woocommerce-pos / includes / API.php

API.php in WCPOS – Point of Sale (POS) plugin for WooCommerce 1.9.14, at includes/API.php

575 lines 21.0 KB

Raw Download Zip

1	<?php
2	/**
3	* WCPOS REST API Class, ie: /wcpos/v1/ endpoints.
4	*
5	* @author Paul Kilmurray <paul@kilbot.com>
6	*
7	* @see http://wcpos.com
8	* @package WCPOS\WooCommercePOS
9	*/
10
11	namespace WCPOS\WooCommercePOS;
12
13	use Ramsey\Uuid\Uuid;
14	use WCPOS\WooCommercePOS\Services\Auth;
15	use WP_HTTP_Response;
16	use WP_REST_Request;
17	use WP_REST_Response;
18	use WP_REST_Server;
19
20	/**
21	* API class.
22	*/
23	class API {
24	/**
25	* WCPOS REST API namespaces and endpoints.
26	*
27	* @var array
28	*/
29	protected $controllers = array();
30
31	/**
32	* Map of route patterns to controller keys.
33	* Built during register_routes() for use in rest_dispatch_request().
34	*
35	* @var array<string, string>
36	*/
37	protected $route_map = array();
38
39	/**
40	* Flag to check if authentication has been checked.
41	*
42	* @var bool
43	*/
44	protected $is_auth_checked = false;
45
46	/**
47	* Flag to track whether WCPOS successfully authenticated the current request
48	* via its own Bearer token. Used to suppress errors from third-party JWT
49	* plugins that inspected the same Authorization header but could not validate
50	* a WCPOS-issued token with their own secret.
51	*
52	* @var bool
53	*/
54	protected $authenticated_via_wcpos = false;
55
56	/**
57	* Constructor.
58	*/
59	public function __construct() {
60	$this->register_routes();
61
62	// Allows requests from WCPOS Desktop and Mobile Apps.
63	add_filter( 'rest_allowed_cors_headers', array( $this, 'rest_allowed_cors_headers' ), 10, 1 );
64	add_filter( 'rest_pre_serve_request', array( $this, 'rest_pre_serve_request' ), 10, 4 );
65
66	/*
67	* Adds authentication to for JWT bearer tokens
68	* - We run determine_current_user at 20 to allow other plugins to run first
69	*/
70	add_filter( 'determine_current_user', array( $this, 'determine_current_user' ), 20 );
71	add_filter( 'rest_authentication_errors', array( $this, 'rest_authentication_errors' ), 50, 1 );
72
73	// Adds info about the WordPress install.
74	add_filter( 'rest_index', array( $this, 'rest_index' ), 10, 1 );
75
76	// These filters allow changes to the WC REST API response.
77	add_filter( 'rest_dispatch_request', array( $this, 'rest_dispatch_request' ), 10, 4 );
78	add_filter( 'rest_pre_dispatch', array( $this, 'rest_pre_dispatch' ), 10, 3 );
79	}
80
81	/**
82	* Register routes for all controllers.
83	*/
84	public function register_routes(): void {
85	/**
86	* Filter the list of controller classes used in the WCPOS REST API.
87	*
88	* This filter allows customizing or extending the set of controller classes that handle
89	* REST API routes for the WCPOS. By filtering these controllers, plugins can
90	* modify existing endpoints or add new controllers for additional functionality.
91	*
92	* @since 1.5.0
93	*
94	* @param array $controllers Associative array of controller identifiers to their corresponding class names.
95	* - 'auth' => Fully qualified name of the class handling authentication.
96	* - 'settings' => Fully qualified name of the class handling settings.
97	* - 'cashier' => Fully qualified name of the class handling cashier management.
98	* - 'products' => Fully qualified name of the class handling products.
99	* - 'product_variations' => Fully qualified name of the class handling product variations.
100	* - 'orders' => Fully qualified name of the class handling orders.
101	* - 'customers' => Fully qualified name of the class handling customers.
102	* - 'product_tags' => Fully qualified name of the class handling product tags.
103	* - 'product_categories' => Fully qualified name of the class handling product categories.
104	* - 'taxes' => Fully qualified name of the class handling taxes.
105	* - 'shipping_methods' => Fully qualified name of the class handling shipping methods.
106	* - 'tax_classes' => Fully qualified name of the class handling tax classes.
