PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 16.3-beta
Jetpack – WP Security, Backup, Speed, & Growth v16.3-beta
16.3-beta 16.3-a.5 16.3-a.7 16.3-a.3 16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 All 507 releases
← All changes | jetpack_vendor/automattic/jetpack-search/src/class-rest-controller.php +349 -22 12.7.3 → 16.3-beta View file →
@@ -14,10 +14,15 @@
14 14 use Automattic\Jetpack\My_Jetpack\Products\Search_Stats as Search_Product_Stats;
15 15 use Jetpack_Options;
16 16 use WP_Error;
17 17 use WP_REST_Request;
18 +use WP_REST_Response;
18 19 use WP_REST_Server;
19 20
21 +if ( ! defined( 'ABSPATH' ) ) {
22 + exit( 0 );
23 +}
24 +
20 25 /**
21 26 * Registers the REST routes for Search.
22 27 */
23 28 class REST_Controller {
@@ -63,8 +68,21 @@
63 68 $this->plan = $plan === null ? new Plan() : $plan;
64 69 }
65 70
66 71 /**
72 + * Registers the REST routes on the `rest_api_init` hook.
73 + *
74 + * Instantiated here, rather than eagerly, so the controller class only loads
75 + * on requests that reach `rest_api_init`. Static so the callback can be
76 + * unregistered.
77 + *
78 + * @access public
79 + */
80 + public static function register() {
81 + ( new self() )->register_rest_routes();
82 + }
83 +
84 + /**
67 85 * Registers the REST routes for Search.
68 86 *
69 87 * @access public
70 88 * @static
@@ -126,8 +144,29 @@
126 144 'callback' => array( $this, 'product_pricing' ),
127 145 'permission_callback' => 'is_user_logged_in',
128 146 )
129 147 );
148 + // "Restore default" for the singleton-template CPTs. Lives on
149 + // jetpack/v4 (not /wp/v2/<rest_base>) so wpcom-origin can proxy it
150 + // on Simple sites — the Jetpack-registered CPT controller isn't on
151 + // the wpcom REST surface. The allowed `<post_type>` slugs are
152 + // enforced inside the handler (single source of truth) rather than
153 + // duplicated into a route-level validate_callback.
154 + register_rest_route(
155 + static::$namespace,
156 + '/search/templates/(?P<post_type>[a-z0-9_-]+)',
157 + array(
158 + 'methods' => WP_REST_Server::DELETABLE,
159 + 'callback' => array( $this, 'reset_singleton_template' ),
160 + 'permission_callback' => array( $this, 'require_admin_privilege_callback' ),
161 + 'args' => array(
162 + 'post_type' => array(
163 + 'required' => true,
164 + 'sanitize_callback' => 'sanitize_key',
165 + ),
166 + ),
167 + )
168 + );
130 169 }
131 170
132 171 /**
133 172 * Routes only existing in Jetpack.
@@ -143,8 +182,24 @@
143 182 )
144 183 );
145 184 register_rest_route(
146 185 static::$namespace,
186 + '/search/plan/activate-free',
187 + array(
188 + 'methods' => WP_REST_Server::EDITABLE,
189 + 'callback' => array( $this, 'activate_free_plan' ),
190 + 'permission_callback' => array( $this, 'require_admin_privilege_callback' ),
191 + 'args' => array(
192 + 'source' => array(
193 + 'type' => 'string',
194 + 'required' => false,
195 + 'sanitize_callback' => 'sanitize_key',
196 + ),
197 + ),
198 + )
199 + );
200 + register_rest_route(
201 + static::$namespace,
147 202 '/search/plan/deactivate',
148 203 array(
149 204 'methods' => WP_REST_Server::EDITABLE,
150 205 'callback' => array( $this, 'deactivate_plan' ),
@@ -237,18 +292,44 @@
237 292 * @param WP_REST_Request $request - REST request.
