← All changes | includes/Admin/Api/OnboardData.php +78 -42 2.2.7 → 2.2.14 View file →

		@@ -1,95 +1,131 @@
1	1	<?php
	2	+/**
	3	+ * REST endpoints for the plugin's onboarding flow
	4	+ *
	5	+ * @package TableKit
	6	+ */
2	7
3	8	namespace TableBuilder\Admin\Api;
4	9
5	10	defined( 'ABSPATH' ) || exit;
6	11
	12	+/**
	13	+ * Registers and serves the tablebuilder/v1/onboard REST routes.
	14	+ */
7	15	class OnboardData {
8	16	private const PLUGIN_SUBSCRIBE_URL = 'https://api.wpmet.com/public/plugin-subscribe/';
9	17
	18	+ /**
	19	+ * Hooks onboarding REST route registration into WordPress.
	20	+ */
10	21	public function __construct() {
11		- add_action( 'rest_api_init', [ $this, 'register_routes' ] );
	22	+ add_action( 'rest_api_init', array( $this, 'register_routes' ) );
12	23	}
13	24
	25	+ /**
	26	+ * Sends the user's email to Wpmet's subscribe endpoint when onboarding completes.
	27	+ *
	28	+ * @param string $email User email to subscribe.
	29	+ * @return void
	30	+ */
14	31	private function send_email_subscribe_data( string $email ): void {
15	32	wp_remote_post(
16	33	self::PLUGIN_SUBSCRIBE_URL,
17		- [
	34	+ array(
18	35	'method' => 'POST',
19		- 'headers' => [
	36	+ 'headers' => array(
20	37	'Accept' => '*/*',
21	38	'Content-Type' => 'application/json',
22		- ],
	39	+ ),
23	40	'body' => wp_json_encode(
24		- [
	41	+ array(
25	42	'email' => $email,
26	43	'slug' => 'tablekit',
27		- ]
	44	+ )
28	45	),
29		- ]
	46	+ )
30	47	);
31	48	}
32	49
	50	+ /**
	51	+ * Registers the tablebuilder/v1/onboard GET/POST REST routes.
	52	+ *
	53	+ * @return void
	54	+ */
33	55	public function register_routes(): void {
34	56	register_rest_route(
35	57	'tablebuilder/v1',
36	58	'onboard',
37		- [
	59	+ array(
38	60	'methods' => \WP_REST_Server::READABLE,
39		- 'callback' => [ $this, 'action_get_onboard' ],
40		- 'permission_callback' => '__return_true',
41		- ]
	61	+ 'callback' => array( $this, 'action_get_onboard' ),
	62	+ 'permission_callback' => array( $this, 'is_request_allowed' ),
	63	+ )
42	64	);
43	65
44	66	register_rest_route(
45	67	'tablebuilder/v1',
46	68	'onboard',
47		- [
	69	+ array(
48	70	'methods' => \WP_REST_Server::EDITABLE,
49		- 'callback' => [ $this, 'action_update_onboard' ],
50		- 'permission_callback' => '__return_true',
51		- ]
	71	+ 'callback' => array( $this, 'action_update_onboard' ),
	72	+ 'permission_callback' => array( $this, 'is_request_allowed' ),
	73	+ )
52	74	);
53	75	}
54	76
55		- private function is_request_allowed( $request ): bool {
	77	+ /**
	78	+ * Verifies nonce and capability. Used as permission_callback so
	79	+ * WordPress returns a proper 401/403 status on failure.
	80	+ *
	81	+ * @param \WP_REST_Request $request Request; only its nonce header is used.
	82	+ * @return true|\WP_Error
	83	+ */
	84	+ public function is_request_allowed( $request ) {
56	85	if ( ! wp_verify_nonce( $request->get_header( 'X-WP-Nonce' ), 'wp_rest' ) ) {
57		- return false;
	86	+ return new \WP_Error(
	87	+ 'rest_cookie_invalid_nonce',
	88	+ __( 'Nonce mismatch.', 'table-builder-block' ),
	89	+ array( 'status' => 403 )
	90	+ );
58	91	}
59	92
60	93	if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
61		- return false;
	94	+ return new \WP_Error(
	95	+ 'rest_forbidden',
	96	+ __( 'Access denied.', 'table-builder-block' ),
	97	+ array( 'status' => 403 )
	98	+ );
62	99	}
63	100
64	101	return true;
65	102	}
66	103
67		- public function action_get_onboard( $request ) {
68		- if ( ! $this->is_request_allowed( $request ) ) {
69		- return [
70		- 'status' => 'fail',
71		- 'message' => [ __( 'Access denied.', 'table-builder-block' ) ],
72		- ];
73		- }
74		-
75		- return [
	104	+ /**
	105	+ * REST callback: get current onboarding completion status.
	106	+ *
	107	+ * @param \WP_REST_Request $request Unused; no params required.
	108	+ * @return array{status:string,onboard:array{completed:bool,completedAt:string}}
	109	+ */
	110	+ public function action_get_onboard( $request ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- required by the register_rest_route() "callback" signature; not needed in the body.
	111	+ return array(
76	112	'status' => 'success',
77		- 'onboard' => [
	113	+ 'onboard' => array(
78	114	'completed' => (bool) get_option( 'tablebuilder_onboard_completed', false ),
79	115	'completedAt' => get_option( 'tablebuilder_onboard_completed_at', '' ),
80		- ],
81		- ];
	116	+ ),
	117	+ );
82	118	}
83	119
	120	+ /**
	121	+ * REST callback: mark onboarding completed/incomplete, optionally
	122	+ * subscribing the given email when marking it completed.
	123	+ *
	124	+ * @param \WP_REST_Request $request Request with "completed" (bool) and optional "userMail" params.
	125	+ * @return array{status:string,onboard:array{completed:bool,completedAt:string}}
	126	+ */
84	127	public function action_update_onboard( $request ) {
85		- if ( ! $this->is_request_allowed( $request ) ) {
86		- return [
87		- 'status' => 'fail',
88		- 'message' => [ __( 'Access denied.', 'table-builder-block' ) ],
89		- ];
90		- }
91		-
92	128	$completed = (bool) $request->get_param( 'completed' );
93	129	$user_mail = sanitize_email( wp_unslash( (string) $request->get_param( 'userMail' ) ) );
94	130
95	131	update_option( 'tablebuilder_onboard_completed', $completed ? 1 : 0 );
		@@ -102,13 +138,13 @@
102	138	update_option( 'tablebuilder_onboard_completed_at', current_time( 'mysql' ) );
103	139	delete_transient( 'tablebuilder_show_onboard' );
104	140	}
105	141
106		- return [
	142	+ return array(
107	143	'status' => 'success',
108		- 'onboard' => [
	144	+ 'onboard' => array(
109	145	'completed' => $completed,
110	146	'completedAt' => get_option( 'tablebuilder_onboard_completed_at', '' ),
111		- ],
112		- ];
	147	+ ),
	148	+ );
113	149	}
114		-}
	150	+}