| 1 |
<?php |
| 2 |
|
| 3 |
namespace Templately\Modules\FullSiteImport\REST; |
| 4 |
|
| 5 |
use Templately\API\API; |
| 6 |
use Templately\Modules\FullSiteImport\Utils\PackInfoFetcher; |
| 7 |
use Templately\Utils\Helper; |
| 8 |
use WP_Error; |
| 9 |
use WP_REST_Request; |
| 10 |
|
| 11 |
/** |
| 12 |
* REST replacement for the `wp_ajax_templately_pack_import_global_settings` action |
| 13 |
* (FR-018, specs/025-full-site-import/spec.md). Fetches a pack's manifest-declared |
| 14 |
* color/typography/customizer settings WITHOUT importing any posts, attachments, |
| 15 |
* templates, or terms — used by the settings-only import mode and by single-import's |
| 16 |
* "merge pack settings into the inserted template" flow. |
| 17 |
* |
| 18 |
* The old ajax action (`Ajax\PackInfoController::import_global_settings()`) is kept |
| 19 |
* running as a deprecated shim (see module.php) — browsers with an already-cached old |
| 20 |
* JS bundle would otherwise break on the next request after this route ships. |
| 21 |
*/ |
| 22 |
class GlobalSettings extends API { |
| 23 |
|
| 24 |
/** |
| 25 |
* The ajax path required `install_plugins` AND `install_themes` (the same |
| 26 |
* capability pair `FullSiteImport::add_ajax_action()` enforces for every |
| 27 |
* `wp_ajax_templately_pack_*` action) plus a valid `templately_nonce`. REST |
| 28 |
* requests carry their own nonce (`X-WP-Nonce`, verified by WP core before |
| 29 |
* permission_callback even runs), so the equivalent protection here is: the |
| 30 |
* same capability pair, ON TOP OF the base API class's `permission_check()` |
| 31 |
* (delete_posts + a connected/verified account `api_key`) — net STRICTER than |
| 32 |
* the ajax path, never weaker. |
| 33 |
*/ |
| 34 |
public function permission_check( WP_REST_Request $request ) { |
| 35 |
$this->request = $request; |
| 36 |
|
| 37 |
if ( ! current_user_can( 'install_plugins' ) || ! current_user_can( 'install_themes' ) ) { |
| 38 |
return new WP_Error( |
| 39 |
'rest_forbidden', |
| 40 |
__( 'Sorry, you are not allowed to import global settings.', 'templately' ), |
| 41 |
[ 'status' => rest_authorization_required_code() ] |
| 42 |
); |
| 43 |
} |
| 44 |
|
| 45 |
return parent::permission_check( $request ); |
| 46 |
} |
| 47 |
|
| 48 |
public function register_routes() { |
| 49 |
$this->post( 'import/global-settings', [ $this, 'import_global_settings' ], [ |
| 50 |
'id' => [ |
| 51 |
'required' => true, |
| 52 |
], |
| 53 |
'isAi' => [ |
| 54 |
'required' => false, |
| 55 |
], |
| 56 |
] ); |
| 57 |
} |
| 58 |
|
| 59 |
public function import_global_settings() { |
| 60 |
$id = $this->get_param( 'id', 0, 'absint' ); |
| 61 |
$isAi = Helper::sanitize( $this->get_param( 'isAi', false, null ), 'boolean' ); |
| 62 |
|
| 63 |
if ( empty( $id ) ) { |
| 64 |
return $this->error( 'invalid_id', __( 'A valid pack id is required.', 'templately' ), 'import/global-settings', 400 ); |
| 65 |
} |
| 66 |
|
| 67 |
$data = ( new PackInfoFetcher() )->fetch( $id, $isAi ); |
| 68 |
if ( is_wp_error( $data ) ) { |
| 69 |
return $this->error( 'api_error', $data->get_error_message(), 'import/global-settings', 500 ); |
| 70 |
} |
| 71 |
|
| 72 |
$settings = []; |
| 73 |
if ( isset( $data['data']['settings'] ) ) { |
| 74 |
$settings = json_decode( $data['data']['settings'], true ); |
| 75 |
} |
| 76 |
|
| 77 |
return $this->success( [ 'settings' => $settings ] ); |
| 78 |
} |
| 79 |
} |
| 80 |
|