238 293 */
239 294 public function update_settings( $request ) {
240 295 $request_body = $request->get_json_params();
296 + if ( ! is_array( $request_body ) ) {
297 + $request_body = array();
298 + }
241 299
242 - $module_active = isset( $request_body['module_active'] ) ? (bool) $request_body['module_active'] : null;
243 - $instant_search_enabled = isset( $request_body['instant_search_enabled'] ) ? (bool) $request_body['instant_search_enabled'] : null;
300 + $module_active = isset( $request_body['module_active'] ) ? (bool) $request_body['module_active'] : null;
301 + $instant_search_enabled = isset( $request_body['instant_search_enabled'] ) ? (bool) $request_body['instant_search_enabled'] : null;
302 + $swap_classic_to_inline_search = isset( $request_body['swap_classic_to_inline_search'] ) ? (bool) $request_body['swap_classic_to_inline_search'] : null;
303 + $experience = isset( $request_body['experience'] ) && is_string( $request_body['experience'] )
304 + ? sanitize_text_field( $request_body['experience'] )
305 + : null;
306 + $reader_chat = array_key_exists( 'reader_chat', $request_body ) ? (bool) $request_body['reader_chat'] : null;
307 + // rest_sanitize_boolean(), not (bool): this value now drives the paid-plan
308 + // gate below, and a plain (bool) cast reads a JSON `"false"` string as true.
309 + $ai_answers_enabled = isset( $request_body['ai_answers_enabled'] ) ? rest_sanitize_boolean( $request_body['ai_answers_enabled'] ) : null;
244 310
245 - $error = $this->validate_search_settings( $module_active, $instant_search_enabled );
311 + $search_suggestions_enabled = isset( $request_body['search_suggestions_enabled'] ) ? (bool) $request_body['search_suggestions_enabled'] : null;
246 312
313 + $override_woocommerce_search_template = isset( $request_body['override_woocommerce_search_template'] ) ? (bool) $request_body['override_woocommerce_search_template'] : null;
314 +
315 + $error = $this->validate_search_settings( $module_active, $instant_search_enabled, $swap_classic_to_inline_search, $experience, $reader_chat, $ai_answers_enabled, $search_suggestions_enabled, $override_woocommerce_search_template );
316 +
247 317 if ( is_wp_error( $error ) ) {
248 318 return $error;
249 319 }
250 320
321 + // If an experience value was provided, delegate to Module_Control::update_experience(),
322 + // which encapsulates the storage shape (off → module deactivate, inline → delete option,
323 + // embedded/overlay → write affirmative value) and keeps the legacy booleans in lockstep.
324 + if ( $experience !== null ) {
325 + $result = $this->search_module->update_experience( $experience );
326 + if ( is_wp_error( $result ) ) {
327 + return $result;
328 + }
329 + return rest_ensure_response( $this->get_settings() );
330 + }
331 +
251 332 // Enabling instant search should enable the module too.
252 333 if ( true === $instant_search_enabled && true !== $module_active ) {
253 334 $module_active = true;
254 335 }
@@ -267,8 +348,26 @@
267 348 $errors['instant_search_enabled'] = $instant_search_enabled_updated;
268 349 }
269 350 }
270 351
352 + if ( $swap_classic_to_inline_search !== null ) {
353 + $this->search_module->update_swap_classic_to_inline_search( $swap_classic_to_inline_search );
354 + }
355 +
356 + if ( $reader_chat !== null ) {
357 + update_option( 'reader_chat', $reader_chat );
358 + }
359 +
360 + if ( $ai_answers_enabled !== null ) {
361 + update_option( 'jetpack_search_ai_answers_enabled', $ai_answers_enabled );
362 + }
363 + if ( $search_suggestions_enabled !== null ) {
364 + update_option( 'jetpack_search_suggestions_enabled', $search_suggestions_enabled );
365 + }
366 + if ( $override_woocommerce_search_template !== null ) {
367 + update_option( 'jetpack_search_override_woocommerce_search_template', $override_woocommerce_search_template );
368 + }
369 +
271 370 if ( ! empty( $errors ) ) {
272 371 return new WP_Error(
273 372 'some_updated',
274 373 sprintf(
@@ -288,12 +387,98 @@
288 387
289 388 /**
290 389 * Validate $module_active and $instant_search_enabled. Returns an WP_Error instance if invalid.
