← All changes | _inc/class.jetpack-provision.php +308 -0 16.2-beta → 16.3 View file →

		@@ -1,0 +1,308 @@
	1	+<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
	2	+/**
	3	+ * Class file for provisioning Jetpack.
	4	+ *
	5	+ * @package automattic/jetpack
	6	+ */
	7	+
	8	+use Automattic\Jetpack\Connection\Client;
	9	+use Automattic\Jetpack\Connection\Secrets;
	10	+use Automattic\Jetpack\Connection\Tokens;
	11	+use Automattic\Jetpack\Identity_Crisis;
	12	+use Automattic\Jetpack\Roles;
	13	+use Automattic\Jetpack\Sync\Actions;
	14	+
	15	+/**
	16	+ * Jetpack_Provision class.
	17	+ */
	18	+class Jetpack_Provision {
	19	+
	20	+ /**
	21	+ * Responsible for checking pre-conditions, registering site, and returning an array of details
	22	+ * that can be used to provision a plan for the site.
	23	+ *
	24	+ * @param array $named_args The array of arguments.
	25	+ *
	26	+ * @return WP_Error|array
	27	+ */
	28	+ public static function register_and_build_request_body( $named_args ) {
	29	+ $url_args = array(
	30	+ 'home_url' => 'WP_HOME',
	31	+ 'site_url' => 'WP_SITEURL',
	32	+ );
	33	+
	34	+ foreach ( $url_args as $url_arg => $constant_name ) {
	35	+ if ( isset( $named_args[ $url_arg ] ) ) {
	36	+ add_filter(
	37	+ $url_arg,
	38	+ function () use ( $url_arg, $named_args ) {
	39	+ return $named_args[ $url_arg ];
	40	+ },
	41	+ 11
	42	+ );
	43	+ }
	44	+ }
	45	+
	46	+ // If Jetpack is currently connected, and is not in Safe Mode already, kick off a sync of the current
	47	+ // functions/callables so that we can test if this site is in IDC.
	48	+ if ( Jetpack::is_connection_ready() && ! Identity_Crisis::validate_sync_error_idc_option() && Actions::sync_allowed() ) {
	49	+ Actions::do_full_sync( array( 'functions' => true ), 'provision' );
	50	+ Actions::$sender->do_full_sync();
	51	+ }
	52	+
	53	+ if ( Identity_Crisis::validate_sync_error_idc_option() ) {
	54	+ return new WP_Error(
	55	+ 'site_in_safe_mode',
	56	+ __( 'Cannot provision a plan while in safe mode. See: https://jetpack.com/support/safe-mode/', 'jetpack' )
	57	+ );
	58	+ }
	59	+
	60	+ if ( ! Jetpack::connection()->is_connected() || ( isset( $named_args['force_register'] ) && (int) $named_args['force_register'] ) ) {
	61	+ // This code mostly copied from Jetpack::admin_page_load.
	62	+ Jetpack::maybe_set_version_option();
	63	+ Jetpack::connection()->add_register_request_param( 'from', 'jetpack-start' );
	64	+ $registered = Jetpack::connection()->try_registration();
	65	+ if ( is_wp_error( $registered ) ) {
	66	+ return $registered;
	67	+ } elseif ( ! $registered ) {
	68	+ return new WP_Error( 'registration_error', __( 'There was an unspecified error registering the site', 'jetpack' ) );
	69	+ }
	70	+ }
	71	+
	72	+ // If the user isn't specified, but we have a current master user, then set that to current user.
	73	+ $master_user_id = Jetpack_Options::get_option( 'master_user' );
	74	+ if ( ! get_current_user_id() && $master_user_id ) {
	75	+ wp_set_current_user( $master_user_id );
	76	+ }
	77	+
	78	+ $site_icon = get_site_icon_url();
	79	+
	80	+ $auto_enable_sso = ( ! Jetpack::connection()->has_connected_owner() || Jetpack::is_module_active( 'sso' ) );
	81	+
	82	+ /** This filter is documented in class.jetpack-cli.php */
	83	+ if ( apply_filters( 'jetpack_start_enable_sso', $auto_enable_sso ) ) {
	84	+ $redirect_uri = add_query_arg(
	85	+ array(
	86	+ 'action' => 'jetpack-sso',
	87	+ 'redirect_to' => rawurlencode( admin_url() ),
	88	+ ),
	89	+ wp_login_url() // TODO: come back to Jetpack dashboard?
