jetpack / jetpack_vendor / automattic / jetpack-publicize / src / rest-api / class-base-controller.php

class-base-controller.php in Jetpack – WP Security, Backup, Speed, & Growth 16.3-beta, at jetpack_vendor/automattic/jetpack-publicize/src/rest-api/class-base-controller.php

129 lines 3.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Base Controller class.
4	*
5	* @package automattic/jetpack-publicize
6	*/
7
8	namespace Automattic\Jetpack\Publicize\REST_API;
9
10	use Automattic\Jetpack\Publicize\Connections;
11	use Automattic\Jetpack\Publicize\Publicize_Utils;
12	use WP_Error;
13	use WP_REST_Controller;
14	use WP_REST_Request;
15	use WP_REST_Response;
16
17	if ( ! defined( 'ABSPATH' ) ) {
18	exit( 0 );
19	}
20
21	/**
22	* Base controller for Publicize endpoints.
23	*/
24	abstract class Base_Controller extends WP_REST_Controller {
25
26	/**
27	* Whether to allow requests as blog.
28	*
29	* @var bool
30	*/
31	protected $allow_requests_as_blog = false;
32
33	/**
34	* Constructor.
35	*/
36	public function __construct() {
37	$this->wpcom_is_wpcom_only_endpoint = true;
38	}
39
40	/**
41	* Check if the request is authorized for the blog.
42	*
43	* @return bool
44	*/
45	protected static function is_authorized_blog_request() {
46	if ( Publicize_Utils::is_wpcom() && is_jetpack_site( get_current_blog_id() ) ) {
47
48	$jp_auth_endpoint = new \WPCOM_REST_API_V2_Endpoint_Jetpack_Auth();
49
50	return $jp_auth_endpoint->is_jetpack_authorized_for_site() === true;
51	}
52
53	return false;
54	}
55
56	/**
57	* Filters out data based on ?_fields= request parameter
58	*
59	* @param array $item Item to prepare.
60	* @param WP_REST_Request $request Full details about the request.
61	*
62	* @return WP_REST_Response filtered item
63	*/
64	public function prepare_item_for_response( $item, $request ) {
65
66	$fields = $this->get_fields_for_response( $request );
67
68	$response_data = array();
69	foreach ( $item as $field => $value ) {
70	if ( rest_is_field_included( $field, $fields ) ) {
71	$response_data[ $field ] = $value;
72	}
73	}
74
75	return rest_ensure_response( $response_data );
76	}
77
78	/**
79	* Verify that user can access Publicize data
80	*
81	* @return true\|WP_Error
82	*/
83	protected function publicize_permissions_check() {
84
85	global $publicize;
86
87	if ( ! $publicize ) {
88	return new WP_Error(
89	'publicize_not_available',
90	__( 'Sorry, Jetpack Social is not available on your site right now.', 'jetpack-publicize-pkg' ),
91	array( 'status' => rest_authorization_required_code() )
92	);
93	}
94
95	if ( $this->allow_requests_as_blog && self::is_authorized_blog_request() ) {
96	return true;
97	}
98
99	if ( $publicize->current_user_can_access_publicize_data() ) {
100	return true;
101	}
102
103	return new WP_Error(
104	'invalid_user_permission_publicize',
105	__( 'Sorry, you are not allowed to access Jetpack Social data on this site.', 'jetpack-publicize-pkg' ),
106	array( 'status' => rest_authorization_required_code() )
107	);
108	}
109
110	/**
111	* Check whether the request is allowed to manage (update/delete) a connection.
112	*
113	* @param WP_REST_Request $request Full details about the request.
114	* @return bool True if the request can manage connection, false otherwise.
115	*/
116	protected function manage_connection_permission_check( $request ) {
117	// Editors and above can manage any connection.
118	if ( current_user_can( 'edit_others_posts' ) ) {
119	return true;
120	}
121
122	$connection_id = $request->get_param( 'connection_id' );
123
124	$connection = Connections::get_by_id( $connection_id );
125
126	return Connections::user_owns_connection( $connection );
127	}
128	}
129