291 390 *
292 - * @param boolean $module_active - Module status.
293 - * @param boolean $instant_search_enabled - Instant Search status.
391 + * @param boolean $module_active - Module status.
392 + * @param boolean $instant_search_enabled - Instant Search status.
393 + * @param boolean $swap_classic_to_inline_search - New inline search status.
394 + * @param string|null $experience - Experience value.
395 + * @param bool|null $reader_chat - Reader Chat status.
396 + * @param bool|null $ai_answers_enabled - Whether Jetpack Search AI answers is enabled.
397 + * @param bool|null $search_suggestions_enabled - New search suggestions status.
398 + * @param bool|null $override_woocommerce_search_template - New WooCommerce search-template override status.
294 399 */
295 - protected function validate_search_settings( $module_active, $instant_search_enabled ) {
400 + protected function validate_search_settings( $module_active, $instant_search_enabled, $swap_classic_to_inline_search, $experience = null, $reader_chat = null, $ai_answers_enabled = null, $search_suggestions_enabled = null, $override_woocommerce_search_template = null ) {
401 + if ( $reader_chat !== null && ! $this->is_reader_chat_setting_registered() ) {
402 + return new WP_Error(
403 + 'rest_invalid_arguments',
404 + esc_html__( 'The arguments passed in are invalid.', 'jetpack-search-pkg' ),
405 + array( 'status' => 400 )
406 + );
407 + }
408 +
409 + // AI Answers cannot be turned on while the site-wide Jetpack AI switch is
410 + // off. Turning it off stays allowed, so a saved choice can still be cleared.
411 + if ( true === $ai_answers_enabled && ! AI_Answers::is_master_enabled() ) {
412 + return new WP_Error(
413 + 'rest_invalid_arguments',
414 + esc_html__( 'AI Answers cannot be enabled while Jetpack AI is turned off for this site.', 'jetpack-search-pkg' ),
415 + array( 'status' => 400 )
416 + );
417 + }
418 +
419 + // AI Answers runs inside Instant Search, so enabling it requires Instant
420 + // Search on — either already, or turned on by this same request.
421 + if ( true === $ai_answers_enabled && true !== $instant_search_enabled && ! $this->search_module->is_instant_search_enabled() ) {
422 + return new WP_Error(
423 + 'rest_invalid_arguments',
424 + esc_html__( 'AI Answers cannot be enabled while Instant Search is off.', 'jetpack-search-pkg' ),
425 + array( 'status' => 400 )
426 + );
427 + }
428 +
429 + // `experience` is the canonical source of truth and writes the legacy booleans in lockstep.
430 + // Reject requests that mix it with any other settings field so callers don't silently
431 + // lose those fields — the `experience` branch in update_settings() early-returns and
432 + // would otherwise drop them.
433 + if ( $experience !== null ) {
434 + if ( $module_active !== null || $instant_search_enabled !== null || $swap_classic_to_inline_search !== null || $reader_chat !== null || $ai_answers_enabled !== null || $search_suggestions_enabled !== null || $override_woocommerce_search_template !== null ) {
435 + return new WP_Error(
436 + 'rest_invalid_arguments',
437 + esc_html__( 'The `experience` field cannot be combined with `module_active`, `instant_search_enabled`, `swap_classic_to_inline_search`, `reader_chat`, `ai_answers_enabled`, `search_suggestions_enabled`, or `override_woocommerce_search_template`.', 'jetpack-search-pkg' ),
438 + array( 'status' => 400 )
439 + );
440 + }
441 + return true;
442 + }
443 +
444 + if ( true === $reader_chat && ( ! $this->plan->supports_search() || $this->plan->is_free_plan() ) ) {
445 + return new WP_Error(
446 + 'rest_forbidden',
447 + esc_html__( 'Site Chat requires a paid Jetpack Search plan.', 'jetpack-search-pkg' ),
448 + array( 'status' => 403 )
449 + );
450 + }
451 +
452 + // AI Answers requires a paid Search plan; reject the write outright.
