# mainwp/6.2.2/includes/abilities/class-mainwp-abilities-util.php MainWP Dashboard: Self-hosted WordPress Management for Agencies, version 6.2.2. 1,330 lines. - Page: https://pluginprobe.com/plugins/mainwp/6.2.2/code/includes/abilities/class-mainwp-abilities-util.php - Raw: https://pluginprobe.com/plugins/mainwp/6.2.2/raw/includes/abilities/class-mainwp-abilities-util.php - Modified: 2026-08-05T16:01:10+00:00 Line numbers below start at 1. Link to a line or a range by appending a fragment to the page URL, for example `https://pluginprobe.com/plugins/mainwp/6.2.2/code/includes/abilities/class-mainwp-abilities-util.php#L10-L20`. ````php get_rest_valid_user(); // If REST auth has validated a user, trust that authentication. if ( ! empty( $rest_user ) ) { // REST API key is valid, check capability of the associated user. if ( ! current_user_can( 'manage_options' ) ) { return new \WP_Error( 'mainwp_permission_denied', __( 'API key user does not have sufficient permissions.', 'mainwp' ), array( 'status' => 403 ) ); } return true; } } // Fallback: session-based authentication for admin/legacy use. if ( ! is_user_logged_in() ) { return new \WP_Error( 'mainwp_permission_denied', __( 'You must be logged in to access this ability.', 'mainwp' ), array( 'status' => 401 ) ); } // Check for manage_options capability. if ( ! current_user_can( 'manage_options' ) ) { return new \WP_Error( 'mainwp_permission_denied', __( 'You do not have permission to perform this action.', 'mainwp' ), array( 'status' => 403 ) ); } return true; } /** * Check if current user can manage sites (write operations). * * Currently a wrapper over check_rest_api_permission() which already verifies * manage_options capability. This method exists as an extension point for future * granular permissions (e.g., a dedicated 'mainwp_manage_sites' capability). * * @param mixed $input The ability input (unused but required by signature). * @return true|\WP_Error True on success, WP_Error on failure. */ public static function check_manage_sites_permission( $input = null ) { $base = self::check_rest_api_permission( $input ); if ( is_wp_error( $base ) ) { return $base; } // Future: Add granular 'mainwp_manage_sites' capability check here. // For now, manage_options is already verified in check_rest_api_permission(). return true; } /** * Check if current user can access a specific site. * * This enforces per-site ACLs beyond the basic REST API permission check. * Use this for all site-specific operations (get, sync, update, plugins, themes). * * IMPORTANT: Returns true on success or WP_Error on failure. * For execute callbacks that need a boolean check, use the helper method below. * * @param int|object $site Site ID or site object. * @param mixed $input The ability input (unused but required by signature). * @return true|\WP_Error True on success, WP_Error on failure. */ public static function check_site_access( $site, $input = null ) { // First, verify basic REST API permission. $base_check = self::check_rest_api_permission( $input ); if ( is_wp_error( $base_check ) ) { return $base_check; } $site_id = is_object( $site ) ? (int) $site->id : (int) $site; // Use MainWP's existing per-site access control. if ( class_exists( 'MainWP_System' ) ) { $system = MainWP_System::instance(); if ( method_exists( $system, 'check_site_access' ) && ! $system->check_site_access( $site_id ) ) { return new \WP_Error( 'mainwp_access_denied', __( 'You do not have permission to access this site.', 'mainwp' ), array( 'status' => 403 ) ); } } /** * Filters whether the current user can access a specific site. * * Allows plugins and tests to override or extend access control. * * @since 6.0.0 * * @param bool $can_access Whether access is allowed (default true). * @param int $site_id The site ID being checked. * @param mixed|null $input The ability input, if available. */ $can_access = apply_filters( 'mainwp_check_site_access', true, $site_id, $input ); if ( ! $can_access ) { return new \WP_Error( 'mainwp_access_denied', __( 'You do not have permission to access this site.', 'mainwp' ), array( 'status' => 403 ) ); } return true; } /** * Check site access and return boolean. * * Convenience method for execute callbacks that need bool-style checks. * Use check_site_access() for permission_callback (returns WP_Error for proper error responses). * * @param int|object $site Site ID or site object. * @param mixed $input The ability input. * @return bool True if access allowed, false otherwise. */ public static function can_access_site( $site, $input = null ): bool { return true === self::check_site_access( $site, $input ); } /** * Check if site's child plugin meets minimum version requirement. * * Use this in execute callbacks before performing operations that require * child plugin communication. Returns WP_Error with 'mainwp_child_outdated' * code if the child version is too low. * * @param object $site Site object with version property. * @param string $min_version Minimum required version. Defaults to MIN_CHILD_VERSION_FOR_ABILITIES. * Pass null or omit to use the class constant. * @return true|\WP_Error