetpack_id ) ) {
2648	return new \WP_Error(
2649	'jetpack_id',
2650	/* translators: %s is an error message string */
2651	sprintf( __( 'Error Details: Jetpack ID is empty. Do not publicly post this error message! %s', 'jetpack-connection' ), $entity ),
2652	$entity
2653	);
2654	} elseif ( ! is_scalar( $registration_response->jetpack_id ) ) {
2655	return new \WP_Error(
2656	'jetpack_id',
2657	/* translators: %s is an error message string */
2658	sprintf( __( 'Error Details: Jetpack ID is not a scalar. Do not publicly post this error message! %s', 'jetpack-connection' ), $entity ),
2659	$entity
2660	);
2661	} elseif ( preg_match( '/[^0-9]/', $registration_response->jetpack_id ) ) {
2662	return new \WP_Error(
2663	'jetpack_id',
2664	/* translators: %s is an error message string */
2665	sprintf( __( 'Error Details: Jetpack ID begins with a numeral. Do not publicly post this error message! %s', 'jetpack-connection' ), $entity ),
2666	$entity
2667	);
2668	}
2669
2670	return $registration_response;
2671	}
2672
2673	/**
2674	* Adds a used nonce to a list of known nonces.
2675	*
2676	* @param int $timestamp the current request timestamp.
2677	* @param string $nonce the nonce value.
2678	* @return bool whether the nonce is unique or not.
2679	*
2680	* @deprecated since 1.24.0
2681	* @see Nonce_Handler::add()
2682	*/
2683	public function add_nonce( $timestamp, $nonce ) {
2684	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Nonce_Handler::add' );
2685	return ( new Nonce_Handler() )->add( $timestamp, $nonce );
2686	}
2687
2688	/**
2689	* Cleans nonces that were saved when calling ::add_nonce.
2690	*
2691	* @todo Properly prepare the query before executing it.
2692	*
2693	* @param bool $all whether to clean even non-expired nonces.
2694	*
2695	* @deprecated since 1.24.0
2696	* @see Nonce_Handler::clean_all()
2697	*/
2698	public function clean_nonces( $all = false ) {
2699	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Nonce_Handler::clean_all' );
2700	( new Nonce_Handler() )->clean_all( $all ? PHP_INT_MAX : ( time() - Nonce_Handler::LIFETIME ) );
2701	}
2702
2703	/**
2704	* Sets the Connection custom capabilities.
2705	*
2706	* @param string[] $caps Array of the user's capabilities.
2707	* @param string $cap Capability name.
2708	* @param int $user_id The user ID.
2709	* @param array $args Adds the context to the cap. Typically the object ID.
2710	*/
2711	public function jetpack_connection_custom_caps( $caps, $cap, $user_id, $args ) { // phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
2712	switch ( $cap ) {
2713	case 'jetpack_connect':
2714	case 'jetpack_reconnect':
2715	$is_offline_mode = ( new Status() )->is_offline_mode();
2716	if ( $is_offline_mode ) {
2717	$caps = array( 'do_not_allow' );
2718	break;
2719	}
2720	// Pass through. If it's not offline mode, these should match disconnect.
2721	// Let users disconnect if it's offline mode, just in case things glitch.
2722	case 'jetpack_disconnect':
2723	/**
2724	* Filters the jetpack_disconnect capability.
2725	*
2726	* @since 1.14.2
2727	*
2728	* @param array An array containing the capability name.
2729	*/
2730	$caps = apply_filters( 'jetpack_disconnect_cap', array( 'manage_options' ) );
2731	break;
2732	case 'jetpack_connect_user':
2733	$is_offline_mode = ( new Status() )->is_offline_mode();
2734	if ( $is_offline_mode ) {
2735	$caps = array( 'do_not_allow' );
2736	break;
2737	}
2738	// With site connections in mind, non-admin users can connect their account only if a connection owner exists.
2739	$caps = $this->has_connected_owner() ? array( 'read' ) : array( 'manage_options' );
2740	break;
2741	case 'jetpack_unlink_user':
2742	$is_offline_mode = ( new Status() )->is_offline_mode();
2743	if ( $is_offline_mode ) {
2744	$caps = array( 'do_not_allow' );
2745	break;
2746	}
2747
2748	// Non-admins can always disconnect
2749	$caps = array( 'read' );
2750	break;
2751	}
2752	return $caps;
2753	}
2754
2755	/**
2756	* Builds the timeout limit for queries talking with the wpcom servers.
2757	*
2758	* Based on local php max_execution_time in php.ini
2759	*
2760	* @since 1.7.0
2761	* @since-jetpack 5.4.0
2762	* @return int
2763	**/
2764	public function get_max_execution_time() {
2765	$timeout = (int) ini_get( 'max_execution_time' );
2766
2767	// Ensure exec time set in php.ini.
2768	if ( ! $timeout ) {
2769	$timeout = 30;
2770	}
2771	return $timeout;
2772	}
2773
2774	/**
2775	* Sets a minimum request timeout, and returns the current timeout
2776	*
2777	* @since 1.7.0
2778	* @since-jetpack 5.4.0
2779	* @param int $min_timeout the minimum timeout value.
2780	**/
2781	public function set_min_time_limit( $min_timeout ) {
2782	$timeout = $this->get_max_execution_time();
2783	if ( $timeout < $min_timeout ) {
2784	$timeout = $min_timeout;
2785	set_time_limit( $timeout );
2786	}
2787	return $timeout;
2788	}
2789
2790	/**
2791	* Get our assumed site creation date.
2792	* Calculated based on the earlier date of either:
2793	* - Earliest admin user registration date.
2794	* - Earliest date of post of any post type.
2795	*
2796	* @since 1.7.0
2797	* @since-jetpack 7.2.0
2798	*
2799	* @return string Assumed site creation date and time.
2800	*/
2801	public function get_assumed_site_creation_date() {
2802	$cached_date = get_transient( 'jetpack_assumed_site_creation_date' );
2803	if ( ! empty( $cached_date ) ) {
2804	return $cached_date;
2805	}
2806
2807	/**
2808	* We don't use the 'ID' field, but need it to overcome a WP caching bug: https://core.trac.wordpress.org/ticket/62003
2809	*
2810	* @todo Remote the 'ID' field from users fetching when the issue is fixed and Jetpack-supported WP versions move beyond it.
2811	*/
2812	$earliest_registered_users = get_users(
2813	array(
2814	'role' => 'administrator',
2815	'orderby' => 'user_registered',
2816	'order' => 'ASC',
2817	'fields' => array( 'ID', 'user_registered' ),
2818	'number' => 1,
2819	)
2820	);
2821	$earliest_registration_date = $earliest_registered_users[0]->user_registered;
2822
2823	$earliest_posts = get_posts(
2824	array(
2825	'posts_per_page' => 1,
2826	'post_type' => 'any',
2827	'post_status' => 'any',
2828	'orderby' => 'date',
2829	'order' => 'ASC',
2830	)
2831	);
2832
2833	// If there are no posts at all, we'll count only on user registration date.