453 + if ( true === $ai_answers_enabled && ! Search_Blocks::supports_paid_search() ) {
454 + return new WP_Error(
455 + 'rest_forbidden',
456 + esc_html__( 'AI Answers requires a paid Jetpack Search plan.', 'jetpack-search-pkg' ),
457 + array( 'status' => 403 )
458 + );
459 + }
460 +
461 + if (
462 + $module_active === null &&
463 + $instant_search_enabled === null &&
464 + ( $swap_classic_to_inline_search !== null || $reader_chat !== null )
465 + ) {
466 + // Allow updating auxiliary settings without updating/validating the module settings.
467 + return true;
468 + }
469 + if ( $module_active === null && $instant_search_enabled === null && $swap_classic_to_inline_search === null && $ai_answers_enabled !== null ) {
470 + // allow updating 'ai_answers_enabled' without updating/validating other settings.
471 + return true;
472 + }
473 + if ( $module_active === null && $instant_search_enabled === null && $swap_classic_to_inline_search === null && $search_suggestions_enabled !== null ) {
474 + // allow updating 'search_suggestions_enabled' without updating/validating other settings.
475 + return true;
476 + }
477 + if ( $module_active === null && $instant_search_enabled === null && $swap_classic_to_inline_search === null && $override_woocommerce_search_template !== null ) {
478 + // allow updating 'override_woocommerce_search_template' without updating/validating other settings.
479 + return true;
480 + }
296 481 if ( ( true === $instant_search_enabled && false === $module_active ) || ( $module_active === null && $instant_search_enabled === null ) ) {
297 482 return new WP_Error(
298 483 'rest_invalid_arguments',
299 484 esc_html__( 'The arguments passed in are invalid.', 'jetpack-search-pkg' ),
@@ -302,18 +487,41 @@
302 487 }
303 488 return true;
304 489 }
305 490
491 + /**
492 + * GET `jetpack/v4/search/settings`
493 + */
494 + public function get_settings() {
495 + $settings = array(
496 + 'module_active' => $this->search_module->is_active(),
497 + 'instant_search_enabled' => $this->search_module->is_instant_search_enabled(),
498 + 'swap_classic_to_inline_search' => $this->search_module->is_swap_classic_to_inline_search(),
499 + 'experience' => $this->search_module->get_experience(),
500 + 'ai_answers_enabled' => AI_Answers::is_enabled(),
501 + 'ai_answers_saved' => AI_Answers::is_saved_on(),
502 + 'ai_master_enabled' => AI_Answers::is_master_enabled(),
503 + 'search_suggestions_enabled' => (bool) get_option( 'jetpack_search_suggestions_enabled', false ),
504 + 'override_woocommerce_search_template' => Search_Blocks::woocommerce_search_template_override_enabled(),
505 + );
506 +
507 + if ( $this->is_reader_chat_setting_registered() ) {
508 + $settings['reader_chat'] = (bool) get_option( 'reader_chat', false );
509 + }
510 +
511 + return rest_ensure_response( $settings );
512 + }
513 +
306 514 /**
307 - * GET `jetpack/v4/search/settings`
515 + * Check whether Reader Chat is available through REST settings in this request.
516 + *
517 + * Reader Chat registers `reader_chat` only for proxied rollout contexts, so the
518 + * Search dashboard should expose the toggle only when that setting exists.
519 + *
520 + * @return bool True when reader_chat is registered.
308 521 */
309 - public function get_settings() {
310 - return rest_ensure_response(
311 - array(
312 - 'module_active' => $this->search_module->is_active(),
313 - 'instant_search_enabled' => $this->search_module->is_instant_search_enabled(),
314 - )
315 - );
522 + protected function is_reader_chat_setting_registered() {
523 + return array_key_exists( 'reader_chat', get_registered_settings() );
316 524 }
317 525
318 526 /**
319 527 * Proxy the request to WPCOM and return the response.
