| 1 |
<?php |
| 2 |
|
| 3 |
namespace ReviewX\Rest\Controllers; |
| 4 |
|
| 5 |
\defined("ABSPATH") || exit; |
| 6 |
use ReviewX\Services\ReachabilityService; |
| 7 |
use ReviewX\Utilities\Helper; |
| 8 |
use ReviewX\WPDrill\Response; |
| 9 |
class ReachabilityController |
| 10 |
{ |
| 11 |
protected ReachabilityService $reachabilityService; |
| 12 |
public function __construct() |
| 13 |
{ |
| 14 |
$this->reachabilityService = new ReachabilityService(); |
| 15 |
} |
| 16 |
/** |
| 17 |
* Public, unauthenticated: the SaaS calls this to confirm it can reach us. |
| 18 |
* |
| 19 |
* It cannot reuse /ping — that route sits behind AuthSaasMiddleware, which |
| 20 |
* needs a site UID and secret, and neither exists before the site connects. |
| 21 |
* The single-use challenge is what authenticates this request. |
| 22 |
*/ |
| 23 |
public function challenge($request) : Response |
| 24 |
{ |
| 25 |
$challenge = (string) $request->get_param('challenge'); |
| 26 |
if ($challenge === '' || !$this->reachabilityService->matchesChallenge($challenge)) { |
| 27 |
return Helper::rvxApi()->fails(\__('Unknown challenge', 'reviewx'), Response::HTTP_FORBIDDEN); |
| 28 |
} |
| 29 |
return Helper::rvxApi(['challenge' => $challenge, 'wp_version' => \get_bloginfo('version'), 'plugin_version' => REVIEWX_VERSION])->success(\__('Site reachable', 'reviewx'), Response::HTTP_OK); |
| 30 |
} |
| 31 |
/** |
| 32 |
* Run the check when the onboarding screen loads. |
| 33 |
* |
| 34 |
* Public, like the sibling /login and /register routes: the admin UI calls |
| 35 |
* the REST API without a nonce or bearer token, so nothing here can identify |
| 36 |
* the caller. The endpoint is safe to leave open — it takes no target from |
| 37 |
* the request (the URL probed is always this site's own home_url) and repeat |
| 38 |
* calls are served from the cached verdict. |
| 39 |
* |
| 40 |
* Only a caller WordPress can actually identify may force a fresh probe, so |
| 41 |
* an anonymous caller cannot drive outbound traffic. |
| 42 |
*/ |
| 43 |
public function verify($request) : Response |
| 44 |
{ |
| 45 |
$force = (bool) $request->get_param('force') && \current_user_can('manage_options'); |
| 46 |
$result = $this->reachabilityService->check($force); |
| 47 |
return Helper::rvxApi($result)->success($result['message'], Response::HTTP_OK); |
| 48 |
} |
| 49 |
} |
| 50 |
|