True if version OK, WP_Error if outdated. */ public static function check_child_version( $site, ?string $min_version = null ) { // Use class constant as default when null or not provided. if ( null === $min_version ) { $min_version = self::MIN_CHILD_VERSION_FOR_ABILITIES; } // Validate site parameter. if ( ! is_object( $site ) || ! isset( $site->id ) ) { return new \WP_Error( 'mainwp_internal_error', __( 'Invalid site object provided.', 'mainwp' ), array( 'status' => 500 ) ); } $child_version = $site->version ?? '0.0.0'; if ( version_compare( $child_version, $min_version, '<' ) ) { return new \WP_Error( 'mainwp_child_outdated', sprintf( /* translators: %s: minimum version */ __( 'Child plugin version %s or higher required.', 'mainwp' ), $min_version ), array( 'status' => 400, 'site_id' => (int) $site->id, ) ); } return true; } /** * Check site access for batch operations. * * Filters a list of site identifiers to only those the user can access. * Returns both accessible sites and access-denied errors. * * @param array $site_ids_or_domains Array of site IDs or URLs/domains. * @param mixed $input The ability input (unused but required by signature). * @return array Array with 'allowed' (accessible sites) and 'denied' (access errors). */ public static function check_batch_site_access( array $site_ids_or_domains, $input = null ): array { // phpcs:ignore -- NOSONAR $allowed = array(); $denied = array(); $exclude_ids = ( is_array( $input ) && ! empty( $input['exclude_ids'] ) && is_array( $input['exclude_ids'] ) ) ? array_map( 'absint', $input['exclude_ids'] ) : array(); $exclude_set = $exclude_ids ? array_fill_keys( $exclude_ids, true ) : array(); foreach ( $site_ids_or_domains as $identifier ) { $site = self::resolve_site( $identifier ); if ( is_wp_error( $site ) ) { $error_data = $site->get_error_data(); $denied[] = array( 'identifier' => $identifier, 'code' => $site->get_error_code(), 'message' => $site->get_error_message(), 'status' => isset( $error_data['status'] ) ? $error_data['status'] : null, ); continue; } $access_check = self::check_site_access( $site, $input ); if ( is_wp_error( $access_check ) ) { $error_data = $access_check->get_error_data(); $denied[] = array( 'identifier' => $identifier, 'code' => $access_check->get_error_code(), 'message' => $access_check->get_error_message(), 'status' => isset( $error_data['status'] ) ? $error_data['status'] : null, ); continue; } $allowed[] = $site; } if ( ! empty( $exclude_set ) ) { $filtered = array(); foreach ( $allowed as $entry ) { $id = null; if ( is_object( $entry ) && isset( $entry->id ) ) { $id = (int) $entry->id; } elseif ( is_array( $entry ) && isset( $entry['id'] ) ) { $id = (int) $entry['id']; } elseif ( is_numeric( $entry ) ) { $id = (int) $entry; } if ( null !== $id && isset( $exclude_set[ $id ] ) ) { continue; } $filtered[] = $entry; } $allowed = array_values( $filtered ); } return array( 'allowed' => $allowed, 'denied' => $denied, ); } /** * Resolve a site identifier to a MainWP site object. * * Resolution order: * 1. If numeric → treat as MainWP site ID * 2. Otherwise → treat as URL/domain and resolve * * @param int|string $site_id_or_domain Site ID or URL/domain. * @return object|\WP_Error Site object on success, WP_Error on failure. */ public static function resolve_site( $site_id_or_domain ) { if ( ! class_exists( 'MainWP_DB' ) ) { return new \WP_Error( 'mainwp_internal_error', __( 'MainWP database class is not available.', 'mainwp' ), array( 'status' => 500 ) ); } $db = MainWP_DB::instance(); // Numeric → try as site ID. if ( is_numeric( $site_id_or_domain ) ) { $site = $db->get_website_by_id( (int) $site_id_or_domain ); if ( $site ) { return $site; } return new \WP_Error( 'mainwp_site_not_found', sprintf( /* translators: %d: site ID */ __( 'No site found with ID %d.', 'mainwp' ), (int) $site_id_or_domain ), array( 'status' => 404 ) ); } // Non-numeric → treat as URL/domain. $url = self::normalize_url( $site_id_or_domain ); $site = $db->get_websites_by_url( $url ); if ( $site && ! empty( $site ) ) { return is_array( $site ) ? $site[0] : $site; } return new \WP_Error( 'mainwp_site_not_found', sprintf( /* translators: %s: domain or URL */ __( 'No site found matching "%s".', 'mainwp' ), $site_id_or_domain ), array( 'status' => 404 ) ); } /** * Resolve a client identifier to a MainWP client object. * * Resolution order: * 1. If numeric → treat as client ID * 2. Otherwise → treat as email and resolve (exact match, returns first by ID) * * Note: Client emails are not enforced as unique in the database. * Email lookup uses exact match and returns the first matching client * ordered by client_id ASC (first created). For precise lookup, * use numeric client ID. * * @param int|string $client_id_or_email Client ID or email address. * @return object|\WP_Error Client object on success, WP_Error on failure. */ public static function resolve_client( $client_id_or_email ) { if ( ! class_exists( 'MainWP\Dashboard\MainWP_DB_Client' ) ) { return new \WP_Error( 'mainwp_internal_error', __( 'MainWP client database class is not available.', 'mainwp' ), array( 'status' => 500 ) ); } $db = MainWP_DB_Client::instance(); // Numeric → try as client ID. if ( is_numeric( $client_id_or_email ) ) { $client = $db->get_wp_client_by( 'client_id', (int) $client_id_or_email ); if ( $client ) { return $client; } return new \WP_Error( 'mainwp_client_not_found', sprintf( /* translators: %d: client ID */ __( 'No client found with ID %d.', 'mainwp' ), (int) $client_id_or_email ), array( 'status' => 404 ) ); } // Non-numeric → treat as email. // Use exact match on email with deterministic ordering. global $wpdb; $table = $wpdb->prefix . 