superfrete / app / Controllers / OAuthController.php

OAuthController.php in SuperFrete trunk, at app/Controllers/OAuthController.php

196 lines 6.3 KB

Raw Download Zip

1	<?php
2
3	namespace SuperFrete_API\Controllers;
4
5	use SuperFrete_API\Helpers\Logger;
6	use WP_REST_Server;
7	use WP_REST_Request;
8	use WP_REST_Response;
9	use WP_Error;
10
11	if (!defined('ABSPATH')) {
12	exit; // Security check
13	}
14
15	class OAuthController
16	{
17
18	public function __construct()
19	{
20	add_action('rest_api_init', [$this, 'register_routes']);
21
22	// Also register AJAX handlers as backup
23	add_action('wp_ajax_superfrete_oauth_proxy', [$this, 'ajax_oauth_proxy']);
24	add_action('wp_ajax_nopriv_superfrete_oauth_proxy', [$this, 'ajax_oauth_proxy']);
25	}
26
27	/**
28	* Register REST API routes for OAuth proxy
29	*/
30	public function register_routes()
31	{
32	// Proxy endpoint for polling OAuth token
33	register_rest_route('superfrete/v1', '/oauth/token', [
34	'methods' => WP_REST_Server::READABLE,
35	'callback' => [$this, 'proxy_oauth_token'],
36	'permission_callback' => '__return_true', // Temporarily allow all for debugging
37	'args' => [
38	'session_id' => [
39	'required' => true,
40	'type' => 'string',
41	'description' => 'OAuth session ID'
42	]
43	]
44	]);
45	}
46
47	/**
48	* AJAX handler for OAuth proxy (backup method)
49	*/
50	public function ajax_oauth_proxy()
51	{
52	Logger::debug('AJAX proxy called', 'OAuth');
53
54	// Check nonce for security
55	if (!isset($_GET['nonce']) \|\| !wp_verify_nonce($_GET['nonce'], 'wp_rest')) {
56	wp_send_json_error('Invalid nonce');
57	return;
58	}
59
60	$session_id = sanitize_text_field($_GET['session_id'] ?? '');
61	Logger::debug('AJAX session_id = ' . $session_id, 'OAuth');
62
63	if (empty($session_id)) {
64	wp_send_json_error('Session ID is required');
65	return;
66	}
67
68	// Get the headless API URL from settings
69	$api_url = $this->get_headless_api_url();
70	if (!$api_url) {
71	wp_send_json_error('Headless API URL not configured');
72	return;
73	}
74
75	// Make server-side request to headless API
76	$url = $api_url . '/headless/oauth/token?session_id=' . urlencode($session_id);
77	Logger::debug('AJAX calling URL = ' . $url, 'OAuth');
78
79	$response = wp_remote_get($url, [
80	'timeout' => 30,
81	'headers' => [
82	'Accept' => 'application/json',
83	'User-Agent' => 'SuperFrete-WordPress-Plugin/2.1.4'
84	]
85	]);
86
87	if (is_wp_error($response)) {
88	Logger::debug('AJAX wp_remote_get error = ' . $response->get_error_message(), 'OAuth');
89	wp_send_json_error('Failed to connect to headless API: ' . $response->get_error_message());
90	return;
91	}
92
93	$status_code = wp_remote_retrieve_response_code($response);
94	$body = wp_remote_retrieve_body($response);
95
96	Logger::debug('AJAX response status = ' . $status_code, 'OAuth');
97	Logger::debug('AJAX response body = ' . $body, 'OAuth');
98
99	// Try to decode JSON response
100	$data = json_decode($body, true);
101	if (json_last_error() !== JSON_ERROR_NONE) {
102	wp_send_json_error('Invalid JSON response from API');
103	return;
104	}
105
106	// Return the data
107	wp_send_json($data);
108	}
109
110	/**
111	* Proxy OAuth token request to headless API
112	*
113	* @param WP_REST_Request $request
114	* @return WP_REST_Response\|WP_Error
115	*/
116	public function proxy_oauth_token(WP_REST_Request $request)
117	{
118	Logger::debug('proxy_oauth_token called', 'OAuth');
119
120	$session_id = $request->get_param('session_id');
121	Logger::debug('session_id = ' . $session_id, 'OAuth');
122
123	if (empty($session_id)) {
124	Logger::debug('Missing session_id', 'OAuth');
125	return new WP_Error('missing_session_id', 'Session ID is required', ['status' => 400]);
126	}
127
128	// Get the headless API URL from settings
129	$api_url = $this->get_headless_api_url();
130	if (!$api_url) {
131	return new WP_Error('api_url_not_configured', 'Headless API URL not configured', ['status' => 500]);
132	}
133
134	// Make server-side request to headless API
135	$url = $api_url . '/headless/oauth/token?session_id=' . urlencode($session_id);
136
137	$response = wp_remote_get($url, [
138	'timeout' => 30,
139	'headers' => [
140	'Accept' => 'application/json',
141	'User-Agent' => 'SuperFrete-WordPress-Plugin/2.1.4'
142	]
143	]);
144
145	if (is_wp_error($response)) {
146	return new WP_Error('api_request_failed', 'Failed to connect to headless API: ' . $response->get_error_message(), ['status' => 500]);
147	}
148
149	$status_code = wp_remote_retrieve_response_code($response);
150	$body = wp_remote_retrieve_body($response);
151
152	// Try to decode JSON response
153	$data = json_decode($body, true);
154	if (json_last_error() !== JSON_ERROR_NONE) {
155	return new WP_Error('invalid_json_response', 'Invalid JSON response from API', ['status' => 500]);
156	}
157
158	// Return the same response structure as the headless API
159	return new WP_REST_Response($data, $status_code);
160	}
161
162	/**
163	* Get headless API URL from WordPress settings
164	*
165	* @return string\|null
166	*/
167	private function get_headless_api_url()
168	{
169	// Check if we're in sandbox mode
170	$sandbox_mode = get_option('superfrete_sandbox_mode', 'no');
171
172	Logger::debug('sandbox_mode setting = ' . $sandbox_mode, 'OAuth');
173
174	if ($sandbox_mode === 'yes') {
175	// Development/sandbox environment
176	$api_url = 'https://api.dev.superintegrador.superfrete.com';
177	Logger::debug('Using dev API = ' . $api_url, 'OAuth');
178	return $api_url;
179	} else {
180	// Production environment
181	$api_url = 'https://api.superintegrador.superfrete.com';
182	Logger::debug('Using production API = ' . $api_url, 'OAuth');
183	return $api_url;
184	}
185	}
186
187	/**
188	* Check if user has admin permissions
189	*
190	* @return bool
191	*/
192	public function check_admin_permissions()
193	{
194	return current_user_can('manage_options');
195	}
196	}