	90	+ );
	91	+ } else {
	92	+ $redirect_uri = admin_url();
	93	+ }
	94	+
	95	+ $request_body = array(
	96	+ 'jp_version' => JETPACK__VERSION,
	97	+ 'redirect_uri' => $redirect_uri,
	98	+ );
	99	+
	100	+ if ( $site_icon ) {
	101	+ $request_body['site_icon'] = $site_icon;
	102	+ }
	103	+
	104	+ if ( get_current_user_id() ) {
	105	+ $user = wp_get_current_user();
	106	+
	107	+ // Role.
	108	+ $roles = new Roles();
	109	+ $role = $roles->translate_current_user_to_role();
	110	+ $signed_role = Jetpack::connection()->sign_role( $role );
	111	+
	112	+ $secrets = ( new Secrets() )->generate( 'authorize' );
	113	+
	114	+ // Jetpack auth stuff.
	115	+ $request_body['scope'] = $signed_role;
	116	+ $request_body['secret'] = $secrets['secret_1'];
	117	+
	118	+ // User stuff.
	119	+ $request_body['user_id'] = $user->ID;
	120	+ $request_body['user_email'] = $user->user_email;
	121	+ $request_body['user_login'] = $user->user_login;
	122	+ }
	123	+
	124	+ // Optional additional params.
	125	+ if ( isset( $named_args['wpcom_user_id'] ) && ! empty( $named_args['wpcom_user_id'] ) ) {
	126	+ $request_body['wpcom_user_id'] = $named_args['wpcom_user_id'];
	127	+ }
	128	+
	129	+ // Override email of selected user.
	130	+ if ( isset( $named_args['wpcom_user_email'] ) && ! empty( $named_args['wpcom_user_email'] ) ) {
	131	+ $request_body['user_email'] = $named_args['wpcom_user_email'];
	132	+ }
	133	+
	134	+ if ( isset( $named_args['plan'] ) && ! empty( $named_args['plan'] ) ) {
	135	+ $request_body['plan'] = $named_args['plan'];
	136	+ }
	137	+
	138	+ if ( isset( $named_args['force_connect'] ) && ! empty( $named_args['force_connect'] ) ) {
	139	+ $request_body['force_connect'] = (int) $named_args['force_connect'];
	140	+ }
	141	+
	142	+ return $request_body;
	143	+ }
	144	+
	145	+ /**
	146	+ * Given an access token and an array of arguments, will provision a plan for this site.
	147	+ *
	148	+ * @param string $access_token The access token from the partner.
	149	+ * @param array $named_args The arguments used for registering the site and then provisioning a plan.
	150	+ *
	151	+ * @return WP_Error|array
	152	+ */
	153	+ public static function partner_provision( $access_token, $named_args ) {
	154	+ // First, verify the token.
	155	+ $verify_response = self::verify_token( $access_token );
	156	+
	157	+ if ( is_wp_error( $verify_response ) ) {
	158	+ return $verify_response;
	159	+ }
	160	+
	161	+ $request_body = self::register_and_build_request_body( $named_args );
	162	+ if ( is_wp_error( $request_body ) ) {
	163	+ return $request_body;
	164	+ }
	165	+
	166	+ $request = array(
	167	+ 'headers' => array(
	168	+ 'Authorization' => "Bearer $access_token",
	169	+ 'Host' => 'public-api.wordpress.com',
	170	+ ),
	171	+ 'timeout' => 60,
	172	+ 'method' => 'POST',
	173	+ 'body' => wp_json_encode( $request_body, JSON_UNESCAPED_SLASHES ),
	174	+ );
	175	+
	176	+ $blog_id = Jetpack_Options::get_option( 'id' );
	177	+ $url = esc_url_raw(
	178	+ sprintf(
	179	+ '%s/rest/v1.3/jpphp/%d/partner-provision',
	180	+ self::get_api_host(),
	181	+ $blog_id
	182	+ )
	183	+ );
	184	+ if ( ! empty( $named_args['partner_tracking_id'] ) ) {
	185	+ $url = esc_url_raw( add_query_arg( 'partner_tracking_id', $named_args['partner_tracking_id'], $url ) );
	186	+ }
	187	+
	188	+ // Add calypso env if set.
	189	+ $calypso_env = ( new \Automattic\Jetpack\Status\Host() )->get_calypso_env();
	190	+ if ( ! empty( $calypso_env ) ) {
	191	+ $url = add_query_arg( array( 'calypso_env' => $calypso_env ), $url );
	192	+ }
	193	+
	194	+ // @phan-suppress-next-line PhanAccessMethodInternal -- Phan is correct, but the usage is intentional.