'mainwp_wp_clients'; // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Direct query needed for client lookup by email. Table name from $wpdb->prefix is safe. $client = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$table} WHERE client_email = %s ORDER BY client_id ASC LIMIT 1", $client_id_or_email ) ); // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter if ( $client ) { return $client; } return new \WP_Error( 'mainwp_client_not_found', sprintf( /* translators: %s: email address */ __( 'No client found with email "%s".', 'mainwp' ), $client_id_or_email ), array( 'status' => 404 ) ); } /** * Resolve a tag identifier to a tag object. * * @param int $tag_id Tag ID. * @return object|\WP_Error Tag object on success, WP_Error on failure. */ public static function resolve_tag( int $tag_id ) { if ( ! class_exists( 'MainWP\Dashboard\MainWP_DB_Common' ) ) { return new \WP_Error( 'mainwp_internal_error', __( 'MainWP database class is not available.', 'mainwp' ), array( 'status' => 500 ) ); } $tag = MainWP_DB_Common::instance()->get_group_by_id( $tag_id ); if ( empty( $tag ) ) { return new \WP_Error( 'mainwp_tag_not_found', sprintf( /* translators: %d: tag ID */ __( 'No tag found with ID %d.', 'mainwp' ), $tag_id ), array( 'status' => 404 ) ); } return $tag; } /** * Map a client object or array to the standard output format. * * @param object|array $client Client object or array from database. * @param array $options Optional formatting options. * - 'include_sites' (bool): Include associated sites count. * - 'include_contacts' (bool): Include client contacts. * @return array Formatted client data. */ public static function format_client_for_output( $client, array $options = array() ): array { // phpcs:ignore -- NOSONAR - complex method. // Convert array to object for consistent access. if ( is_array( $client ) ) { $client = (object) $client; } $output = array( 'id' => (int) $client->client_id, 'name' => (string) $client->name, 'email' => isset( $client->client_email ) ? (string) $client->client_email : '', 'phone' => isset( $client->client_phone ) ? (string) $client->client_phone : '', 'address_1' => isset( $client->address_1 ) ? (string) $client->address_1 : '', 'address_2' => isset( $client->address_2 ) ? (string) $client->address_2 : '', 'city' => isset( $client->city ) ? (string) $client->city : '', 'state' => isset( $client->state ) ? (string) $client->state : '', 'zip' => isset( $client->zip ) ? (string) $client->zip : '', 'country' => isset( $client->country ) ? (string) $client->country : '', 'note' => isset( $client->note ) ? (string) $client->note : '', 'suspended' => isset( $client->suspended ) ? (int) $client->suspended : 0, 'created' => isset( $client->created ) && $client->created > 0 ? gmdate( 'c', (int) $client->created ) : null, 'facebook' => isset( $client->client_facebook ) ? (string) $client->client_facebook : '', 'twitter' => isset( $client->client_twitter ) ? (string) $client->client_twitter : '', 'instagram' => isset( $client->client_instagram ) ? (string) $client->client_instagram : '', 'linkedin' => isset( $client->client_linkedin ) ? (string) $client->client_linkedin : '', ); // Include sites count if requested. if ( ! empty( $options['include_sites'] ) ) { $sites = MainWP_DB_Client::instance()->get_websites_by_client_ids( $client->client_id ); $output['sites_count'] = is_array( $sites ) ? count( $sites ) : 0; } return $output; } /** * Map a cost tracker entry to the standard output format. * * @param object $cost Cost tracker object from database. * @return array Formatted cost data. */ public static function format_cost_for_output( $cost ): array { return array( 'id' => (int) $cost->id, 'name' => (string) $cost->name, 'type' => isset( $cost->type ) ? (string) $cost->type : '', 'price' => isset( $cost->price ) ? (float) $cost->price : 0.0, 'renewal_type' => isset( $cost->renewal_type ) ? (string) $cost->renewal_type : '', 'payment_method' => isset( $cost->payment_method ) ? (string) $cost->payment_method : '', 'product_type' => isset( $cost->product_type ) ? (string) $cost->product_type : '', 'last_renewal' => isset( $cost->last_renewal ) && $cost->last_renewal > 0 ? gmdate( 'c', (int) $cost->last_renewal ) : null, 'next_renewal' => isset( $cost->next_renewal ) && $cost->next_renewal > 0 ? gmdate( 'c', (int) $cost->next_renewal ) : null, ); } /** * Format a tag object for ability output. * * Standardizes tag data structure for consistent API responses. * * @param object $tag Tag object from MainWP_DB_Common::get_tags(). * @param