2834	if ( $earliest_posts ) {
2835	$earliest_post_date = $earliest_posts[0]->post_date;
2836	} else {
2837	$earliest_post_date = PHP_INT_MAX;
2838	}
2839
2840	$assumed_date = min( $earliest_registration_date, $earliest_post_date );
2841	set_transient( 'jetpack_assumed_site_creation_date', $assumed_date );
2842
2843	return $assumed_date;
2844	}
2845
2846	/**
2847	* Adds the activation source string as a parameter to passed arguments.
2848	*
2849	* @todo Refactor to use rawurlencode() instead of urlencode().
2850	*
2851	* @param array $args arguments that need to have the source added.
2852	* @return array $amended arguments.
2853	*/
2854	public static function apply_activation_source_to_args( $args ) {
2855	$activation_source = get_option( 'jetpack_activation_source' );
2856
2857	if ( ! empty( $activation_source[0] ) ) {
2858	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.urlencode_urlencode
2859	$args['_as'] = urlencode( $activation_source[0] );
2860	}
2861
2862	if ( ! empty( $activation_source[1] ) ) {
2863	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.urlencode_urlencode
2864	$args['_ak'] = urlencode( $activation_source[1] );
2865	}
2866
2867	return $args;
2868	}
2869
2870	/**
2871	* Generates two secret tokens and the end of life timestamp for them.
2872	*
2873	* @param string $action The action name.
2874	* @param int\|bool $user_id The user identifier.
2875	* @param int $exp Expiration time in seconds.
2876	*/
2877	public function generate_secrets( $action, $user_id = false, $exp = 600 ) {
2878	return ( new Secrets() )->generate( $action, $user_id, $exp );
2879	}
2880
2881	/**
2882	* Returns two secret tokens and the end of life timestamp for them.
2883	*
2884	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Secrets->get() instead.
2885	*
2886	* @param string $action The action name.
2887	* @param int $user_id The user identifier.
2888	* @return string\|array an array of secrets or an error string.
2889	*/
2890	public function get_secrets( $action, $user_id ) {
2891	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Secrets->get' );
2892	return ( new Secrets() )->get( $action, $user_id );
2893	}
2894
2895	/**
2896	* Deletes secret tokens in case they, for example, have expired.
2897	*
2898	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Secrets->delete() instead.
2899	*
2900	* @param string $action The action name.
2901	* @param int $user_id The user identifier.
2902	*/
2903	public function delete_secrets( $action, $user_id ) {
2904	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Secrets->delete' );
2905	( new Secrets() )->delete( $action, $user_id );
2906	}
2907
2908	/**
2909	* Deletes all connection tokens and transients from the local Jetpack site.
2910	* If the plugin object has been provided in the constructor, the function first checks
2911	* whether it's the only active connection.
2912	* If there are any other connections, the function will do nothing and return `false`
2913	* (unless `$ignore_connected_plugins` is set to `true`).
2914	*
2915	* @param bool $ignore_connected_plugins Delete the tokens even if there are other connected plugins.
2916	*
2917	* @return bool True if disconnected successfully, false otherwise.
2918	*/
2919	public function delete_all_connection_tokens( $ignore_connected_plugins = false ) {
2920	// refuse to delete if we're not the last Jetpack plugin installed.
2921	if ( ! $ignore_connected_plugins && null !== $this->plugin && ! $this->plugin->is_only() ) {
2922	return false;
2923	}
2924
2925	/**
2926	* Fires upon the disconnect attempt.
2927	* Return `false` to prevent the disconnect.
2928	*
2929	* @since 1.14.2
2930	*/
2931	if ( ! apply_filters( 'jetpack_connection_delete_all_tokens', true ) ) {
2932	return false;
2933	}
2934
2935	// The protected owner anchor is a local cache of a record WordPress.com owns. Dropping it
2936	// here keeps a disconnected site from carrying a lock that names a user who no longer holds
2937	// a token; the anchor is re-established from WordPress.com when the owner reconnects.
2938	\Jetpack_Options::delete_option(
2939	array(
2940	'master_user',
2941	'protected_owner',
2942	'time_diff',
2943	'fallback_no_verify_ssl_certs',
2944	)
2945	);
2946
2947	// Clear the memoized connection owner ID since it changed
2948	self::$connection_owner_id = null;
2949
2950	( new Secrets() )->delete_all();
2951	$this->get_tokens()->delete_all();
2952
2953	// Delete cached connected user data.
2954	$transient_key = 'jetpack_connected_user_data_' . get_current_user_id();
2955	delete_transient( $transient_key );
2956
2957	// Delete the cached site record, which a later connection must not serve.
2958	self::delete_cached_site_data();
2959
2960	// Delete all XML-RPC errors.
2961	Error_Handler::get_instance()->delete_all_errors();
2962
2963	return true;
2964	}
2965
2966	/**
2967	* Tells WordPress.com to disconnect the site and clear all tokens from cached site.
2968	* If the plugin object has been provided in the constructor, the function first check
2969	* whether it's the only active connection.
2970	* If there are any other connections, the function will do nothing and return `false`
2971	* (unless `$ignore_connected_plugins` is set to `true`).
2972	*
2973	* @param bool $ignore_connected_plugins Delete the tokens even if there are other connected plugins.
2974	*
2975	* @return bool True if disconnected successfully, false otherwise.
2976	*/
2977	public function disconnect_site_wpcom( $ignore_connected_plugins = false ) {
2978	if ( ! $ignore_connected_plugins && null !== $this->plugin && ! $this->plugin->is_only() ) {
2979	return false;
2980	}
2981
2982	if ( ( new Status() )->is_offline_mode() && ! apply_filters( 'jetpack_connection_disconnect_site_wpcom_offline_mode', false ) ) {
2983	// Prevent potential disconnect of the live site by removing WPCOM tokens.
2984	return false;
2985	}
2986
2987	/**
2988	* Fires upon the disconnect attempt.
2989	* Return `false` to prevent the disconnect.
2990	*
2991	* @since 1.14.2
2992	*/
2993	if ( ! apply_filters( 'jetpack_connection_disconnect_site_wpcom', true, $this ) ) {
2994	return false;
2995	}
2996
2997	$xml = new Jetpack_IXR_Client();
2998	$xml->query( 'jetpack.deregister', get_current_user_id() );
2999
3000	return true;
3001	}
3002
3003	/**
3004	* Disconnect the plugin and remove the tokens.
3005	* This function will automatically perform "soft" or "hard" disconnect depending on whether other plugins are using the connection.
3006	* This is a proxy method to simplify the Connection package API.
