← All changes | json-endpoints/class.wpcom-json-api-update-user-endpoint.php +202 -0 16.2-beta → 16.3 View file →

		@@ -1,0 +1,202 @@
	1	+<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
	2	+/**
	3	+ * Update site users API endpoint.
	4	+ *
	5	+ * Endpoint: /sites/%s/users/%d/delete
	6	+ */
	7	+
	8	+if ( ! defined( 'ABSPATH' ) ) {
	9	+ exit( 0 );
	10	+}
	11	+
	12	+new WPCOM_JSON_API_Update_User_Endpoint(
	13	+ array(
	14	+ 'description' => 'Deletes or removes a user of a site.',
	15	+ 'group' => 'users',
	16	+ 'stat' => 'users:delete',
	17	+
	18	+ 'method' => 'POST',
	19	+ 'path' => '/sites/%s/users/%d/delete',
	20	+ 'path_labels' => array(
	21	+ '$site' => '(int|string) The site ID or domain.',
	22	+ '$user_ID' => '(int) The user\'s ID',
	23	+ ),
	24	+
	25	+ 'request_format' => array(
	26	+ 'reassign' => '(int) An optional id of a user to reassign posts to.',
	27	+ ),
	28	+
	29	+ 'response_format' => array(
	30	+ 'success' => '(bool) Was the deletion of user successful?',
	31	+ ),
	32	+
	33	+ 'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/82974409/users/1/delete',
	34	+ 'example_request_data' => array(
	35	+ 'headers' => array(
	36	+ 'authorization' => 'Bearer YOUR_API_TOKEN',
	37	+ ),
	38	+ ),
	39	+
	40	+ 'example_response' => '
	41	+ {
	42	+ "success": true
	43	+ }',
	44	+ )
	45	+);
	46	+
	47	+/**
	48	+ * Update site users API class.
	49	+ *
	50	+ * @phan-constructor-used-for-side-effects
	51	+ */
	52	+class WPCOM_JSON_API_Update_User_Endpoint extends WPCOM_JSON_API_Endpoint {
	53	+ /**
	54	+ * Update site users API callback.
	55	+ *
	56	+ * @param string $path API path.
	57	+ * @param int $blog_id Blog ID.
	58	+ * @param int $user_id User ID.
	59	+ */
	60	+ public function callback( $path = '', $blog_id = 0, $user_id = 0 ) {
	61	+ $blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) );
	62	+ if ( is_wp_error( $blog_id ) ) {
	63	+ return $blog_id;
	64	+ }
	65	+
	66	+ if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
	67	+ if ( (int) wpcom_get_blog_owner( $blog_id ) === (int) $user_id ) {
	68	+ return new WP_Error( 'forbidden', 'A site owner cannot be removed through this endpoint.', 403 );
	69	+ }
	70	+ }
	71	+
	72	+ if ( $this->api->ends_with( $path, '/delete' ) ) {
	73	+ return $this->delete_or_remove_user( $user_id );
	74	+ }
	75	+
	76	+ return false;
	77	+ }
	78	+
	79	+ /**
	80	+ * Checks if a user exists by checking to see if a WP_User object exists for a user ID.
	81	+ *
	82	+ * @param int $user_id User ID.
	83	+ * @return bool
	84	+ */
	85	+ public function user_exists( $user_id ) {
	86	+ $user = get_user_by( 'id', $user_id );
	87	+
	88	+ return false !== $user && is_a( $user, 'WP_User' );
	89	+ }
	90	+
	91	+ /**
	92	+ * Return the domain name of a subscription.
	93	+ *
	94	+ * @param Store_Subscription $subscription Subscription object.
	95	+ * @return string
	96	+ */
	97	+ protected function get_subscription_domain_name( $subscription ) {
	98	+ return $subscription->meta;
	99	+ }
	100	+
	101	+ /**
	102	+ * Get a list of the domains owned by the given user.
	103	+ *
	104	+ * @param int $user_id User ID.
	105	+ * @return array
	106	+ */
	107	+ protected function domain_subscriptions_for_site_owned_by_user( $user_id ) {
	108	+ $subscriptions = WPCOM_Store::get_subscriptions( get_current_blog_id(), $user_id, domains::get_domain_products() );
	109	+
	110	+ $domains = array_unique( array_map( array( $this, 'get_subscription_domain_name' ), $subscriptions ) );
	111	+
	112	+ return array_values( $domains );
	113	+ }
	114	+
	115	+ /**
	116	+ * Validates user input and then decides whether to remove or delete a user.