array $options Optional. Formatting options: * - 'include_sites_ids' (bool): Include array of site IDs. Default true. * @return array Formatted tag data. */ public static function format_tag_for_output( object $tag, array $options = array() ): array { $defaults = array( 'include_sites_ids' => true, ); $options = array_merge( $defaults, $options ); $formatted = array( 'id' => (int) $tag->id, 'name' => (string) $tag->name, 'color' => ! empty( $tag->color ) ? (string) $tag->color : null, 'sites_count' => isset( $tag->count_sites ) ? (int) $tag->count_sites : 0, ); if ( $options['include_sites_ids'] ) { // Always include sites_ids key to match output schema. $formatted['sites_ids'] = array(); if ( isset( $tag->sites_ids ) ) { if ( is_string( $tag->sites_ids ) && ! empty( $tag->sites_ids ) ) { $formatted['sites_ids'] = array_map( 'intval', explode( ',', $tag->sites_ids ) ); } elseif ( is_array( $tag->sites_ids ) ) { $formatted['sites_ids'] = array_map( 'intval', $tag->sites_ids ); } } } return $formatted; } /** * Resolve multiple site identifiers. * * @param array $site_ids_or_domains Array of site IDs or URLs/domains. * @return array Array with 'sites' (resolved) and 'errors' (failed). */ public static function resolve_sites( array $site_ids_or_domains ): array { $sites = array(); $errors = array(); foreach ( $site_ids_or_domains as $identifier ) { $site = self::resolve_site( $identifier ); if ( is_wp_error( $site ) ) { $error_data = $site->get_error_data(); $errors[] = array( 'identifier' => $identifier, 'code' => $site->get_error_code(), 'message' => $site->get_error_message(), 'status' => isset( $error_data['status'] ) ? $error_data['status'] : null, ); } else { $sites[] = $site; } } return array( 'sites' => $sites, 'errors' => $errors, ); } /** * Resolve multiple site identifiers for batch operations. * * Convenience method that returns only successfully resolved sites, * silently skipping any that fail to resolve. Use resolve_sites() if * you need both resolved sites and error details. * * @param array $site_ids_or_domains Array of site IDs or URLs/domains. * @return array Array of site objects (successfully resolved only). */ public static function resolve_sites_batch( array $site_ids_or_domains ): array { $result = self::resolve_sites( $site_ids_or_domains ); return $result['sites']; } /** * Normalize a URL for site lookup. * * IMPORTANT: This normalization is for site resolution only. * * Handles: * - Protocol stripping (https://, http://) * - www prefix removal * - Trailing slash enforcement * * LIMITATIONS (prefer site ID for these cases): * - Port numbers (example.com:8080) - not stripped, may fail to match * - Subdirectory multisites (example.com/site1 vs example.com/site2) - may collide * - URL-encoded characters - not decoded * - IDN/punycode domains - not normalized * * RECOMMENDATION: For ambiguous cases or programmatic access, always use * site ID instead of URL/domain. * * @param string $url URL to normalize. * @return string Normalized URL. */ public static function normalize_url( string $url ): string { // Remove protocol and www prefix. $url = preg_replace( '#^https?://(www\.)?#i', '', $url ); // Ensure trailing slash. $url = trailingslashit( $url ); return $url; } /** * Normalize a site URL for storage and duplicate detection. * * Unlike normalize_url() which strips protocols for lookup, this method * preserves the URL scheme while normalizing for consistent storage: * - Lowercases the host component (domain names are case-insensitive per RFC 4343) * - Ensures trailing slash on the path * - Preserves the scheme (http/https) * * Use this before storing site URLs or checking for duplicates to ensure * URLs like "HTTPS://EXAMPLE.COM" and "https://example.com/" are treated * as equivalent. * * @param string $url URL to normalize. * @return string Normalized URL with lowercase host and trailing slash. */ public static function normalize_site_url( string $url ): string { $parsed = wp_parse_url( $url ); if ( empty( $parsed ) || empty( $parsed['host'] ) ) { // Invalid URL, return as-is with trailing slash. return trailingslashit( $url ); } // Build normalized URL. $scheme = isset( $parsed['scheme'] ) ? strtolower( $parsed['scheme'] ) : 'https'; $host = strtolower( $parsed['host'] ); $port = isset( $parsed['port'] ) ? ':' . $parsed['port'] : ''; $path = isset( $parsed['path'] ) ? $parsed['path'] : '/'; // Ensure path has trailing slash (but not double slashes). $path = trailingslashit( $path ); return $scheme . '://' . $host . $port . $path; } /** * Create a permission callback for site-specific abilities. * * The Abilities API passes $input to the permission_callback, but our * check_site_access() method expects a resolved site object. This wrapper * resolves the site from input first, then performs the access check. * * IMPORTANT: Use this for any ability that operates on a single site * identified by 'site_id_or_domain' in the input schema. * * @param string $input_key The input key containing the site identifier (default: 'site_id_or_domain'). * @return callable Permission callback closure. */ public static function make_site_permission_callback( string $input_key = 'site_id_or_domain' ): callable { return function ( $input ) use ( $input_key ) { // First check basic REST API permission. $base_check = self::check_rest_api_permission( $input ); if ( is_wp_error( $base_check ) ) { return $base_check; } // Resolve the site from input. $identifier = $input[ $input_key ] ?? null; if ( null === $identifier ) { return new \WP_Error( 'mainwp_invalid_input', __( 'Site identifier is required.', 'mainwp' ), array( 'status' => 400 ) ); } $site = self::resolve_site( $identifier ); if ( is_wp_error( $site ) ) { return $site; } // Check per-site access. return self::check_site_access( $site, $input ); }; } /** * Map a site object to the standard output format. * * @param object $site Site object from database. * @param bool $full_details Whether to include full site details (default: false). * @param bool $include_stats Whether to include site statistics (default: false). * @return array Formatted site data. */ public static function format_site_for_output( $site, bool $full_details = false, bool $include_stats = false ): array { $output = array( 'id' => (int) $site->id, 'url' => (string) $site->url, 'name' => MainWP_Utility::remove_http_prefix( (string) $site->name, true ), 'status' => self::get_site_status( $site ), 'client_id' => isset( $site->client_id ) && $site->client_id > 0 ? (int) $site->client_id : null, ); if ( $full_details ) { // Add extended site details for single-site retrieval. $output['admin_username'] = $site->adminname ?? ''; // Get site_info from DB option (stored as JSON). // Pass full $site object to allow property check before DB query. $site_info_raw = MainWP_DB::instance()->get_website_option( $site, 'site_info' ); $site_info = ! empty( $site_info_raw ) ? json_decode( $site_info_raw, true ) : array(); // Ensure $site_info is an array (json_decode returns null on invalid JSON). if ( ! is_array( $site_info ) ) { $site_info = array(); } $output['wp_version'] = isset( $site_info['wpversion'] ) ? $site_info['wpversion'] : ''; $output['php_version'] = isset( $site_info['phpversion'] ) ? $site_info['phpversion'] : ''; $output['child_version'] = $site->version ?? ''; // Format last_sync as ISO 8601 timestamp. $output['last_sync'] = ! empty( $site->dtsSync ) ? gmdate( 'c', (int) $site->dtsSync ) : null; $output['notes'] = $site->note ?? ''; } // Include site statistics if requested. if ( $include_stats ) { $output['stats'] = self::get_site_stats( $site ); } return $output; } /** * Get site statistics for include_stats option. * * @param object $site Site object from database. * @return array Site statistics array. */ public static function get_site_stats( $site ): array { // Count plugin updates. $plugin_updates = ! empty( $site->plugin_upgrades ) ? json_decode( $site->plugin_upgrades, true ) : array(); $plugin_count = is_array( $plugin_updates ) ? count( $plugin_updates ) : 0; // Count theme updates. $theme_updates = ! empty( $site->theme_upgrades ) ? json_decode( $site->theme_upgrades, true ) : array(); $theme_count = is_array( $theme_updates ) ? count( $theme_updates ) : 0; // Check for WordPress core update. // Pass full $site object to allow property check before DB query. $wp_upgrades = MainWP_DB::instance()->get_website_option( $site, 'wp_upgrades' ); $wp_upgrades = ! empty( $wp_upgrades ) ? json_decode( $wp_upgrades, true ) : array(); $wp_update_available = is_array( $wp_upgrades ) && ! empty( $wp_upgrades ); // Get health score if available. The health_value column is a sortable // composite (score - critical * 100) that goes negative when critical // issues exist; recompute the real 0-100 score from the stored Site // Health issue counts like the REST and UI surfaces do. $health_score = null; // json_format=true returns a guaranteed array (scalars coerced to array()). $health_status = MainWP_DB::instance()->get_website_option( $site, 'health_site_status', array(), true ); if ( ! empty( $health_status ) ) { $hstatus = MainWP_Utility::get_site_health( $health_status ); $health_score = (int) $hstatus['val']; } return array( 'plugin_updates' => $plugin_count, 'theme_updates' => $theme_count, 'wp_update_available' => $wp_update_available, 'health_score' => $health_score, ); } /** * Get site connection status string. * * @param object $site Site object. * @return string Status string: 'connected', 'disconnected', or 'suspended'. */ public static function get_site_status( $site ): string { // Check if site is suspended. if ( isset( $site->suspended ) && 1 === (int) $site->suspended ) { return 'suspended'; } // Check offline status. if ( isset( $site->offline_check_result ) && -1 === (int) $site->offline_check_result ) { return 'disconnected'; } // Check for sync errors. if ( isset( $site->sync_errors ) && ! empty( $site->sync_errors ) ) { return 'disconnected'; } return 'connected'; } /** * Queue a batch sync operation for background processing. * * Used when >200 sites need to be synced to avoid request timeouts. * Stores job data in a transient and schedules a cron event for processing. * * @param array $sites Array of site objects to sync. * @return string|\WP_Error Job ID for status polling, or WP_Error on failure. */ public static function queue_batch_sync( array $sites ) { // Generate unique job ID. $job_id = 'sync_' . wp_generate_uuid4(); // Extract site IDs from site objects. $site_ids = array_map( function ( $site ) { return (int) $site->id; }, $sites ); // Store job data in transient (expires in 24 hours). // Structure aligns with REST v2 job status endpoint expectations. // Status values: 'queued' -> 'processing' -> 'completed' | 'failed'. $job_data = array( 'job_type' => 'sync', // Distinguishes from 'update' jobs. 