3007	*
3008	* @see Manager::disconnect_site()
3009	*
3010	* @param boolean $disconnect_wpcom Should disconnect_site_wpcom be called.
3011	* @param bool $ignore_connected_plugins Delete the tokens even if there are other connected plugins.
3012	* @return bool
3013	*/
3014	public function remove_connection( $disconnect_wpcom = true, $ignore_connected_plugins = false ) {
3015
3016	$this->disconnect_site( $disconnect_wpcom, $ignore_connected_plugins );
3017
3018	return true;
3019	}
3020
3021	/**
3022	* Completely clearing up the connection, and initiating reconnect.
3023	*
3024	* @return true\|WP_Error True if reconnected successfully, a `WP_Error` object otherwise.
3025	*/
3026	public function reconnect() {
3027	( new Tracking() )->record_user_event( 'restore_connection_reconnect' );
3028
3029	$this->disconnect_site_wpcom( true );
3030
3031	return $this->register();
3032	}
3033
3034	/**
3035	* Validate the tokens, and refresh the invalid ones.
3036	*
3037	* @since 9.8.1 When token validation is inconclusive, check the blog token on its own instead of assuming both are broken.
3038	*
3039	* @return string\|bool\|WP_Error True if connection restored or string indicating what's to be done next. A `WP_Error` object or false otherwise.
3040	*/
3041	public function restore() {
3042	// If this is a site connection we need to trigger a full reconnection as our only secure means of
3043	// communication with WPCOM, aka the blog token, is compromised.
3044	if ( $this->is_site_connection() ) {
3045	return $this->reconnect();
3046	}
3047
3048	$validate_tokens_response = $this->get_tokens()->validate();
3049
3050	if ( is_array( $validate_tokens_response ) &&
3051	isset( $validate_tokens_response['blog_token']['is_healthy'] ) &&
3052	isset( $validate_tokens_response['user_token']['is_healthy'] ) ) {
3053	$blog_token_healthy = $validate_tokens_response['blog_token']['is_healthy'];
3054	$user_token_healthy = $validate_tokens_response['user_token']['is_healthy'];
3055	} else {
3056	// The paired health check could not run (a token is missing locally — e.g. a
3057	// deleted owner token — or the request failed): no evidence the blog token is
3058	// broken, and it's the one credential reconnect() would revoke for every user,
3059	// so check it on its own before that teardown.
3060	$blog_token_healthy = true === $this->get_tokens()->validate_blog_token();
3061	$user_token_healthy = false; // Unknown, treated as unhealthy.
3062	}
3063
3064	// Tokens are both valid, or both invalid. We can't fix the problem we don't see, so the full reconnection is needed.
3065	if ( $blog_token_healthy === $user_token_healthy ) {
3066	$result = $this->reconnect();
3067	return ( true === $result ) ? 'authorize' : $result;
3068	}
3069
3070	if ( ! $blog_token_healthy ) {
3071	return $this->refresh_blog_token();
3072	}
3073
3074	if ( ! $user_token_healthy ) {
3075	return ( true === $this->refresh_user_token() ) ? 'authorize' : false;
3076	}
3077
3078	return false;
3079	}
3080
3081	/**
3082	* Responds to a WordPress.com call to register the current site.
3083	* Should be changed to protected.
3084	*
3085	* @param array $registration_data Array of [ secret_1, user_id ].
3086	*/
3087	public function handle_registration( array $registration_data ) {
3088	list( $registration_secret_1, $registration_user_id ) = $registration_data;
3089	if ( empty( $registration_user_id ) ) {
3090	return new \WP_Error( 'registration_state_invalid', __( 'Invalid Registration State', 'jetpack-connection' ), 400 );
3091	}
3092
3093	return ( new Secrets() )->verify( 'register', $registration_secret_1, (int) $registration_user_id );
3094	}
3095
3096	/**
3097	* Perform the API request to validate the blog and user tokens.
3098	*
3099	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Tokens->validate_tokens() instead.
3100	*
3101	* @param int\|null $user_id ID of the user we need to validate token for. Current user's ID by default.
3102	*
3103	* @return array\|false\|WP_Error The API response: `array( 'blog_token_is_healthy' => true\|false, 'user_token_is_healthy' => true\|false )`.
3104	*/
3105	public function validate_tokens( $user_id = null ) {
3106	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Tokens->validate' );
3107	return $this->get_tokens()->validate( $user_id );
3108	}
3109
3110	/**
3111	* Verify a Previously Generated Secret.
3112	*
3113	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Secrets->verify() instead.
3114	*
3115	* @param string $action The type of secret to verify.
3116	* @param string $secret_1 The secret string to compare to what is stored.
3117	* @param int $user_id The user ID of the owner of the secret.
3118	* @return \WP_Error\|string WP_Error on failure, secret_2 on success.
3119	*/
3120	public function verify_secrets( $action, $secret_1, $user_id ) {
3121	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Secrets->verify' );
3122	return ( new Secrets() )->verify( $action, $secret_1, $user_id );
3123	}
3124
3125	/**
3126	* Responds to a WordPress.com call to authorize the current user.
3127	* Should be changed to protected.
3128	*/
3129	public function handle_authorization() {
3130	}
3131
3132	/**
3133	* Obtains the auth token.
3134	*
3135	* @param array $data The request data.
3136	* @return object\|\WP_Error Returns the auth token on success.
3137	* Returns a \WP_Error on failure.
3138	*/
3139	public function get_token( $data ) {
3140	return $this->get_tokens()->get( $data, $this->api_url( 'token' ) );
3141	}
3142
3143	/**
3144	* Builds a URL to the Jetpack connection auth page.
3145	*
3146	* @since 2.7.6 Added optional $from and $raw parameters.
3147	*
3148	* @param WP_User\|null $user (optional) defaults to the current logged in user.
3149	* @param string\|null $redirect (optional) a redirect URL to use instead of the default.
3150	* @param bool\|string $from If not false, adds 'from=$from' param to the connect URL.
3151	* @param bool $raw If true, URL will not be escaped.
3152	*
3153	* @return string Connect URL.
3154	*/
3155	public function get_authorization_url( $user = null, $redirect = null, $from = false, $raw = false ) {
3156	if ( empty( $user ) ) {
3157	$user = wp_get_current_user();
3158	}
3159
3160	$roles = new Roles();
3161	$role = $roles->translate_user_to_role( $user );
3162	$signed_role = $this->get_tokens()->sign_role( $role );
3163
3164	/**
3165	* Filter the URL of the first time the user gets redirected back to your site for connection
3166	* data processing.
3167	*
3168	* @since 1.7.0
3169	* @since-jetpack 8.0.0
3170	*
3171	* @param string $redirect_url Defaults to the site admin URL.