107	* - 'order_statuses' => Fully qualified name of the class handling order statuses.
108	*/
109	$classes = apply_filters(
110	'woocommerce_pos_rest_api_controllers',
111	array(
112	// WCPOS rest api controllers.
113	'auth' => API\Auth::class,
114	'settings' => API\Settings::class,
115	'cashier' => API\Cashier::class,
116	'templates' => API\Templates_Controller::class,
117	'receipts' => API\Receipts_Controller::class,
118	'print_jobs' => API\Print_Jobs_Controller::class,
119
120	// TODO: remove this?
121	'stores' => API\Stores::class,
122	'extensions' => API\Extensions::class,
123	'logs' => API\Logs::class,
124	'payment_gateways' => API\Payment_Gateways::class,
125	'gateway_bootstrap' => API\Gateway_Bootstrap_Controller::class,
126	'checkout' => API\Checkout_Controller::class,
127
128	// extend WC REST API controllers.
129	'products' => API\Products_Controller::class,
130	'product_variations' => API\Product_Variations_Controller::class,
131	'orders' => API\Orders_Controller::class,
132	'customers' => API\Customers_Controller::class,
133	'product_tags' => API\Product_Tags_Controller::class,
134	'product_categories' => API\Product_Categories_Controller::class,
135	'product_brands' => API\Product_Brands_Controller::class,
136	'coupons' => API\Coupons_Controller::class,
137	'taxes' => API\Taxes_Controller::class,
138	'shipping_methods' => API\Shipping_Methods_Controller::class,
139	'tax_classes' => API\Tax_Classes_Controller::class,
140	'order_statuses' => API\Data_Order_Statuses_Controller::class,
141	)
142	);
143
144	foreach ( $classes as $key => $class ) {
145	if ( class_exists( $class ) ) {
146	$this->controllers[ $key ] = new $class();
147	$this->controllers[ $key ]->register_routes();
148	}
149	}
150
151	// Build route map for use in rest_dispatch_request().
152	$rest_server = rest_get_server();
153	$all_routes = $rest_server->get_routes( 'wcpos/v1' );
154
155	foreach ( $all_routes as $route_pattern => $route_handlers ) {
156	foreach ( $route_handlers as $route_handler ) {
157	$callback = $route_handler['callback'] ?? null;
158
159	// Extract the controller object from the callback.
160	$controller_obj = null;
161	if ( \is_array( $callback ) && isset( $callback[0] ) && \is_object( $callback[0] ) ) {
162	$controller_obj = $callback[0];
163	} elseif ( $callback instanceof \Closure ) {
164	// WC 10.5+ RestApiCache wraps callbacks in closures.
165	// Use reflection to extract the bound $this.
166	$ref = new \ReflectionFunction( $callback );
167	$controller_obj = $ref->getClosureThis();
168	}
169
170	if ( ! $controller_obj ) {
171	continue;
172	}
173
174	// Find which controller key this object belongs to.
175	foreach ( $this->controllers as $key => $registered_controller ) {
176	if ( $controller_obj === $registered_controller ) {
177	$this->route_map[ $route_pattern ] = $key;
178	break;
179	}
180	}
181	}
182	}
183	}
184
185	/**
186	* Add CORS headers to the REST API response.
187	*
188	* @param string[] $allow_headers The list of request headers to allow.
189	*
190	* @return string[] $allow_headers
191	*/
192	public function rest_allowed_cors_headers( array $allow_headers ): array {
193	$allow_headers[] = 'X-WCPOS';
194	$allow_headers[] = 'X-HTTP-Method-Override';
195	$allow_headers[] = 'X-WCPOS-Idempotency-Key';
196
197	return $allow_headers;
198	}
199
200	/**
201	* Add Access Control Allow Headers for POS app.
202	*
203	* NOTE: I have seen this filter called with NULL for $served, it should be a boolean.
204	*
205	* @param mixed $served Whether the request has already been served.
206	* Default false.
207	* @param WP_HTTP_Response $result Result to send to the client. Usually a `WP_REST_Response`.
208	* @param WP_REST_Request $request Request used to generate the response.
209	* @param WP_REST_Server $server Server instance.
