← All changes | includes/API/Login.php +19 -150 3.7.5 → 2.2.0 View file →

		@@ -13,16 +13,8 @@
13	13	if ( '/templately/v1/login' === $_route ) {
14	14	return true;
15	15	}
16	16
17		- if ( '/templately/v1/pricing' === $_route ) {
18		- return true;
19		- }
20		-
21		- if ( '/templately/v1/google-auth-url' === $_route ) {
22		- return true;
23		- }
24		-
25	17	return parent::permission_check( $request );
26	18	}
27	19
28	20	public function register_routes() {
		@@ -28,46 +20,10 @@
28	20	public function register_routes() {
29	21	$this->post( 'login', [$this, 'login'] );
30	22	$this->post( 'logout', [$this, 'logout'] );
31	23	$this->get( 'is-signed', [$this, 'is_signed'] );
32		- $this->get( 'pricing', [$this, 'pricing'] );
33		- $this->get( 'google-auth-url', [$this, 'google_auth_url'] );
34	24	}
35	25
36		- public function google_auth_url() {
37		- // Get redirect_to parameter from request if provided
38		- $redirect_to = $this->get_param( 'redirect-to', '' );
39		-
40		- // Use client-provided current_url instead of HTTP_REFERER for reliability
41		- $current_url = $this->get_param( 'current_url', '' );
42		-
43		- $url = $this->http()->google_auth_url( $redirect_to, $current_url );
44		- return [
45		- 'status' => 'success',
46		- 'url' => $url
47		- ];
48		- }
49		-
50		- public function pricing(){
51		- $data = get_transient( "templately_subscriptions_v2" );
52		-
53		- if( is_array( $data ) && ! empty( $data ) ) {
54		- return $data;
55		- }
56		-
57		- // Field set drives the Subscription screen's plan comparison grid, so it
58		- // carries the per-plan limits too, not just price/sites.
59		- $query = 'id, price, name, slug, discounted_price, type, sites, coupon, my_cloud_items, pro_items, workspace, fsi_limit, ai_credit, description';
60		- $response = $this->http()->query(
61		- 'subscriptionPlans',
62		- $query
63		- )->post();
64		-
65		- set_transient( "templately_subscriptions_v2", $response, WEEK_IN_SECONDS );
66		-
67		- return $response;
68		- }
69		-
70	26	public function login() {
71	27	$errors = [];
72	28	$_ip = Helper::get_ip();
73	29	$_site_url = home_url( '/' );
		@@ -81,10 +37,8 @@
81	37	'ip' => $_ip,
82	38	'site_url' => $_site_url
83	39	];
84	40
85		- $postArgs = [];
86		-
87	41	if ( $viaAPI ) {
88	42	$api_key = $this->get_param( 'api_key' );
89	43	$funcArgs['api_key'] = $api_key;
90	44
		@@ -92,9 +46,9 @@
92	46	$errors['api_key'] = __( 'API Key field cannot be empty.', 'templately' );
93	47	}
94	48	} else {
95	49	$funcArgs['email'] = $email;
96		- $funcArgs['password'] = addcslashes( $password, '"' );
	50	+ $funcArgs['password'] = $password;
97	51
98	52	if ( ! filter_var( $email, FILTER_VALIDATE_EMAIL ) ) {
99	53	$errors['email'] = __( 'Make sure you have given a valid email address.', 'templately' );
100	54	}
		@@ -107,50 +61,20 @@
107	61	if ( ! empty( $errors ) ) {
108	62	return $this->error( 'login_error', $errors, 'login', 400 );
109	63	}
110	64
111		- // `ends_at`, `plan_type` and `cancel_at_period_end` drive the Subscription
112		- // screen's renewal line. They are asked for instead of leaning on
113		- // `plan_expire_at`, which the API resolves with `empty($subscription->ends_at)
114		- // ?? …` — a boolean that never falls through, so it never carries a date.