3172	*/
3173	$processing_url = apply_filters( 'jetpack_connect_processing_url', admin_url( 'admin.php' ) );
3174
3175	/**
3176	* Filter the URL to redirect the user back to when the authorization process
3177	* is complete.
3178	*
3179	* @since 1.7.0
3180	* @since-jetpack 8.0.0
3181	*
3182	* @param string $redirect_url Defaults to the site URL.
3183	*/
3184	$redirect = apply_filters( 'jetpack_connect_redirect_url', $redirect );
3185
3186	$secrets = ( new Secrets() )->generate( 'authorize', $user->ID, 2 * HOUR_IN_SECONDS );
3187
3188	/**
3189	* Filter the type of authorization.
3190	* 'calypso' completes authorization on wordpress.com/jetpack/connect
3191	* while 'jetpack' ( or any other value ) completes the authorization at jetpack.wordpress.com.
3192	*
3193	* @since 1.7.0
3194	* @since-jetpack 4.3.3
3195	*
3196	* @param string $auth_type Defaults to 'calypso', can also be 'jetpack'.
3197	*/
3198	$auth_type = apply_filters( 'jetpack_auth_type', 'calypso' );
3199
3200	$body_args = array(
3201	'response_type' => 'code',
3202	'client_id' => \Jetpack_Options::get_option( 'id' ),
3203	'redirect_uri' => add_query_arg(
3204	array(
3205	'handler' => 'jetpack-connection-webhooks',
3206	'action' => 'authorize',
3207	'_wpnonce' => wp_create_nonce( "jetpack-authorize_{$role}_{$redirect}" ),
3208	'redirect' => $redirect ? rawurlencode( $redirect ) : false,
3209	),
3210	esc_url( $processing_url )
3211	),
3212	'state' => $user->ID,
3213	'scope' => $signed_role,
3214	'user_email' => $user->user_email,
3215	'user_login' => $user->user_login,
3216	'is_active' => $this->has_connected_owner(), // TODO Deprecate this.
3217	'jp_version' => (string) Constants::get_constant( 'JETPACK__VERSION' ),
3218	'auth_type' => $auth_type,
3219	'secret' => $secrets['secret_1'],
3220	'blogname' => get_option( 'blogname' ),
3221	'site_url' => Urls::site_url(),
3222	'home_url' => Urls::home_url(),
3223	'site_icon' => get_site_icon_url(),
3224	'site_lang' => get_locale(),
3225	'site_created' => $this->get_assumed_site_creation_date(),
3226	'allow_site_connection' => ! $this->has_connected_owner(),
3227	'calypso_env' => ( new Host() )->get_calypso_env(),
3228	'source' => ( new Host() )->get_source_query(),
3229	);
3230
3231	// Include the slugs of every plugin currently using the Jetpack connection so wpcom
3232	// knows which integrations the site is authorizing on behalf of. `Plugin_Storage::get_all()`
3233	// returns a `WP_Error` when called before `plugins_loaded`; in that case we silently skip.
3234	$active_plugins = Plugin_Storage::get_all();
3235	if ( is_array( $active_plugins ) && ! empty( $active_plugins ) ) {
3236	$body_args['plugins'] = implode( ',', array_keys( $active_plugins ) );
3237	}
3238
3239	// Signal to Calypso that the site already has a connection owner so the
3240	// authorize page can show secondary-connection content where appropriate.
3241	if ( $this->has_connected_owner() ) {
3242	$body_args['has_connected_owner'] = true;
3243	}
3244
3245	/**
3246	* Filters the user connection request data for additional property addition.
3247	*
3248	* @since 1.7.0
3249	* @since-jetpack 8.0.0
3250	*
3251	* @param array $request_data request data.
3252	*/
3253	$body = apply_filters( 'jetpack_connect_request_body', $body_args );
3254
3255	$body = static::apply_activation_source_to_args( urlencode_deep( $body ) );
3256
3257	$api_url = $this->api_url( 'authorize' );
3258
3259	$url = add_query_arg( $body, $api_url );
3260
3261	if ( is_network_admin() ) {
3262	$url = add_query_arg( 'is_multisite', network_admin_url( 'admin.php?page=jetpack-settings' ), $url );
3263	}
3264
3265	if ( $from ) {
3266	$url = add_query_arg( 'from', $from, $url );
3267	}
3268
3269	if ( $raw ) {
3270	$url = esc_url_raw( $url );
3271	}
3272
3273	/**
3274	* Filter the URL used when connecting a user to a WordPress.com account.
3275	*
3276	* @since 2.0.0
3277	* @since 2.7.6 Added $raw parameter.
3278	*
3279	* @param string $url Connection URL.
3280	* @param bool $raw If true, URL will not be escaped.
3281	*/
3282	return apply_filters( 'jetpack_build_authorize_url', $url, $raw );
3283	}
3284
3285	/**
3286	* Authorizes the user by obtaining and storing the user token.
3287	*
3288	* @since 9.8.1 Only a user with `jetpack_connect` can take a vacant connection owner slot.
3289	*
3290	* @param array $data The request data.
3291	* @return string\|\WP_Error Returns a string on success.
3292	* Returns a \WP_Error on failure.
3293	*/
3294	public function authorize( $data = array() ) {
3295	/**
3296	* Action fired when user authorization starts.
3297	*
3298	* @since 1.7.0
3299	* @since-jetpack 8.0.0
3300	*/
3301	do_action( 'jetpack_authorize_starting' );
3302
3303	$roles = new Roles();
3304	$role = $roles->translate_current_user_to_role();
3305
3306	if ( ! $role ) {
3307	return new \WP_Error( 'no_role', 'Invalid request.', 400 );
3308	}
3309
3310	$cap = $roles->translate_role_to_cap( $role );
3311	if ( ! $cap ) {
3312	return new \WP_Error( 'no_cap', 'Invalid request.', 400 );
3313	}
3314
3315	if ( ! empty( $data['error'] ) ) {
3316	return new \WP_Error( $data['error'], 'Error included in the request.', 400 );
3317	}
3318
3319	if ( ! isset( $data['state'] ) ) {
3320	return new \WP_Error( 'no_state', 'Request must include state.', 400 );
3321	}
3322
3323	if ( ! ctype_digit( $data['state'] ) ) {
3324	return new \WP_Error( $data['error'], 'State must be an integer.', 400 );
3325	}
3326
3327	$current_user_id = get_current_user_id();
3328	if ( $current_user_id !== (int) $data['state'] ) {
3329	return new \WP_Error( 'wrong_state', 'State does not match current user.', 400 );
3330	}
3331
3332	if ( empty( $data['code'] ) ) {
3333	return new \WP_Error( 'no_code', 'Request must include an authorization code.', 400 );
3334	}
3335
3336	$token = $this->get_tokens()->get( $data, $this->api_url( 'token' ) );
3337
3338	if ( is_wp_error( $token ) ) {
3339	$code = $token->get_error_code();
3340	if ( empty( $code ) ) {
3341	$code = 'invalid_token';
3342	}
3343	return new \WP_Error( $code, $token->get_error_message(), 400 );
3344	}
3345
3346	if ( ! $token ) {
3347	return new \WP_Error( 'no_token', 'Error generating token.', 400 );
3348	}
3349
3350	// Only a user who may manage the site connection takes a vacant owner slot; others link as secondary users.