210	*
211	* @return bool $served
212	*/
213	public function rest_pre_serve_request( $served, WP_HTTP_Response $result, WP_REST_Request $request, WP_REST_Server $server ) {
214	$server->send_header( 'Access-Control-Allow-Origin', '*' );
215
216	return $served;
217	}
218
219	/**
220	* Check request for any login tokens.
221	*
222	* Runs at priority 20, after other plugins (e.g. third-party JWT plugins at
223	* priority 10) have had a chance to authenticate the user. If another plugin
224	* already returned a valid user ID, we trust it. Otherwise we attempt our own
225	* WCPOS Bearer-token authentication.
226	*
227	* Note: some JWT plugins pass a WP_Error through this filter when they fail to
228	* validate a Bearer token. We treat that the same as false so we can still
229	* authenticate the request with our own JWT.
230	*
231	* Note: this filter may not be called at all when WordPress has already cached
232	* the current user (WooCommerce issue #26847). The rest_authentication_errors
233	* fallback below handles that scenario.
234	*
235	* @param false\|int\|\WP_Error $user_id User ID if one has been determined, false otherwise.
236	*
237	* @return false\|int
238	*/
239	public function determine_current_user( $user_id ) {
240	$this->is_auth_checked = true;
241
242	// Trust a valid user ID set by another plugin (e.g. JWT plugin with its own token).
243	// Treat a WP_Error the same as false — another plugin rejected its own token,
244	// but we should still attempt authentication with our Bearer token.
245	if ( ! empty( $user_id ) && ! is_wp_error( $user_id ) ) {
246	return $user_id;
247	}
248
249	$result = $this->authenticate( false );
250	if ( $result && ! is_wp_error( $result ) ) {
251	$this->authenticated_via_wcpos = true;
252	return $result;
253	}
254
255	// If neither we nor another plugin authenticated the user, return false
256	// (not authenticated) rather than a WP_Error from $user_id. WordPress core
257	// expects determine_current_user to return false\|int, not WP_Error.
258	// The JWT plugin's error will surface via rest_authentication_errors instead.
259	return is_wp_error( $user_id ) ? false : $user_id;
260	}
261
262	/**
263	* Handles two distinct failure modes:
264	*
265	* 1. WooCommerce issue #26847: determine_current_user may not be called when
266	* WordPress has already cached the current user. We attempt auth here as a
267	* fallback.
268	*
269	* 2. JWT plugin conflict: a third-party JWT plugin (e.g. jwt-authentication-for-wp-rest-api)
270	* sees our Bearer token, fails to validate it with its own secret, and returns
271	* a WP_Error via rest_authentication_errors at priority 10. We run at priority 50
272	* and attempt our own Bearer-token validation. If it succeeds, we clear the
273	* stale error — our authentication wins.
274	*
275	* @param mixed $errors Authentication errors.
276	*
277	* @return mixed
278	*/
279	public function rest_authentication_errors( $errors ) {
280	// If there is already an error from a previous filter (e.g. a JWT plugin that
281	// rejected our Bearer token), attempt WCPOS authentication before passing it
282	// through. This covers the case where determine_current_user was skipped
283	// (WC #26847) or where the JWT plugin ran at a higher priority.
284	if ( ! empty( $errors ) ) {
285	// Only clear errors that originate from JWT authentication plugins. Errors
286	// from other mechanisms (maintenance locks, IP restrictions, etc.) should
287	// be passed through even when the WCPOS Bearer token is valid.
288	$is_jwt_plugin_error = is_wp_error( $errors ) && 0 === strpos( $errors->get_error_code(), 'jwt_auth_' );
289
290	if ( $is_jwt_plugin_error && ! $this->authenticated_via_wcpos ) {
291	$user_id = $this->authenticate( false );
292	if ( $user_id && ! is_wp_error( $user_id ) ) {
293	wp_set_current_user( $user_id );
294	$this->authenticated_via_wcpos = true;
295	}
296	}
297
298	if ( $this->authenticated_via_wcpos && $is_jwt_plugin_error ) {
299	return null;
300	}
301
302	return $errors;
303	}
304
305	// check if determine_current_user has been called.
306	if ( ! $this->is_auth_checked ) {
307	// Authentication hasn't occurred during `determine_current_user`, so check auth.
308	$user_id = $this->authenticate( false );
309	if ( $user_id && ! is_wp_error( $user_id ) ) {
310	wp_set_current_user( $user_id );
311	$this->authenticated_via_wcpos = true;
312
313	return true;
314	}
315	}
316
317	return $errors;
318	}
319
320	/**
321	* Extract the Authorization Bearer token from the request.