'sites' => $site_ids, 'status' => 'queued', // queued | processing | completed | failed. 'created' => time(), 'started' => null, 'completed' => null, 'synced' => array(), // Successfully synced sites. 'errors' => array(), // Failed syncs array. 'progress' => 0, // 0-100 percentage. 'total' => count( $site_ids ), // Total sites to process. 'processed' => 0, // Sites processed so far. ); set_transient( 'mainwp_sync_job_' . $job_id, $job_data, DAY_IN_SECONDS ); // Verify transient was stored successfully. $stored = get_transient( 'mainwp_sync_job_' . $job_id ); if ( empty( $stored ) || ! is_array( $stored ) ) { return new \WP_Error( 'mainwp_queue_failed', __( 'Failed to store sync job data. Please try again.', 'mainwp' ), array( 'status' => 500 ) ); } // Only schedule if no matching event already exists. if ( ! wp_next_scheduled( 'mainwp_process_sync_job', array( $job_id ) ) ) { wp_schedule_single_event( time() + 60, 'mainwp_process_sync_job', array( $job_id ) ); } return $job_id; } /** * Get batch sync job status. * * @param string $job_id Job ID to check. * @return array|null Job data array or null if not found. */ public static function get_batch_sync_status( string $job_id ): ?array { $job_data = get_transient( 'mainwp_sync_job_' . $job_id ); return is_array( $job_data ) ? $job_data : null; } /** * Queue a batch update operation for background processing. * * Used when >200 sites need updates to avoid request timeouts. * Stores job data in a transient and schedules a cron event for processing. * * @param array $sites Array of site objects to update. * @param array $update_params Update parameters with keys: types (array), specific_items (array). * @return string|\WP_Error Job ID for status polling, or WP_Error on failure. */ public static function queue_batch_updates( array $sites, array $update_params ) { // Generate unique job ID. $job_id = 'update_' . wp_generate_uuid4(); // Extract site IDs from site objects. $site_ids = array_map( function ( $site ) { return (int) $site->id; }, $sites ); // Normalize and validate types parameter. $allowed_types = array( 'core', 'plugins', 'themes', 'translations' ); $types = isset( $update_params['types'] ) && is_array( $update_params['types'] ) ? array_values( array_intersect( $update_params['types'], $allowed_types ) ) : array(); // Normalize specific_items to array of strings. $specific_items = array(); if ( isset( $update_params['specific_items'] ) && is_array( $update_params['specific_items'] ) ) { foreach ( $update_params['specific_items'] as $item ) { if ( is_string( $item ) && '' !== $item ) { $specific_items[] = $item; } } } // Store job data in transient (expires in 24 hours). // Structure aligns with REST v2 job status endpoint expectations. // Status values: 'queued' -> 'processing' -> 'completed' | 'failed'. $job_data = array( 'job_type' => 'update', // Distinguishes from 'sync' jobs. 'sites' => $site_ids, 'types' => $types, 'specific_items' => $specific_items, 'status' => 'queued', // queued | processing | completed | failed. 'created' => time(), 'started' => null, 'completed' => null, 'updated' => array(), // Successful updates array. 'errors' => array(), // Failed updates array. 'progress' => 0, // 0-100 percentage. 'total' => count( $site_ids ), // Total sites to process. 'processed' => 0, // Sites processed so far. ); set_transient( 'mainwp_update_job_' . $job_id, $job_data, DAY_IN_SECONDS ); // Verify transient was stored successfully. $stored = get_transient( 'mainwp_update_job_' . $job_id ); if ( empty( $stored ) || ! is_array( $stored ) ) { return new \WP_Error( 'mainwp_queue_failed', __( 'Failed to store update job data. Please try again.', 'mainwp' ), array( 'status' => 500 ) ); } // Only schedule if no matching event already exists. if ( ! wp_next_scheduled( 'mainwp_process_update_job', array( $job_id ) ) ) { wp_schedule_single_event( time() + 60, 'mainwp_process_update_job', array( $job_id ) ); } return $job_id; } /** * Get batch update job status. * * @param string $job_id Job ID to check. * @return array|null Job data array or null if not found. */ public static function get_batch_update_status( string $job_id ): ?array { $job_data = get_transient( 'mainwp_update_job_' . $job_id ); return is_array( $job_data ) ? $job_data : null; } /** * Queue a batch site operation for background processing. * * Used when >200 sites need to be processed for batch operations like * reconnect, disconnect, check, or suspend. Stores job