3351	$is_connection_owner = ! $this->has_connected_owner() && current_user_can( 'jetpack_connect' );
3352
3353	$this->get_tokens()->update_user_token( $current_user_id, sprintf( '%s.%d', $token, $current_user_id ), $is_connection_owner );
3354
3355	// Delete cached connected user data, so a cached failure from the
3356	// previous (broken) token doesn't linger after reconnecting.
3357	delete_transient( "jetpack_connected_user_data_$current_user_id" );
3358
3359	/**
3360	* Fires after user has successfully received an auth token.
3361	*
3362	* @since 1.7.0
3363	* @since-jetpack 3.9.0
3364	*/
3365	do_action( 'jetpack_user_authorized' );
3366
3367	if ( ! $is_connection_owner ) {
3368	/**
3369	* Action fired when a secondary user has been authorized.
3370	*
3371	* @since 1.7.0
3372	* @since-jetpack 8.0.0
3373	*/
3374	do_action( 'jetpack_authorize_ending_linked' );
3375	return 'linked';
3376	}
3377
3378	/**
3379	* Action fired when the master user has been authorized.
3380	*
3381	* @since 1.7.0
3382	* @since-jetpack 8.0.0
3383	*
3384	* @param array $data The request data.
3385	*/
3386	do_action( 'jetpack_authorize_ending_authorized', $data );
3387
3388	\Jetpack_Options::delete_raw_option( 'jetpack_last_connect_url_check' );
3389
3390	( new Nonce_Handler() )->reschedule();
3391
3392	return 'authorized';
3393	}
3394
3395	/**
3396	* Disconnects from the Jetpack servers.
3397	* Forgets all connection details and tells the Jetpack servers to do the same.
3398	*
3399	* @param boolean $disconnect_wpcom Should disconnect_site_wpcom be called.
3400	* @param bool $ignore_connected_plugins Delete the tokens even if there are other connected plugins.
3401	*/
3402	public function disconnect_site( $disconnect_wpcom = true, $ignore_connected_plugins = true ) {
3403	if ( ! $ignore_connected_plugins && null !== $this->plugin && ! $this->plugin->is_only() ) {
3404	return false;
3405	}
3406
3407	wp_clear_scheduled_hook( 'jetpack_clean_nonces' );
3408
3409	( new Nonce_Handler() )->clean_all();
3410
3411	Heartbeat::init()->deactivate();
3412
3413	/**
3414	* Fires before a site is disconnected.
3415	*
3416	* @since 1.36.3
3417	*/
3418	do_action( 'jetpack_site_before_disconnected' );
3419
3420	// If the site is in an IDC because sync is not allowed,
3421	// let's make sure to not disconnect the production site.
3422	if ( $disconnect_wpcom ) {
3423	$tracking = new Tracking();
3424	$tracking->record_user_event( 'disconnect_site', array() );
3425
3426	$this->disconnect_site_wpcom( $ignore_connected_plugins );
3427	}
3428
3429	$this->delete_all_connection_tokens( $ignore_connected_plugins );
3430
3431	// Remove tracked package versions, since they depend on the Jetpack Connection.
3432	delete_option( Package_Version_Tracker::PACKAGE_VERSION_OPTION );
3433
3434	$jetpack_unique_connection = \Jetpack_Options::get_option( 'unique_connection' );
3435	if ( $jetpack_unique_connection ) {
3436	// Check then record unique disconnection if site has never been disconnected previously.
3437	if ( - 1 === $jetpack_unique_connection['disconnected'] ) {
3438	$jetpack_unique_connection['disconnected'] = 1;
3439	} else {
3440	if ( 0 === $jetpack_unique_connection['disconnected'] ) {
3441	$a8c_mc_stats_instance = new A8c_Mc_Stats();
3442	$a8c_mc_stats_instance->add( 'connections', 'unique-disconnect' );
3443	$a8c_mc_stats_instance->do_server_side_stats();
3444	}
3445	// increment number of times disconnected.
3446	$jetpack_unique_connection['disconnected'] += 1;
3447	}
3448
3449	\Jetpack_Options::update_option( 'unique_connection', $jetpack_unique_connection );
3450	}
3451
3452	/**
3453	* Fires when a site is disconnected.
3454	*
3455	* @since 1.30.1
3456	*/
3457	do_action( 'jetpack_site_disconnected' );
3458	}
3459
3460	/**
3461	* The Base64 Encoding of the SHA1 Hash of the Input.
3462	*
3463	* @param string $text The string to hash.
3464	* @return string
3465	*/
3466	public function sha1_base64( $text ) {
3467	return base64_encode( sha1( $text, true ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
3468	}
3469
3470	/**
3471	* This function mirrors Jetpack_Data::is_usable_domain() in the WPCOM codebase.
3472	*
3473	* @param string $domain The domain to check.
3474	*
3475	* @return bool\|WP_Error
3476	*/
3477	public function is_usable_domain( $domain ) {
3478
3479	// If it's empty, just fail out.
3480	if ( ! $domain ) {
3481	return new \WP_Error(
3482	'fail_domain_empty',
3483	/* translators: %1$s is a domain name. */
3484	sprintf( __( 'Domain `%1$s` just failed is_usable_domain check as it is empty.', 'jetpack-connection' ), $domain )
3485	);
3486	}
3487
3488	/**
3489	* Skips the usuable domain check when connecting a site.
3490	*
3491	* Allows site administrators with domains that fail gethostname-based checks to pass the request to WP.com
3492	*
3493	* @since 1.7.0
3494	* @since-jetpack 4.1.0
3495	*
3496	* @param bool If the check should be skipped. Default false.
3497	*/
3498	if ( apply_filters( 'jetpack_skip_usuable_domain_check', false ) ) {
3499	return true;
3500	}
3501
3502	// None of the explicit localhosts.
3503	$forbidden_domains = array(
3504	'wordpress.com',
3505	'localhost',
3506	'localhost.localdomain',
3507	'local.wordpress.test', // VVV pattern.
3508	'local.wordpress-trunk.test', // VVV pattern.
3509	'src.wordpress-develop.test', // VVV pattern.
3510	'build.wordpress-develop.test', // VVV pattern.
3511	);
3512	if ( in_array( $domain, $forbidden_domains, true ) ) {
3513	return new \WP_Error(
3514	'fail_domain_forbidden',
3515	sprintf(
3516	/* translators: %1$s is a domain name. */
3517	__(
3518	'Domain `%1$s` just failed is_usable_domain check as it is in the forbidden array.',
3519	'jetpack-connection'
3520	),
3521	$domain
3522	)
3523	);
3524	}
3525
3526	// No .test or .local domains.
