class.wpcom-json-api-update-user-endpoint.php — Jetpack – WP Security, Backup, Speed, & Growth 9.3.5

jetpack / json-endpoints / class.wpcom-json-api-update-user-endpoint.php

jetpack / json-endpoints Last commit date

class.wpcom-json-api-update-user-endpoint.php

166 lines

1	<?php
2
3	new WPCOM_JSON_API_Update_User_Endpoint( array(
4	'description' => 'Deletes or removes a user of a site.',
5	'group' => 'users',
6	'stat' => 'users:delete',
7
8	'method' => 'POST',
9	'path' => '/sites/%s/users/%d/delete',
10	'path_labels' => array(
11	'$site' => '(int\|string) The site ID or domain.',
12	'$user_ID' => '(int) The user\'s ID'
13	),
14
15	'request_format' => array(
16	'reassign' => '(int) An optional id of a user to reassign posts to.',
17	),
18
19	'response_format' => array(
20	'success' => '(bool) Was the deletion of user successful?',
21	),
22
23	'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/82974409/users/1/delete',
24	'example_request_data' => array(
25	'headers' => array(
26	'authorization' => 'Bearer YOUR_API_TOKEN'
27	),
28	),
29
30	'example_response' => '
31	{
32	"success": true
33	}'
34	) );
35
36	class WPCOM_JSON_API_Update_User_Endpoint extends WPCOM_JSON_API_Endpoint {
37
38	function callback( $path = '', $blog_id = 0, $user_id = 0 ) {
39	$blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) );
40	if ( is_wp_error( $blog_id ) ) {
41	return $blog_id;
42	}
43
44	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
45	if ( wpcom_get_blog_owner( $blog_id ) == $user_id ) {
46	return new WP_Error( 'forbidden', 'A site owner can not be removed through this endpoint.', 403 );
47	}
48	}
49
50	if ( $this->api->ends_with( $path, '/delete' ) ) {
51	return $this->delete_or_remove_user( $user_id );
52	}
53
54	return false;
55	}
56
57	/**
58	* Checks if a user exists by checking to see if a WP_User object exists for a user ID.
59	* @param int $user_id
60	* @return bool
61	*/
62	function user_exists( $user_id ) {
63	$user = get_user_by( 'id', $user_id );
64
65	return false != $user && is_a( $user, 'WP_User' );
66	}
67
68	/**
69	* Return the domain name of a subscription
70	*
71	* @param Store_Subscription $subscription
72	* @return string
73	*/
74	protected function get_subscription_domain_name( $subscription ) {
75	return $subscription->meta;
76	}
77
78	/**
79	* Get a list of the domains owned by the given user.
80	*
81	* @param int $user_id
82	* @return array
83	*/
84	protected function domain_subscriptions_for_site_owned_by_user( $user_id ) {
85	$subscriptions = WPCOM_Store::get_subscriptions( get_current_blog_id(), $user_id, domains::get_domain_products() );
86
87	$domains = array_unique( array_map( array( $this, 'get_subscription_domain_name' ), $subscriptions ) );
88
89	return $domains;
90	}
91
92	/**
93	* Validates user input and then decides whether to remove or delete a user.
94	* @param int $user_id
95	* @return array\|WP_Error
96	*/
97	function delete_or_remove_user( $user_id ) {
98	if ( 0 == $user_id ) {
99	return new WP_Error( 'invalid_input', 'A valid user ID must be specified.', 400 );
100	}
101
102	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
103	$domains = $this->domain_subscriptions_for_site_owned_by_user( $user_id );
104	if ( ! empty( $domains ) ) {
105	return new WP_Error( 'user_owns_domain_subscription', join( ', ', $domains ) );
106	}
107	}
108
109	if ( get_current_user_id() == $user_id ) {
110	return new WP_Error( 'invalid_input', 'User can not remove or delete self through this endpoint.', 400 );
111	}
112
113	if ( ! $this->user_exists( $user_id ) ) {
114	return new WP_Error( 'invalid_input', 'A user does not exist with that ID.', 400 );
115	}
116
117	return is_multisite() ? $this->remove_user( $user_id ) : $this->delete_user( $user_id );
118	}
119
120	/**
121	* Removes a user from the current site.
122	* @param int $user_id
123	* @return array\|WP_Error
124	*/
125	function remove_user( $user_id ) {
126	if ( ! current_user_can( 'remove_users' ) ) {
127	return new WP_Error( 'unauthorized', 'User cannot remove users for specified site.', 403 );
128	}
129
130	if ( ! is_user_member_of_blog( $user_id, get_current_blog_id() ) ) {
131	return new WP_Error( 'invalid_input', 'User is not a member of the specified site.', 400 );
132	}
133
134	return array(
135	'success' => remove_user_from_blog( $user_id, get_current_blog_id() )
136	);
137	}
138
139	/**
140	* Deletes a user and optionally reassigns posts to another user.
141	* @param int $user_id
142	* @return array\|WP_Error
143	*/
144	function delete_user( $user_id ) {
145	if ( ! current_user_can( 'delete_users' ) ) {
146	return new WP_Error( 'unauthorized', 'User cannot delete users for specified site.', 403 );
147	}
148
149	$input = (array) $this->input();
150
151	if ( isset( $input['reassign'] ) ) {
152	if ( $user_id == $input['reassign'] ) {
153	return new WP_Error( 'invalid_input', 'Can not reassign posts to user being deleted.', 400 );
154	}
155
156	if ( ! $this->user_exists( $input['reassign'] ) ) {
157	return new WP_Error( 'invalid_input', 'User specified in reassign argument is not a member of the specified site.', 400 );
158	}
159	}
160
161	return array(
162	'success' => wp_delete_user( $user_id, (int) $input['reassign'] ),
163	);
164	}
165	}
166