115		- $query = 'status, message, user{ id, name, first_name, last_name, display_name, email, profile_photo, joined, is_verified, is_company_user, is_restricted_company_user, api_key, plan, plan_expire_at, my_cloud{ limit, usages, last_pushed }, favourites{ id, type }, show_notice, reviews{ type, type_id, rating }, subscription { id, name, sites, subscription_plan_id, ends_at, plan_type, cancel_at_period_end } }';
	65	+ $query = 'status, message, user{ id, name, first_name, last_name, display_name, email, profile_photo, joined, is_verified, api_key, plan, plan_expire_at, my_cloud{ limit, usages, last_pushed }, favourites{ id, type }, show_notice }';
116	66
117	67	$response = $this->http()->mutation(
118	68	$viaAPI ? 'connectWithApiKey' : 'connect',
119	69	$query,
120	70	$funcArgs
121		- )->post($postArgs);
	71	+ )->post();
122	72
123	73	if ( is_wp_error( $response ) ) {
124	74	return $response;
125	75	}
126	76
127		- if ( empty( $response['user']['api_key'] ) ) {
128		- return $this->error( 'login_error', $response['message'] ?? __('Invalid API key.', 'templately'), 'login', 400 );
129		- }
130		-
131		- $options = $this->utils( 'options' );
132		- $options->use_current_user( true );
133		-
134		- try {
135		- return $this->store_connection( $response, $global_signin, $_ip, $_site_url );
136		- } finally {
137		- $options->use_current_user( false );
138		- }
139		- }
140		-
141		- /**
142		- * Persist an authenticated connection against the acting user.
143		- *
144		- * @param array $response Cloud response, already validated.
145		- * @param bool $global_signin Whether the user asked to sign in globally.
146		- * @param string $_ip Request IP, echoed back into the profile.
147		- * @param string $_site_url Site URL, echoed back into the profile.
148		- *
149		- * @return array
150		- */
151		- private function store_connection( $response, $global_signin, $_ip, $_site_url ) {
152		-
153	77	if ( $global_signin && ! Login::is_globally_signed() ) {
154	78	Options::set_global_login();
155	79	}
156	80
		@@ -178,25 +102,8 @@
178	102	unset( $response['user']['favourites'] );
179	103	$meta['favourites'] = $_favourites;
180	104	}
181	105
182		- if ( ! empty( $response['user']['reviews'] ) ) {
183		- $_reviews = $this->utils( 'helper' )->normalizeReviews( $response['user']['reviews'] );
184		- $this->utils( 'options' )->set( 'reviews', $_reviews );
185		-
186		- unset( $response['user']['reviews'] );
187		- $meta['reviews'] = $_reviews;
188		- }
189		-
190		- if(Helper::is_dev_api()){
191		- $response['user']['is_dev_api'] = true;
192		- }
193		-
194		- if(! empty( $response['user'] ) && is_array($response['user'])){
195		- $response['user']['ip'] = $_ip;
196		- $response['user']['site_url'] = base64_encode( $_site_url );
197		- }
198		-
199	106	$this->utils( 'options' )->set( 'user', $response['user'] );
200	107	$response['user']['meta'] = $this->user_meta( $meta );
201	108
202	109	return $response;
		@@ -202,28 +109,13 @@
202	109	return $response;
203	110	}
204	111
205	112	public function logout() {
206		- // Read the key off the acting user's own record. Options::get() falls back to
207		- // the global-login administrator when no target is given, so $this->api_key
208		- // resolves to the administrator's key for any linked user — disconnecting the
209		- // administrator's account on the cloud as well as locally.
210		- $api_key = $this->utils( 'options' )->get( 'api_key', '', get_current_user_id() );
211		-
212		- if ( empty( $api_key ) ) {
213		- return $this->error(
214		- 'logout_error',
215		- __( 'You are not connected to Templately.', 'templately' ),
216		- 'logout',
217		- 403
218		- );
219		- }
220		-
221	113	$response = $this->http()->mutation(
222	114	'disconnect',
223	115	'status, message, data',
224	116	[
225		- 'api_key' => $api_key,
	117	+ 'api_key' => $this->api_key,
226	118	"site_url" => home_url( '/' )
227	119	]
228	120	)->post();
229	121
		@@ -250,33 +142,20 @@
250	142	return $response;
251	143	}
252	144
253	145	public function delete(){
254		- $options = $this->utils( 'options' );
	146	+ $this->utils( 'options' )
	147	+ ->remove( 'user' )
	148	+ ->remove( 'favourites' )
	149	+ ->remove( 'cloud_activity' )
	150	+ ->remove( 'api_key' )
	151	+ ->remove( 'global_login' )
	152	+ ->remove( 'templates_in_clouds' );
255	153
256		- // Pin the removals to the acting user. Without the pin, Options::user_id()
257		- // resolves a linked user to the global-login administrator and the delete
258		- // path wipes the administrator's connection instead of the caller's.