3527	if ( preg_match( '#\.(test\|local)$#i', $domain ) ) {
3528	return new \WP_Error(
3529	'fail_domain_tld',
3530	sprintf(
3531	/* translators: %1$s is a domain name. */
3532	__(
3533	'Domain `%1$s` just failed is_usable_domain check as it uses an invalid top level domain.',
3534	'jetpack-connection'
3535	),
3536	$domain
3537	)
3538	);
3539	}
3540
3541	// No WPCOM subdomains.
3542	if ( preg_match( '#\.WordPress\.com$#i', $domain ) ) {
3543	return new \WP_Error(
3544	'fail_subdomain_wpcom',
3545	sprintf(
3546	/* translators: %1$s is a domain name. */
3547	__(
3548	'Domain `%1$s` just failed is_usable_domain check as it is a subdomain of WordPress.com.',
3549	'jetpack-connection'
3550	),
3551	$domain
3552	)
3553	);
3554	}
3555
3556	// If PHP was compiled without support for the Filter module (very edge case).
3557	if ( ! function_exists( 'filter_var' ) ) {
3558	// Just pass back true for now, and let wpcom sort it out.
3559	return true;
3560	}
3561
3562	$domain = preg_replace( '#^https?://#', '', untrailingslashit( $domain ) );
3563
3564	if ( filter_var( $domain, FILTER_VALIDATE_IP )
3565	&& ! \Automattic\Jetpack\IP\Utils::ip_is_public( $domain )
3566	) {
3567	return new \WP_Error(
3568	'fail_ip_forbidden',
3569	sprintf(
3570	/* translators: %1$s is a domain name. */
3571	__(
3572	'IP address `%1$s` just failed is_usable_domain check as it is not a public IP address.',
3573	'jetpack-connection'
3574	),
3575	$domain
3576	)
3577	);
3578	}
3579
3580	return true;
3581	}
3582
3583	/**
3584	* Gets the requested token.
3585	*
3586	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Tokens->get_access_token() instead.
3587	*
3588	* @param int\|false $user_id false: Return the Blog Token. int: Return that user's User Token.
3589	* @param string\|false $token_key If provided, check that the token matches the provided input.
3590	* @param bool\|true $suppress_errors If true, return a falsy value when the token isn't found; When false, return a descriptive WP_Error when the token isn't found.
3591	*
3592	* @return object\|false
3593	*
3594	* @see $this->get_tokens()->get_access_token()
3595	*/
3596	public function get_access_token( $user_id = false, $token_key = false, $suppress_errors = true ) {
3597	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Tokens->get_access_token' );
3598	return $this->get_tokens()->get_access_token( $user_id, $token_key, $suppress_errors );
3599	}
3600
3601	/**
3602	* In some setups, $HTTP_RAW_POST_DATA can be emptied during some IXR_Server paths
3603	* since it is passed by reference to various methods.
3604	* Capture it here so we can verify the signature later.
3605	*
3606	* @param array $methods an array of available XMLRPC methods.
3607	* @return array the same array, since this method doesn't add or remove anything.
3608	*/
3609	public function xmlrpc_methods( $methods ) {
3610	$this->raw_post_data = $GLOBALS['HTTP_RAW_POST_DATA'] ?? null;
3611	return $methods;
3612	}
3613
3614	/**
3615	* Resets the raw post data parameter for testing purposes.
3616	*/
3617	public function reset_raw_post_data() {
3618	$this->raw_post_data = null;
3619	}
3620
3621	/**
3622	* Registering an additional method.
3623	*
3624	* @param array $methods an array of available XMLRPC methods.
3625	* @return array the amended array in case the method is added.
3626	*/
3627	public function public_xmlrpc_methods( $methods ) {
3628	if ( array_key_exists( 'wp.getOptions', $methods ) ) {
3629	$methods['wp.getOptions'] = array( $this, 'jetpack_get_options' );
3630	}
3631	return $methods;
3632	}
3633
3634	/**
3635	* Handles a getOptions XMLRPC method call.
3636	*
3637	* @param array $args method call arguments.
3638	* @return array\|IXR_Error An amended XMLRPC server options array.
3639	*/
3640	public function jetpack_get_options( $args ) {
3641	global $wp_xmlrpc_server;
3642
3643	$wp_xmlrpc_server->escape( $args );
3644
3645	$username = $args[1];
3646	$password = $args[2];
3647
3648	$user = $wp_xmlrpc_server->login( $username, $password );
3649	if ( ! $user ) {
3650	return $wp_xmlrpc_server->error;
3651	}
3652
3653	$options = array();
3654	$user_data = $this->get_connected_user_data();
3655	if ( is_array( $user_data ) ) {
3656	$options['jetpack_user_id'] = array(
3657	'desc' => __( 'The WP.com user ID of the connected user', 'jetpack-connection' ),
3658	'readonly' => true,
3659	'value' => $user_data['ID'],
3660	);
3661	$options['jetpack_user_login'] = array(
3662	'desc' => __( 'The WP.com username of the connected user', 'jetpack-connection' ),
3663	'readonly' => true,
3664	'value' => $user_data['login'],
3665	);
3666	$options['jetpack_user_email'] = array(
3667	'desc' => __( 'The WP.com user email of the connected user', 'jetpack-connection' ),
3668	'readonly' => true,
3669	'value' => $user_data['email'],
3670	);
3671	$options['jetpack_user_site_count'] = array(
3672	'desc' => __( 'The number of sites of the connected WP.com user', 'jetpack-connection' ),
3673	'readonly' => true,
3674	'value' => $user_data['site_count'],
3675	);
3676	}
3677	$wp_xmlrpc_server->blog_options = array_merge( $wp_xmlrpc_server->blog_options, $options );
3678	$args = stripslashes_deep( $args );
3679	return $wp_xmlrpc_server->wp_getOptions( $args );
3680	}
3681
3682	/**
3683	* Adds Jetpack-specific options to the output of the XMLRPC options method.
3684	*
3685	* @param array $options standard Core options.
3686	* @return array amended options.
3687	*/
3688	public function xmlrpc_options( $options ) {
3689	$jetpack_client_id = false;
3690	if ( $this->is_connected() ) {
3691	$jetpack_client_id = \Jetpack_Options::get_option( 'id' );
3692	}
3693	$options['jetpack_version'] = array(
3694	'desc' => __( 'Jetpack Plugin Version', 'jetpack-connection' ),
3695	'readonly' => true,
3696	'value' => Constants::get_constant( 'JETPACK__VERSION' ),
3697	);
3698
3699	$options['jetpack_client_id'] = array(
3700	'desc' => __( 'The Client ID/WP.com Blog ID of this site', 'jetpack-connection' ),
3701	'readonly' => true,
3702	'value' => $jetpack_client_id,
3703	);
3704	return $options;
3705	}
3706
3707	/**
3708	* Resets the saved authentication state in between testing requests.