	195	+ $result = Client::_wp_remote_request( $url, $request );
	196	+
	197	+ if ( is_wp_error( $result ) ) {
	198	+ return $result;
	199	+ }
	200	+
	201	+ $response_code = wp_remote_retrieve_response_code( $result );
	202	+ $body_json = json_decode( wp_remote_retrieve_body( $result ) );
	203	+
	204	+ if ( 200 !== $response_code ) {
	205	+ if ( isset( $body_json->error ) ) {
	206	+ return new WP_Error( $body_json->error, $body_json->message );
	207	+ } else {
	208	+ return new WP_Error(
	209	+ 'server_error',
	210	+ /* translators: %s is an HTTP status code retured from an API request. Ex. – 400 */
	211	+ sprintf( __( 'Request failed with code %s', 'jetpack' ), $response_code )
	212	+ );
	213	+ }
	214	+ }
	215	+
	216	+ if ( isset( $body_json->access_token ) && is_user_logged_in() ) {
	217	+ // Check if this matches the existing token before replacing.
	218	+ $existing_token = ( new Tokens() )->get_access_token( get_current_user_id() );
	219	+ if ( empty( $existing_token ) || $existing_token->secret !== $body_json->access_token ) {
	220	+ self::authorize_user( get_current_user_id(), $body_json->access_token );
	221	+ }
	222	+ }
	223	+
	224	+ return $body_json;
	225	+ }
	226	+
	227	+ /**
	228	+ * Authorizes the passed user.
	229	+ *
	230	+ * @param int $user_id User ID.
	231	+ * @param string $access_token Access token.
	232	+ */
	233	+ private static function authorize_user( $user_id, $access_token ) {
	234	+ // authorize user and enable SSO.
	235	+ ( new Tokens() )->update_user_token( $user_id, sprintf( '%s.%d', $access_token, $user_id ), true );
	236	+
	237	+ /**
	238	+ * Auto-enable SSO module for new Jetpack Start connections
	239	+ *
	240	+ * @since 5.0.0
	241	+ *
	242	+ * @param bool $enable_sso Whether to enable the SSO module. Default to true.
	243	+ */
	244	+ $other_modules = apply_filters( 'jetpack_start_enable_sso', true )
	245	+ ? array( 'sso' )
	246	+ : array();
	247	+
	248	+ $active_modules = Jetpack_Options::get_option( 'active_modules' );
	249	+
	250	+ if ( $active_modules ) {
	251	+ Jetpack::delete_active_modules();
	252	+ Jetpack::activate_default_modules( 999, 1, array_merge( $active_modules, $other_modules ), false );
	253	+ } else {
	254	+ Jetpack::activate_default_modules( false, false, $other_modules, false );
	255	+ }
	256	+ }
	257	+
	258	+ /**
	259	+ * Verifies the access token being used.
	260	+ *
	261	+ * @param string $access_token Access token.
	262	+ *
	263	+ * @return array|bool|WP_Error
	264	+ */
	265	+ private static function verify_token( $access_token ) {
	266	+ $request = array(
	267	+ 'headers' => array(
	268	+ 'Authorization' => 'Bearer ' . $access_token,
	269	+ 'Host' => 'public-api.wordpress.com',
	270	+ ),
	271	+ 'timeout' => 10,
	272	+ 'method' => 'POST',
	273	+ 'body' => '',
	274	+ );
	275	+
	276	+ $url = sprintf( '%s/rest/v1.3/jpphp/partner-keys/verify', self::get_api_host() );
	277	+ // @phan-suppress-next-line PhanAccessMethodInternal -- Phan is correct, but the usage is intentional.
	278	+ $result = Client::_wp_remote_request( $url, $request );
	279	+
	280	+ if ( is_wp_error( $result ) ) {
	281	+ return $result;
	282	+ }
	283	+
	284	+ $response_code = wp_remote_retrieve_response_code( $result );
	285	+ $body_json = json_decode( wp_remote_retrieve_body( $result ) );
	286	+
	287	+ if ( 200 !== $response_code ) {
	288	+ if ( isset( $body_json->error ) ) {
	289	+ return new WP_Error( $body_json->error, $body_json->message );
	290	+ } else {
	291	+ /* translators: %s is HTTP response code (e.g. 500, 401, etc). */
	292	+ return new WP_Error( 'server_error', sprintf( __( 'Request failed with code %s', 'jetpack' ), $response_code ) );
	293	+ }
	294	+ }
	295	+
	296	+ return true;
	297	+ }
	298	+
	299	+ /**
	300	+ * Gets the API host as set via env.
	301	+ *
	302	+ * @return string API URL.
	303	+ */
	304	+ private static function get_api_host() {
	305	+ $env_api_host = getenv( 'JETPACK_START_API_HOST', true );
	306	+ return $env_api_host ? 'https://' . $env_api_host : JETPACK__WPCOM_JSON_API_BASE;
	307	+ }
	308	+}