data in a transient * and schedules a cron event for processing. * * @param string $operation_type Operation type: 'reconnect', 'disconnect', 'check', 'suspend'. * @param array $sites Array of site objects to process. * @return string|\WP_Error Job ID for status polling, or WP_Error on failure. */ public static function queue_batch_operation( string $operation_type, array $sites ) { // Validate operation type. $allowed_operations = array( 'reconnect', 'disconnect', 'check', 'suspend' ); if ( ! in_array( $operation_type, $allowed_operations, true ) ) { return new \WP_Error( 'mainwp_invalid_operation', __( 'Invalid batch operation type.', 'mainwp' ), array( 'status' => 400 ) ); } // Generate unique job ID. $job_id = $operation_type . '_' . wp_generate_uuid4(); // Extract site IDs from site objects. $site_ids = array_map( function ( $site ) { return (int) $site->id; }, $sites ); // Store job data in transient (expires in 24 hours). // Status values: 'queued' -> 'processing' -> 'completed' | 'failed'. $job_data = array( 'job_type' => $operation_type, 'sites' => $site_ids, 'status' => 'queued', 'created' => time(), 'started' => null, 'completed' => null, 'successful' => array(), // Successfully processed sites. 'errors' => array(), // Failed operations array. 'progress' => 0, // 0-100 percentage. 'total' => count( $site_ids ), 'processed' => 0, // Sites processed so far. ); set_transient( 'mainwp_batch_job_' . $job_id, $job_data, DAY_IN_SECONDS ); // Verify transient was stored successfully. $stored = get_transient( 'mainwp_batch_job_' . $job_id ); if ( empty( $stored ) || ! is_array( $stored ) ) { return new \WP_Error( 'mainwp_queue_failed', __( 'Failed to store batch job data. Please try again.', 'mainwp' ), array( 'status' => 500 ) ); } // Schedule cron event for processing. // Only schedule if no matching event already exists. if ( ! wp_next_scheduled( 'mainwp_process_batch_job', array( $job_id ) ) ) { wp_schedule_single_event( time() + 60, 'mainwp_process_batch_job', array( $job_id ) ); } return $job_id; } /** * Get batch operation job status. * * @param string $job_id Job ID to check. * @return array|null Job data array or null if not found. */ public static function get_batch_operation_status( string $job_id ): ?array { $job_data = get_transient( 'mainwp_batch_job_' . $job_id ); return is_array( $job_data ) ? $job_data : null; } /** * Normalize ability input to ensure it's always an array. * * Workaround for Abilities API REST controller bug where missing or empty * input is passed as null instead of an empty array. The REST controller * fails JSON Schema validation before schema defaults can be applied. * * Use this at the start of execute callbacks as defensive coding: * * ```php * public static function execute_list_sites( $input ) { * $input = MainWP_Abilities_Util::normalize_input( $input, [ * 'page' => 1, * 'per_page' => 20, * ] ); * // ... continue with normalized input * } * ``` * * NOTE: This workaround only helps if the ability passes REST validation. * The bug causes validation to fail BEFORE the execute callback is called. * This helper is provided for defensive coding once the upstream bug is fixed. * * @see .mwpdev/debugging/abilities-api-input-investigation.md * @see .mwpdev/docs/abilities-api-docs/known-issues.md * * @param mixed $input Raw input from ability execution (may be null, array, or object). * @param array $defaults Default values from input schema properties. * @return array Normalized input array with defaults applied. */ public static function normalize_input( $input, array $defaults = array() ): array { // Convert objects to arrays. if ( is_object( $input ) ) { $input = (array) $input; } // If input is null, empty, or not an array, start with empty array. if ( ! is_array( $input ) ) { $input = array(); } // Merge with defaults (input values take precedence over defaults). return array_merge( $defaults, $input ); } /** * Get default values from an input schema. * * Extracts default values from a JSON Schema's properties definitions. * Useful when you need to programmatically obtain defaults without hardcoding. * * Example: * ```php * $schema = self::get_list_sites_input_schema(); * $defaults = MainWP_Abilities_Util::get_schema_defaults( $schema ); * $input = MainWP_Abilities_Util::normalize_input( $input, $defaults ); * ``` * * @param array $schema JSON Schema with 'properties' containing 'default' values. * @return array Associative array of property names to their default values. */ public static function get_schema_defaults( array $schema ): array { $defaults = array(); if ( ! isset( $schema['properties'] ) || ! is_array( $schema['properties'] ) ) { return $defaults; } foreach ( $schema['properties'] as $property_name => $property_schema ) { if ( isset( $property_schema['default'] ) ) { $defaults[ $property_name ] = $property_schema['default']; } } return $defaults; } /** * Format plugin data for ability output. * * Standardizes plugin data structure for activate/deactivate/delete operations. * Handles missing fields gracefully as plugins may not have all metadata. * * @param