	117	+ *
	118	+ * @param int $user_id User ID.
	119	+ * @return array|WP_Error
	120	+ */
	121	+ public function delete_or_remove_user( $user_id ) {
	122	+ if ( 0 === (int) $user_id ) {
	123	+ return new WP_Error( 'invalid_input', 'A valid user ID must be specified.', 400 );
	124	+ }
	125	+
	126	+ if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
	127	+ $domains = $this->domain_subscriptions_for_site_owned_by_user( $user_id );
	128	+ if ( ! empty( $domains ) ) {
	129	+ $error = new WP_Error( 'user_owns_domain_subscription', implode( ', ', $domains ) );
	130	+ $error->add_data( $domains, 'additional_data' );
	131	+ return $error;
	132	+ }
	133	+
	134	+ $active_user_subscriptions = WPCOM_Store::get_user_subscriptions( $user_id, get_current_blog_id() );
	135	+ if ( ! empty( $active_user_subscriptions ) ) {
	136	+ $product_names = array_values( wp_list_pluck( $active_user_subscriptions, 'product_name' ) );
	137	+ $error = new WP_Error( 'user_has_active_subscriptions', 'User has active subscriptions' );
	138	+ $error->add_data( $product_names, 'additional_data' );
	139	+ return $error;
	140	+ }
	141	+ }
	142	+
	143	+ if ( ! $this->user_exists( $user_id ) ) {
	144	+ return new WP_Error( 'invalid_input', 'A user does not exist with that ID.', 400 );
	145	+ }
	146	+
	147	+ return is_multisite() ? $this->remove_user( $user_id ) : $this->delete_user( $user_id );
	148	+ }
	149	+
	150	+ /**
	151	+ * Removes a user from the current site.
	152	+ *
	153	+ * @param int $user_id User ID.
	154	+ * @return array|WP_Error
	155	+ */
	156	+ public function remove_user( $user_id ) {
	157	+ // Skip the check if the user is removing themselves.
	158	+ if ( ! current_user_can( 'remove_users' ) && get_current_user_id() !== (int) $user_id ) {
	159	+ return new WP_Error( 'unauthorized', 'User cannot remove users for specified site.', 403 );
	160	+ }
	161	+
	162	+ if ( ! is_user_member_of_blog( $user_id, get_current_blog_id() ) ) {
	163	+ return new WP_Error( 'invalid_input', 'User is not a member of the specified site.', 400 );
	164	+ }
	165	+
	166	+ return array(
	167	+ 'success' => remove_user_from_blog( $user_id, get_current_blog_id() ),
	168	+ );
	169	+ }
	170	+
	171	+ /**
	172	+ * Deletes a user and optionally reassigns posts to another user.
	173	+ *
	174	+ * @param int $user_id User ID.
	175	+ * @return array|WP_Error
	176	+ */
	177	+ public function delete_user( $user_id ) {
	178	+ // Skip the check if the user is deleting themselves.
	179	+ if ( ! current_user_can( 'delete_users' ) && get_current_user_id() !== (int) $user_id ) {
	180	+ return new WP_Error( 'unauthorized', 'User cannot delete users for specified site.', 403 );
	181	+ }
	182	+
	183	+ $input = (array) $this->input();
	184	+ $reassign = isset( $input['reassign'] ) ? (int) $input['reassign'] : null;
	185	+
	186	+ if ( $reassign !== null ) {
	187	+ if ( (int) $user_id === $reassign ) {
	188	+ return new WP_Error( 'invalid_input', 'Cannot reassign posts to user being deleted.', 400 );
	189	+ }
	190	+
	191	+ if ( ! $this->user_exists( $reassign ) ) {
	192	+ return new WP_Error( 'invalid_input', 'User specified in reassign argument is not a member of the specified site.', 400 );
	193	+ }
	194	+ }
	195	+
	196	+ $success = $reassign !== null ? wp_delete_user( $user_id, $reassign ) : wp_delete_user( $user_id );
	197	+
	198	+ return array(
	199	+ 'success' => $success,
	200	+ );
	201	+ }
	202	+}