@@ -355,8 +563,9 @@
355 563 $default_options = array(
356 564 'search_plan_info' => null,
357 565 'enable_search' => true,
358 566 'enable_instant_search' => true,
567 + 'search_experience' => null,
359 568 'auto_config_search' => true,
360 569 );
361 570 $payload = $request->get_json_params();
362 571 $payload = wp_parse_args( $payload, $default_options );
@@ -368,9 +577,8 @@
368 577 }
369 578
370 579 // Enable search module by default, unless `enable_search` is explicitly set to boolean `false`.
371 580 if ( false !== $payload['enable_search'] ) {
372 - // Eligibility is checked in `activate` function.
373 581 $ret = $this->search_module->activate();
374 582 if ( is_wp_error( $ret ) ) {
375 583 return $ret;
376 584 }
@@ -375,19 +583,45 @@
375 583 return $ret;
376 584 }
377 585 }
378 586
379 - // Enable instant search by default, unless `enable_instant_search` is explicitly set to boolean `false`.
380 - if ( false !== $payload['enable_instant_search'] ) {
381 - // Eligibility is checked in `enable_instant_search` function.
382 - $ret = $this->search_module->enable_instant_search();
587 + if ( $payload['search_experience'] !== null ) {
588 + // Canonical path. Restrict to activate-able experiences — `off`
589 + // belongs on `/plan/deactivate`, and a non-string payload would
590 + // blow up `update_experience(string $experience)`.
591 + $valid_experiences = array(
592 + Module_Control::EXPERIENCE_OVERLAY,
593 + Module_Control::EXPERIENCE_INLINE,
594 + Module_Control::EXPERIENCE_EMBEDDED,
595 + );
596 + if ( ! is_string( $payload['search_experience'] )
597 + || ! in_array( $payload['search_experience'], $valid_experiences, true )
598 + ) {
599 + return new WP_Error(
600 + 'invalid_experience',
601 + __( 'Invalid experience value.', 'jetpack-search-pkg' ),
602 + array( 'status' => 400 )
603 + );
604 + }
605 + $ret = $this->search_module->update_experience( sanitize_text_field( $payload['search_experience'] ) );
383 606 if ( is_wp_error( $ret ) ) {
384 607 return $ret;
385 608 }
386 609 }
387 610
388 - // Automatically configure necessary settings for instant search, unless `auto_config_search` is explicitly set to boolean `false`.
389 - if ( false !== $payload['auto_config_search'] ) {
611 + if ( $payload['search_experience'] === null && false !== $payload['enable_instant_search'] ) {
612 + // Legacy path: old WPCOM callers send `enable_instant_search`
613 + // instead of `search_experience`. Gated on the canonical value
614 + // being absent so it doesn't overwrite a non-overlay experience
615 + // the caller just set.
616 + // Error handling intentionally skipped — this is the legacy fallback.
617 + $ret = $this->search_module->enable_instant_search();
618 + }
619 +
620 + // `auto_config_search` wires up Overlay sidebar widgets — only meaningful
621 + // when Overlay is the resulting experience. For Inline / Embedded, the
622 + // caller would otherwise get widget side effects they didn't ask for.
623 + if ( false !== $payload['auto_config_search'] && $this->search_module->is_instant_search_enabled() ) {
390 624 Instant_Search::instance( $this->get_blog_id() )->auto_config_search();
391 625 }
392 626
393 627 return rest_ensure_response(
@@ -397,8 +631,44 @@
397 631 );
398 632 }
399 633
400 634 /**
635 + * Grant the free Search product to this site instead of sending the user to a $0 checkout.
636 + *
637 + * POST `jetpack/v4/search/plan/activate-free`
638 + *
639 + * @since 8.3.0
640 + *
641 + * @param WP_REST_Request $request - REST request.
642 + * @return WP_REST_Response|WP_Error Errors carry `checkout_fallback`, which the dashboard
643 + * branches on to decide whether to fall back to checkout.
644 + */
645 + public function activate_free_plan( $request ) {
646 + /*
647 + * Another plugin can load an older My Jetpack before this package's copy registers, and
648 + * that copy has no such method. Degrade to the checkout the dashboard still has.