3709	*/
3710	public function reset_saved_auth_state() {
3711	$this->xmlrpc_verification = null;
3712	}
3713
3714	/**
3715	* Sign a user role with the master access token.
3716	* If not specified, will default to the current user.
3717	*
3718	* @access public
3719	*
3720	* @param string $role User role.
3721	* @param int $user_id ID of the user.
3722	* @return string Signed user role.
3723	*/
3724	public function sign_role( $role, $user_id = null ) {
3725	return $this->get_tokens()->sign_role( $role, $user_id );
3726	}
3727
3728	/**
3729	* Set the plugin instance.
3730	*
3731	* @param Plugin $plugin_instance The plugin instance.
3732	*
3733	* @return $this
3734	*/
3735	public function set_plugin_instance( Plugin $plugin_instance ) {
3736	$this->plugin = $plugin_instance;
3737
3738	return $this;
3739	}
3740
3741	/**
3742	* Retrieve the plugin management object.
3743	*
3744	* @return Plugin\|null
3745	*/
3746	public function get_plugin() {
3747	return $this->plugin;
3748	}
3749
3750	/**
3751	* Get all connected plugins information, excluding those disconnected by user.
3752	* WARNING: the method cannot be called until Plugin_Storage::configure is called, which happens on plugins_loaded
3753	* Even if you don't use Jetpack Config, it may be introduced later by other plugins,
3754	* so please make sure not to run the method too early in the code.
3755	*
3756	* @return array\|WP_Error
3757	*/
3758	public function get_connected_plugins() {
3759	$maybe_plugins = Plugin_Storage::get_all();
3760
3761	if ( $maybe_plugins instanceof WP_Error ) {
3762	return $maybe_plugins;
3763	}
3764
3765	return $maybe_plugins;
3766	}
3767
3768	/**
3769	* Force plugin disconnect. After its called, the plugin will not be allowed to use the connection.
3770	* Note: this method does not remove any access tokens.
3771	*
3772	* @deprecated since 1.39.0
3773	* @return bool
3774	*/
3775	public function disable_plugin() {
3776	return null;
3777	}
3778
3779	/**
3780	* Force plugin reconnect after user-initiated disconnect.
3781	* After its called, the plugin will be allowed to use the connection again.
3782	* Note: this method does not initialize access tokens.
3783	*
3784	* @deprecated since 1.39.0.
3785	* @return bool
3786	*/
3787	public function enable_plugin() {
3788	return null;
3789	}
3790
3791	/**
3792	* Whether the plugin is allowed to use the connection, or it's been disconnected by user.
3793	* If no plugin slug was passed into the constructor, always returns true.
3794	*
3795	* @deprecated 1.42.0 This method no longer has a purpose after the removal of the soft disconnect feature.
3796	*
3797	* @return bool
3798	*/
3799	public function is_plugin_enabled() {
3800	return true;
3801	}
3802
3803	/**
3804	* Perform the API request to refresh the blog token.
3805	* Note that we are making this request on behalf of the Jetpack master user,
3806	* given they were (most probably) the ones that registered the site at the first place.
3807	*
3808	* @return WP_Error\|bool The result of updating the blog_token option.
3809	*/
3810	public function refresh_blog_token() {
3811	( new Tracking() )->record_user_event( 'restore_connection_refresh_blog_token' );
3812
3813	$blog_id = \Jetpack_Options::get_option( 'id' );
3814	if ( ! $blog_id ) {
3815	return new WP_Error( 'site_not_registered', 'Site not registered.' );
3816	}
3817
3818	$url = sprintf(
3819	'%s/%s/v%s/%s',
3820	Constants::get_constant( 'JETPACK__WPCOM_JSON_API_BASE' ),
3821	'wpcom',
3822	'2',
3823	'sites/' . $blog_id . '/jetpack-refresh-blog-token'
3824	);
3825	$method = 'POST';
3826	$user_id = get_current_user_id();
3827
3828	$response = Client::remote_request( compact( 'url', 'method', 'user_id' ) );
3829
3830	if ( is_wp_error( $response ) ) {
3831	return new WP_Error( 'refresh_blog_token_http_request_failed', $response->get_error_message() );
3832	}
3833
3834	$code = wp_remote_retrieve_response_code( $response );
3835	$entity = wp_remote_retrieve_body( $response );
3836
3837	if ( $entity ) {
3838	$json = json_decode( $entity );
3839	} else {
3840	$json = false;
3841	}
3842
3843	if ( 200 !== $code ) {
3844	if ( empty( $json->code ) ) {
3845	return new WP_Error( 'unknown', '', $code );
3846	}
3847
3848	/* translators: Error description string. */
3849	$error_description = isset( $json->message ) ? sprintf( __( 'Error Details: %s', 'jetpack-connection' ), (string) $json->message ) : '';
3850
3851	return new WP_Error( (string) $json->code, $error_description, $code );
3852	}
3853
3854	if ( empty( $json->jetpack_secret ) \|\| ! is_scalar( $json->jetpack_secret ) ) {
3855	return new WP_Error( 'jetpack_secret', '', $code );
3856	}
3857
3858	Error_Handler::get_instance()->delete_all_errors();
3859
3860	return $this->get_tokens()->update_blog_token( (string) $json->jetpack_secret );
3861	}
3862
3863	/**
3864	* Disconnect the user from WP.com, and initiate the reconnect process.
3865	*
3866	* @since 9.8.0 Added the `$force` parameter.
3867	*
3868	* @param bool $force Whether to remove the local token even if WordPress.com does not confirm the unlink.
3869	* When false, only the current user's own token is refreshed, never the owner's,
3870	* and only over a healthy blog token.
3871	* @return true\|string\|WP_Error True when forced. Otherwise 'authorize' when the user should authorize again, a `WP_Error` object on failure.
3872	*/
3873	public function refresh_user_token( $force = true ) {
3874	$user_id = get_current_user_id();
3875
3876	if ( ! $force ) {
3877	// Unlinking the owner would leave the site without one.
3878	if ( ! $user_id \|\| $this->is_site_connection() \|\| $this->get_connection_owner_id() === $user_id ) {
3879	return new WP_Error(
3880	'restore_requires_administrator',
3881	__( 'An administrator needs to restore the Jetpack connection.', 'jetpack-connection' ),
3882	array( 'status' => 403 )
3883	);
3884	}
3885
3886	// Relinking goes over the blog token, so it must work before anything is unlinked.