array|object $plugin Plugin data with keys: slug, Name/name, Version/version, active, update. * @return array Standardized plugin structure: { slug, name, version, active, has_update, update_version }. */ public static function format_plugin_for_output( $plugin ): array { // phpcs:ignore -- NOSONAR -complexity. if ( is_object( $plugin ) ) { $plugin = (array) $plugin; } if ( ! is_array( $plugin ) ) { $plugin = array(); } $slug = isset( $plugin['slug'] ) ? sanitize_text_field( $plugin['slug'] ) : ''; // Support both capitalized (Name) and lowercase (name) keys. $name = ''; if ( isset( $plugin['Name'] ) ) { $name = sanitize_text_field( $plugin['Name'] ); } elseif ( isset( $plugin['name'] ) ) { $name = sanitize_text_field( $plugin['name'] ); } else { $name = $slug; } // Support both capitalized (Version) and lowercase (version) keys. $version = ''; if ( isset( $plugin['Version'] ) ) { $version = sanitize_text_field( $plugin['Version'] ); } elseif ( isset( $plugin['version'] ) ) { $version = sanitize_text_field( $plugin['version'] ); } $active = isset( $plugin['active'] ) ? (bool) $plugin['active'] : false; // Determine if update is available: either a non-empty array in 'update' key, // or a root-level 'new_version' key indicates an update is available. $has_update_array = isset( $plugin['update'] ) && is_array( $plugin['update'] ) && ! empty( $plugin['update'] ); $has_root_version = isset( $plugin['new_version'] ); $has_update = $has_update_array || $has_root_version; // Extract update_version from various possible structures. // Guard nested access with is_array() to avoid warnings when 'update' is boolean/scalar. $update_version = null; if ( $has_update ) { if ( $has_update_array && isset( $plugin['update']['new_version'] ) ) { $update_version = sanitize_text_field( $plugin['update']['new_version'] ); } elseif ( $has_root_version ) { $update_version = sanitize_text_field( $plugin['new_version'] ); } } return array( 'slug' => $slug, 'name' => $name, 'version' => $version, 'active' => $active, 'has_update' => $has_update, 'update_version' => $update_version, ); } /** * Format theme data for ability output. * * Standardizes theme data structure for activate/delete operations. * Handles missing fields gracefully as themes may not have all metadata. * * @param array|object $theme Theme data with keys: slug, Name/name, Version/version, active, update. * @return array Standardized theme structure: { slug, name, version, active, has_update, update_version }. */ public static function format_theme_for_output( $theme ): array { // phpcs:ignore -- NOSONAR -complexity. if ( is_object( $theme ) ) { $theme = (array) $theme; } if ( ! is_array( $theme ) ) { $theme = array(); } $slug = isset( $theme['slug'] ) ? sanitize_text_field( $theme['slug'] ) : ''; // Support both capitalized (Name) and lowercase (name) keys. $name = ''; if ( isset( $theme['Name'] ) ) { $name = sanitize_text_field( $theme['Name'] ); } elseif ( isset( $theme['name'] ) ) { $name = sanitize_text_field( $theme['name'] ); } else { $name = $slug; } // Support both capitalized (Version) and lowercase (version) keys. $version = ''; if ( isset( $theme['Version'] ) ) { $version = sanitize_text_field( $theme['Version'] ); } elseif ( isset( $theme['version'] ) ) { $version = sanitize_text_field( $theme['version'] ); } $active = isset( $theme['active'] ) ? (bool) $theme['active'] : false; // Determine if update is available: either a non-empty array in 'update' key, // or a root-level 'new_version' key indicates an update is available. $has_update_array = isset( $theme['update'] ) && is_array( $theme['update'] ) && ! empty( $theme['update'] ); $has_root_version = isset( $theme['new_version'] ); $has_update = $has_update_array || $has_root_version; // Extract update_version from various possible structures. // Guard nested access with is_array() to avoid warnings when 'update' is boolean/scalar. $update_version = null; if ( $has_update ) { if ( $has_update_array && isset( $theme['update']['new_version'] ) ) { $update_version = sanitize_text_field( $theme['update']['new_version'] ); } elseif ( $has_root_version ) { $update_version = sanitize_text_field( $theme['new_version'] ); } } return array( 'slug' => $slug, 'name' => $name, 'version' => $version, 'active' => $active, 'has_update' => $has_update, 'update_version' => $update_version, ); } /** * Check if a child site response indicates success. * * Handles both the new format ({ success: true }) and legacy format ({ status: "SUCCESS" }) * returned by MainWP Child plugin for plugin/theme actions. * * @since 5.4 * * @param mixed $result The response from MainWP_Connect::fetch_url_authed(). * @return bool True if the response indicates success, false otherwise. */ public static function is_child_response_success( $result ): bool { if ( ! is_array( $result ) ) { return false; } // New format: { success: true }. if ( isset( $result['success'] ) && $result['success'] ) { return true; } // Legacy format: { status: "SUCCESS" }. if ( isset( $result['status'] ) && 'SUCCESS' === $result['status'] ) { return true; } return false; } } ````