649 + */
650 + if ( ! method_exists( Search_Product::class, 'activate_free_product' ) ) {
651 + return new WP_Error(
652 + 'jetpack_search_free_activation_unavailable',
653 + __( 'Jetpack Search Free could not be activated for this site.', 'jetpack-search-pkg' ),
654 + array(
655 + 'status' => 501,
656 + 'checkout_fallback' => true,
657 + )
658 + );
659 + }
660 +
661 + $source = $request->get_param( 'source' );
662 + $result = Search_Product::activate_free_product( $source ? $source : 'search-dashboard' );
663 + if ( is_wp_error( $result ) ) {
664 + return $result;
665 + }
666 +
667 + return rest_ensure_response( $result );
668 + }
669 +
670 + /**
401 671 * Deactivate plan: turn off search module and instant search.
402 672 * If the plan is still valid then the function would simply deactivate the search module.
403 673 * Typically called from WPCOM.
404 674 *
@@ -424,8 +694,65 @@
424 694 );
425 695 }
426 696
427 697 /**
698 + * Force-delete the {@see Singleton_Template_Cpt} customization for the
699 + * requested post type, backing the dashboard's "Restore default" link.
700 + * `before_delete_post` in the base class clears the option pointer +
701 + * per-request cache so the next render falls back to the bundled template.
702 + *
703 + * DELETE `jetpack/v4/search/templates/<post_type>`
704 + *
705 + * @param WP_REST_Request $request - REST request.
706 + * @return WP_REST_Response|WP_Error
707 + */
708 + public function reset_singleton_template( $request ) {
709 + $cpt_class = $this->resolve_singleton_template_class( $request['post_type'] );
710 + if ( ! $cpt_class ) {
711 + return new WP_Error(
712 + 'jetpack_search_template_unknown',
713 + __( 'Unknown search template.', 'jetpack-search-pkg' ),
714 + array( 'status' => 404 )
715 + );
716 + }
717 + if ( ! $cpt_class::is_customized() ) {
718 + return new WP_Error(
719 + 'jetpack_search_template_not_customized',
720 + __( 'No customization to restore.', 'jetpack-search-pkg' ),
721 + array( 'status' => 404 )
722 + );
723 + }
724 + $post_id = $cpt_class::get_post_id();
725 + if ( ! wp_delete_post( $post_id, true ) ) {
726 + return new WP_Error(
727 + 'jetpack_search_template_reset_failed',
728 + __( 'Failed to restore the default template.', 'jetpack-search-pkg' ),
729 + array( 'status' => 500 )
730 + );
731 + }
732 + return rest_ensure_response( array( 'deleted' => true ) );
733 + }
734 +
735 + /**
736 + * Map a CPT slug to its concrete `Singleton_Template_Cpt` subclass.
737 + * Returns null when the slug isn't one of the registered singleton-template
738 + * CPTs — the route only sanitizes the slug (via `sanitize_key`), so this
739 + * lookup is the primary "is this a known CPT?" filter, not a backup check.
740 + *
741 + * @param string $post_type Post type slug from the request.
742 + * @return class-string<Singleton_Template_Cpt>|null
743 + */
744 + protected function resolve_singleton_template_class( $post_type ) {
745 + $map = array(
746 + Overlay_Template::POST_TYPE => Overlay_Template::class,
747 + Product_Overlay_Template::POST_TYPE => Product_Overlay_Template::class,
748 + Search_Template::POST_TYPE => Search_Template::class,
749 + Product_Search_Template::POST_TYPE => Product_Search_Template::class,
750 + );
751 + return $map[ $post_type ] ?? null;
752 + }
753 +
754 + /**
428 755 * Pricing for record count of the site
429 756 */
430 757 public function product_pricing() {
431 758 $tier_pricing = Search_Product::get_pricing_for_ui();
@@ -454,9 +781,9 @@
454 781 }
455 782
456 783 return new WP_Error(
457 784 isset( $body['error'] ) ? 'remote-error-' . $body['error'] : 'remote-error',
458 - isset( $body['message'] ) ? $body['message'] : 'unknown remote error',
785 + $body['message'] ?? 'unknown remote error',
459 786 array( 'status' => $status_code )
460 787 );
461 788 }
462 789