3887	$blog_token_health = $this->get_tokens()->validate_blog_token();
3888
3889	if ( is_wp_error( $blog_token_health ) ) {
3890	return new WP_Error(
3891	'restore_check_failed',
3892	__( 'The site connection could not be checked. Please try again shortly.', 'jetpack-connection' ),
3893	array( 'status' => 503 )
3894	);
3895	}
3896
3897	if ( true !== $blog_token_health ) {
3898	return new WP_Error(
3899	'restore_requires_administrator',
3900	__( 'The site connection is broken. An administrator needs to restore it before you can reconnect your account.', 'jetpack-connection' ),
3901	array( 'status' => 409 )
3902	);
3903	}
3904	}
3905
3906	// A forced refresh unlinks even without a stored token, as it always has.
3907	if ( $force \|\| $this->is_user_connected( $user_id ) ) {
3908	( new Tracking() )->record_user_event( 'restore_connection_refresh_user_token' );
3909
3910	// Unforced, the local token only goes once WordPress.com has unlinked it.
3911	$unlinked = $this->disconnect_user( $force ? null : $user_id, $force, $force );
3912
3913	if ( ! $force && ! $unlinked ) {
3914	return new WP_Error(
3915	'restore_unlink_failed',
3916	__( 'Your account could not be disconnected from WordPress.com. Please try again.', 'jetpack-connection' ),
3917	array( 'status' => 502 )
3918	);
3919	}
3920	}
3921
3922	return $force ? true : 'authorize';
3923	}
3924
3925	/**
3926	* Fetches a signed token.
3927	*
3928	* @deprecated 1.24.0 Use Automattic\Jetpack\Connection\Tokens->get_signed_token() instead.
3929	*
3930	* @param object $token the token.
3931	* @return WP_Error\|string a signed token
3932	*/
3933	public function get_signed_token( $token ) {
3934	_deprecated_function( __METHOD__, '1.24.0', 'Automattic\\Jetpack\\Connection\\Tokens->get_signed_token' );
3935	return $this->get_tokens()->get_signed_token( $token );
3936	}
3937
3938	/**
3939	* If the site-level connection is active, add the list of plugins using connection to the heartbeat (except Jetpack itself)
3940	*
3941	* @since 6.11.0 Add the list of Jetpack package versions to the heartbeat.
3942	* @since 8.7.4 Add the missing connection owner and XML-RPC error stats to the heartbeat.
3943	* @since 8.7.9 Add the site environment stats (WordPress/PHP versions, etc.) to the heartbeat.
3944	*
3945	* @param array $stats The Heartbeat stats array.
3946	* @return array $stats
3947	*/
3948	public function add_stats_to_heartbeat( $stats ) {
3949
3950	if ( ! $this->is_connected() ) {
3951	return $stats;
3952	}
3953
3954	$active_plugins_using_connection = Plugin_Storage::get_all();
3955	foreach ( array_keys( $active_plugins_using_connection ) as $plugin_slug ) {
3956	if ( 'jetpack' !== $plugin_slug ) {
3957	$stats_group = isset( $active_plugins_using_connection['jetpack'] ) ? 'combined-connection' : 'standalone-connection';
3958	$stats[ $stats_group ][] = $plugin_slug;
3959	}
3960	}
3961
3962	$stats['jetpack_package_versions'] = apply_filters( 'jetpack_package_versions', array() );
3963
3964	$stats['identitycrisis'] = Identity_Crisis::check_identity_crisis() ? 'yes' : 'no';
3965
3966	// Missing the connection owner?
3967	$stats['missing-owner'] = $this->is_missing_connection_owner();
3968
3969	$xmlrpc_errors = \Jetpack_Options::get_option( 'xmlrpc_errors', array() );
3970	if ( $xmlrpc_errors ) {
3971	$stats['xmlrpc-errors'] = implode( ',', array_keys( $xmlrpc_errors ) );
3972	\Jetpack_Options::delete_option( 'xmlrpc_errors' );
3973	}
3974
3975	// Site environment stats (WordPress/PHP versions, site configuration, etc.).
3976	$stats = array_merge( $stats, Heartbeat::get_environment_stats() );
3977
3978	return $stats;
3979	}
3980
3981	/**
3982	* Records a failed XML-RPC signature verification so it can be reported in the heartbeat.
3983	*
3984	* We don't want to expose a detailed error message about why a request failed
3985	* signature verification, as doing so could leak information. Instead, we track
3986	* that the error occurred via a Jetpack option and send that data back in the
3987	* heartbeat. All this does is record the error code, but it's enough to find trends.
3988	*
3989	* @since 8.7.4
3990	*
3991	* @param \WP_Error $xmlrpc_error The error produced during signature validation.
3992	* @return void
3993	*/
3994	public function track_xmlrpc_error( $xmlrpc_error ) {
3995	$code = is_wp_error( $xmlrpc_error )
3996	? $xmlrpc_error->get_error_code()
3997	: 'should-not-happen';
3998
3999	$xmlrpc_errors = \Jetpack_Options::get_option( 'xmlrpc_errors', array() );
4000	if ( isset( $xmlrpc_errors[ $code ] ) && $xmlrpc_errors[ $code ] ) {
4001	// No need to update the option if we already have this code stored.
4002	return;
4003	}
4004	$xmlrpc_errors[ $code ] = true;
4005
4006	\Jetpack_Options::update_option( 'xmlrpc_errors', $xmlrpc_errors, false );
4007	}
4008
4009	/**
4010	* Get the WPCOM or self-hosted site ID.
4011	*
4012	* @param bool $quiet Return null instead of an error.
4013	*
4014	* @return int\|WP_Error\|null
4015	*/
4016	public static function get_site_id( $quiet = false ) {
4017	$is_wpcom = ( defined( 'IS_WPCOM' ) && IS_WPCOM );
4018	$site_id = $is_wpcom ? get_current_blog_id() : \Jetpack_Options::get_option( 'id' );
4019	if ( ! $site_id ) {
4020	return $quiet
4021	? null
4022	: new \WP_Error(
4023	'unavailable_site_id',
4024	__( 'Sorry, something is wrong with your Jetpack connection.', 'jetpack-connection' ),
4025	403
4026	);
4027	}
4028	return (int) $site_id;
4029	}
4030
4031	/**
4032	* Check if Jetpack is ready for uninstall cleanup.
4033	*
4034	* @param string $current_plugin_slug The current plugin's slug.
4035	*
4036	* @return bool
4037	*/
4038	public static function is_ready_for_cleanup( $current_plugin_slug ) {
4039	$active_plugins = get_option( Plugin_Storage::ACTIVE_PLUGINS_OPTION_NAME );
4040
4041	return empty( $active_plugins ) \|\| ! is_array( $active_plugins )
4042	\|\| ( count( $active_plugins ) === 1 && array_key_exists( $current_plugin_slug, $active_plugins ) );
4043	}
4044	}
4045