| 1 |
<?php |
| 2 |
|
| 3 |
namespace Templately\Modules\Auth\REST; |
| 4 |
|
| 5 |
use Templately\API\API; |
| 6 |
use Templately\Utils\Helper; |
| 7 |
|
| 8 |
class Profile extends API { |
| 9 |
|
| 10 |
public function register_routes() { |
| 11 |
$this->get( 'profile/sync', [ $this, 'sync' ] ); |
| 12 |
$this->get( 'profile/verified', [ $this, 'verified' ] ); |
| 13 |
} |
| 14 |
|
| 15 |
public function sync() { |
| 16 |
// `subscription` (with `subscription_plan_id`) must be requested here too, |
| 17 |
// not just on connect: /profile/sync overwrites the stored `user` record |
| 18 |
// wholesale, so omitting the node DROPS the id the Subscription screen's |
| 19 |
// CurrentPlanCard uses to resolve the billing interval — and the card then |
| 20 |
// falls back to guessing "Lifetime" from an empty `plan_expire_at`. |
| 21 |
// Keep the `subscription` field set in step with `Login::login()` — the |
| 22 |
// Subscription screen renders from whichever of the two answered last, so a |
| 23 |
// field missing here silently degrades the card after a profile sync. |
| 24 |
$query = 'status, message, user{ id, name, first_name, last_name, display_name, email, profile_photo, joined, is_verified, is_restricted_company_user, api_key, plan, plan_expire_at, my_cloud{ limit, usages, last_pushed }, favourites{ id, type }, show_notice, reviews{ type, type_id, rating }, subscription { id, name, sites, subscription_plan_id, ends_at, plan_type, cancel_at_period_end } }'; |
| 25 |
|
| 26 |
$funcArgs = [ |
| 27 |
'api_key' => $this->api_key, |
| 28 |
'site_url' => home_url( '/' ), |
| 29 |
'ip' => Helper::get_ip() |
| 30 |
]; |
| 31 |
|
| 32 |
$response = $this->http()->mutation( 'connectWithApiKey', $query, $funcArgs )->post(); |
| 33 |
|
| 34 |
if ( is_wp_error( $response ) ) { |
| 35 |
return $response; |
| 36 |
} |
| 37 |
|
| 38 |
$meta = [ |
| 39 |
'is_globally_signed' => Login::is_globally_signed(), |
| 40 |
'signed_as_global' => Login::signed_as_global() |
| 41 |
]; |
| 42 |
|
| 43 |
if ( ! empty( $response['user']['my_cloud']['last_pushed'] ) ) { |
| 44 |
// Cloud response body = untrusted input: never hydrate objects from it. |
| 45 |
$_cloud_activity = unserialize( $response['user']['my_cloud']['last_pushed'], [ 'allowed_classes' => false ] ); |
| 46 |
$this->utils( 'options' )->set( 'cloud_activity', $_cloud_activity ); |
| 47 |
$meta['cloud_activity'] = $_cloud_activity; |
| 48 |
unset( $response['user']['my_cloud']['last_pushed'] ); |
| 49 |
} |
| 50 |
|
| 51 |
if ( ! empty( $response['user']['favourites'] ) ) { |
| 52 |
$_favourites = $this->utils( 'helper' )->normalizeFavourites( $response['user']['favourites'] ); |
| 53 |
$this->utils( 'options' )->set( 'favourites', $_favourites ); |
| 54 |
|
| 55 |
unset( $response['user']['favourites'] ); |
| 56 |
$meta['favourites'] = $_favourites; |
| 57 |
} |
| 58 |
|
| 59 |
if ( ! empty( $response['user']['reviews'] ) ) { |
| 60 |
$_reviews = $this->utils( 'helper' )->normalizeReviews( $response['user']['reviews'] ); |
| 61 |
$this->utils( 'options' )->set( 'reviews', $_reviews ); |
| 62 |
|
| 63 |
unset( $response['user']['reviews'] ); |
| 64 |
$meta['reviews'] = $_reviews; |
| 65 |
} |
| 66 |
|
| 67 |
if ( ! empty( $response['user']['reviews'] ) ) { |
| 68 |
$_reviews = $this->utils( 'helper' )->normalizeReviews( $response['user']['reviews'] ); |
| 69 |
$this->utils( 'options' )->set( 'reviews', $_reviews ); |
| 70 |
|
| 71 |
unset( $response['user']['reviews'] ); |
| 72 |
$meta['reviews'] = $_reviews; |
| 73 |
} |
| 74 |
|
| 75 |
if ( ! empty( $response['user'] ) && is_array( $response['user'] ) ) { |
| 76 |
/** |
| 77 |
* The cloud API key must never be persisted here or sent to the client. |
| 78 |
* Under a global login this key belongs to the admin, while any user with |
| 79 |
* `delete_posts` can reach this endpoint. Login and SignUp already drop it. |
| 80 |
*/ |
| 81 |
unset( $response['user']['api_key'] ); |
| 82 |
|
| 83 |
$response['user']['site_url'] = base64_encode( home_url( '/' ) ); |
| 84 |
$response['user']['ip'] = Helper::get_ip(); |
| 85 |
} |
| 86 |
|
| 87 |
$this->utils( 'options' )->set( 'user', $response['user'] ); |
| 88 |
$response['user']['meta'] = Login::get_instance()->user_meta( $meta ); |
| 89 |
|
| 90 |
return $this->success( $response ); |
| 91 |
} |
| 92 |
|
| 93 |
public function verified() { |
| 94 |
$funcArgs = [ |
| 95 |
'api_key' => $this->api_key |
| 96 |
]; |
| 97 |
|
| 98 |
$response = $this->http()->query( 'isVerifiedUser', '', $funcArgs )->post(); |
| 99 |
|
| 100 |
if ( $response && !is_wp_error( $response ) ) { |
| 101 |
$user = $this->utils( 'options' )->get( 'user' ); |
| 102 |
|
| 103 |
// Options::get('user') returns the default `false` when no local user is |
| 104 |
// stored. Writing `$user['is_verified']` onto a scalar raises a PHP warning |
| 105 |
// and would persist a corrupted `user` option — guard for the array. |
| 106 |
if ( is_array( $user ) ) { |
| 107 |
$user['is_verified'] = true; |
| 108 |
$this->utils( 'options' )->set( 'user', $user ); |
| 109 |
} |
| 110 |
} |
| 111 |
|
| 112 |
return $response; |
| 113 |
} |
| 114 |
} |
| 115 |
|
