Authentication
1 week ago
Consent
1 week ago
Endpoints
1 week ago
Helpers
1 week ago
PKCE
1 week ago
Storage
1 week ago
Bootstrap.php
1 week ago
Constants.php
1 week ago
Module.php
1 week ago
Bootstrap.php
85 lines
| 1 | <?php |
| 2 | /** |
| 3 | * OAuth bootstrap. |
| 4 | * |
| 5 | * @package PrestoPlayer |
| 6 | * @subpackage Services\OAuth |
| 7 | */ |
| 8 | |
| 9 | namespace PrestoPlayer\Services\OAuth; |
| 10 | |
| 11 | use PrestoPlayer\Contracts\Service; |
| 12 | use PrestoPlayer\Services\Abilities\Module as AbilitiesModule; |
| 13 | use PrestoPlayer\Services\OAuth\Authentication\BearerAuthenticator; |
| 14 | use PrestoPlayer\Services\OAuth\Authentication\ChallengeResponder; |
| 15 | use PrestoPlayer\Services\OAuth\Endpoints\AuthorizeEndpoint; |
| 16 | use PrestoPlayer\Services\OAuth\Endpoints\DiscoveryEndpoint; |
| 17 | use PrestoPlayer\Services\OAuth\Endpoints\RegisterEndpoint; |
| 18 | use PrestoPlayer\Services\OAuth\Endpoints\RevokeEndpoint; |
| 19 | use PrestoPlayer\Services\OAuth\Endpoints\TokenEndpoint; |
| 20 | use PrestoPlayer\Services\OAuth\Storage\ClientRepository; |
| 21 | use PrestoPlayer\Services\OAuth\Storage\CodeRepository; |
| 22 | use PrestoPlayer\Services\OAuth\Storage\TokenRepository; |
| 23 | |
| 24 | /** |
| 25 | * Registers the OAuth REST surface (DCR / authorize / token / revoke + |
| 26 | * discovery + bearer auth) only when AI access is switched on. |
| 27 | * |
| 28 | * Keeping this behind a single always-registered service lets config/app.php |
| 29 | * stay a flat registration list: it lists Bootstrap, and Bootstrap decides at |
| 30 | * runtime whether the gated endpoints load. Leaving the endpoints registered |
| 31 | * while the feature is off would expose an open `/oauth/register` endpoint |
| 32 | * hitting tables that don't exist yet. OAuth\Module stays registered regardless |
| 33 | * so it can install the schema on the enable transition. |
| 34 | */ |
| 35 | class Bootstrap implements Service { |
| 36 | |
| 37 | /** |
| 38 | * Register the gated OAuth services when AI access is enabled. |
| 39 | * |
| 40 | * @return void |
| 41 | */ |
| 42 | public function register() { |
| 43 | if ( ! $this->isEnabled() ) { |
| 44 | return; |
| 45 | } |
| 46 | |
| 47 | foreach ( $this->gatedServices() as $service ) { |
| 48 | $service->register(); |
| 49 | } |
| 50 | } |
| 51 | |
| 52 | /** |
| 53 | * Whether the AI-access (MCP) toggle is on. |
| 54 | * |
| 55 | * @return bool |
| 56 | */ |
| 57 | protected function isEnabled() { |
| 58 | $option = get_option( AbilitiesModule::OPTION_KEY, array() ); |
| 59 | return is_array( $option ) && ! empty( $option['enabled'] ); |
| 60 | } |
| 61 | |
| 62 | /** |
| 63 | * Build the OAuth services gated behind the toggle, sharing one instance of |
| 64 | * each storage repository across the endpoints that need it (the same wiring |
| 65 | * the DI container did when these were listed individually). |
| 66 | * |
| 67 | * @return Service[] |
| 68 | */ |
| 69 | protected function gatedServices() { |
| 70 | $clients = new ClientRepository(); |
| 71 | $codes = new CodeRepository(); |
| 72 | $tokens = new TokenRepository(); |
| 73 | |
| 74 | return array( |
| 75 | new RegisterEndpoint( $clients ), |
| 76 | new AuthorizeEndpoint(), |
| 77 | new TokenEndpoint( $clients, $codes, $tokens ), |
| 78 | new RevokeEndpoint( $clients, $tokens ), |
| 79 | new DiscoveryEndpoint(), |
| 80 | new BearerAuthenticator(), |
| 81 | new ChallengeResponder(), |
| 82 | ); |
| 83 | } |
| 84 | } |
| 85 |