259		- $options->use_current_user( true );
	154	+ if ( $this->utils( 'options' )->whoami() === 'global' ) {
	155	+ $this->utils( 'options' )->remove_global_login();
	156	+ }
260	157
261		- try {
262		- $options
263		- ->remove( 'user' )
264		- ->remove( 'favourites' )
265		- ->remove( 'reviews' )
266		- ->remove( 'cloud_activity' )
267		- ->remove( 'api_key' )
268		- ->remove( 'global_login' )
269		- ->remove( 'total_download_counts' )
270		- ->remove( 'templates_in_clouds' );
271		-
272		- if ( $options->who_am_i() === 'global' ) {
273		- $options->remove_global_login();
274		- }
275		- } finally {
276		- $options->use_current_user( false );
277		- }
278		-
279	158	$global_user_id = $this->utils( 'options' )->is_global();
280	159	$global_user = null;
281	160
282	161	if ( $global_user_id !== $this->utils( 'options' )->current_user_id() ) {
		@@ -282,12 +161,8 @@
282	161	if ( $global_user_id !== $this->utils( 'options' )->current_user_id() ) {
283	162	$global_user = $this->utils( 'options' )->get( 'user', false, $global_user_id );
284	163
285	164	if ( ! empty( $global_user ) ) {
286		- if ( is_array( $global_user ) ) {
287		- unset( $global_user['api_key'] );
288		- }
289		-
290	165	$global_user['meta'] = $this->user_meta();
291	166	}
292	167	}
293	168
		@@ -293,9 +168,9 @@
293	168
294	169	return $global_user;
295	170	}
296	171
297		- public static function is_signed(): array {
	172	+ public static function is_signed() {
298	173	$_response = [
299	174	'status' => 'success'
300	175	];
301	176
		@@ -301,13 +176,8 @@
301	176
302	177	$_user = ( new static )->utils( 'options' )->get( 'user', null );
303	178
304	179	if ( ! is_null( $_user ) ) {
305		- // Profiles stored before 3.7.1 may still carry the cloud API key.
306		- if ( is_array( $_user ) ) {
307		- unset( $_user['api_key'] );
308		- }
309		-
310	180	$_user['meta'] = self::get_instance()->user_meta();
311	181	}
312	182
313	183	if ( empty( $_user ) ) {
		@@ -318,9 +188,9 @@
318	188
319	189	return $_response;
320	190	}
321	191
322		- public function user_meta( $meta = [] ): array {
	192	+ public function user_meta( $meta = [] ) {
323	193	$_meta = [
324	194	'link_account' => self::utils( 'options' )->link_account(),
325	195	'unlink_account' => self::utils( 'options' )->unlink_account(),
326	196	'is_globally_signed' => Login::is_globally_signed(),
		@@ -325,9 +195,8 @@
325	195	'unlink_account' => self::utils( 'options' )->unlink_account(),
326	196	'is_globally_signed' => Login::is_globally_signed(),
327	197	'signed_as_global' => Login::signed_as_global(),
328	198	'starred' => self::utils( 'options' )->get( 'favourites' ),
329		- 'reviews' => self::utils( 'options' )->get( 'reviews' ),
330	199	'cloud_activity' => self::utils( 'options' )->get( 'cloud_activity' ),
331	200	'has_api' => rest_sanitize_boolean( self::utils( 'options' )->get( 'api_key' ) )
332	201	];
333	202
		@@ -333,12 +202,12 @@
333	202
334	203	return array_merge( $_meta, $meta );
335	204	}
336	205
337		- public static function is_globally_signed(): bool {
	206	+ public static function is_globally_signed() {
338	207	return rest_sanitize_boolean( ( new static )->utils( 'options' )->is_globally_signed() );
339	208	}
340	209
341		- public static function signed_as_global(): bool {
	210	+ public static function signed_as_global() {
342	211	return rest_sanitize_boolean( ( new static )->utils( 'options' )->signed_as_global() );
343	212	}
344		-}
	213	+}