322	*
323	* @return false\|string
324	*/
325	public function get_auth_header() {
326	// Check if HTTP_AUTHORIZATION is set and not empty
327	// (htaccess SetEnvIf can set an empty value when no header is present).
328	if ( ! empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
329	return sanitize_text_field( wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ) );
330	}
331
332	// Check for alternative header in $_SERVER.
333	if ( ! empty( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
334	return sanitize_text_field( wp_unslash( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) );
335	}
336
337	// Check for authorization param in URL ($_GET).
338	if ( ! empty( $_GET['authorization'] ) ) {
339	return sanitize_text_field( wp_unslash( $_GET['authorization'] ) );
340	}
341
342	// Return false if none of the variables are set.
343	return false;
344	}
345
346	/**
347	* Adds info to the WP REST API index response.
348	* - UUID
349	* - Version Info.
350	*
351	* @param WP_REST_Response $response Response data.
352	*
353	* @return WP_REST_Response
354	*/
355	public function rest_index( WP_REST_Response $response ): WP_REST_Response {
356	$uuid = get_option( 'woocommerce_pos_uuid' );
357	if ( ! $uuid ) {
358	$uuid = Uuid::uuid4()->toString();
359	update_option( 'woocommerce_pos_uuid', $uuid );
360	}
361	$response->data['uuid'] = $uuid;
362	$response->data['wp_version'] = get_bloginfo( 'version' );
363	$response->data['wc_version'] = WC()->version;
364	$response->data['wcpos_version'] = VERSION;
365	$response->data['use_jwt_as_param'] = woocommerce_pos_get_settings( 'tools', 'use_jwt_as_param' );
366
367	// Add WCPOS authentication endpoint to the response.
368	$response->data['authentication']['wcpos'] = array(
369	'endpoints' => array(
370	'authorization' => Template_Router::get_auth_url(),
371	),
372	);
373
374	/**
375	* Remove the routes from the response.
376	*
377	* Some wordpress sites have a huge number of routes, like 2MB of data. It shouldn;t matter, but it seems
378	* to cause issues with the desktop application sometimes. We don't use the routes at the moment, so we
379	* can remove them from the response.
380	*/
381	$data = $response->get_data();
382	unset( $data['routes'] );
383	$response->set_data( $data );
384
385	return $response;
386	}
387
388	/**
389	* Filters the pre-calculated result of a REST API dispatch request.
390	*
391	* Allow hijacking the request before dispatching by returning a non-empty. The returned value
392	* will be used to serve the request instead.
393	*
394	* @param mixed $result Response to replace the requested version with. Can be anything
395	* a normal endpoint can return, or null to not hijack the request.
396	* @param WP_REST_Server $server Server instance.
397	* @param WP_REST_Request $request Request used to generate the response.
398	*
399	* @return mixed
400	*/
401	public function rest_pre_dispatch( $result, $server, $request ) {
402	if ( strpos( $request->get_route(), '/wcpos/v1/' ) !== 0 ) {
403	return $result;
404	}
405
406	// Baseline permission gate: all POS endpoints require access_woocommerce_pos.
407	// Exempt public auth, printer-token polling, and authenticated receipt denials that need
408	// the receipt-specific error code.
409	$route = $request->get_route();
410	$has_route_specific_permission_error = is_user_logged_in() && 0 === strpos( $route, '/wcpos/v1/receipts/' );
411	$is_public_auth_route = \in_array( $route, array( '/wcpos/v1/auth/test', '/wcpos/v1/auth/refresh' ), true );
412	$is_printer_token_route = \in_array( $route, array( '/wcpos/v1/print-jobs/cloudprnt', '/wcpos/v1/print-jobs/epson-sdp' ), true )
413	\|\| 0 === strpos( $route, '/wcpos/v1/print-jobs/cloudprnt/' )
414	\|\| 0 === strpos( $route, '/wcpos/v1/print-jobs/epson-sdp/' );
415	$is_relay_verification_route = '/wcpos/v1/print-jobs/relay-verification' === $route;
416
417	if ( ! $is_public_auth_route && ! $has_route_specific_permission_error && ! $is_printer_token_route && ! $is_relay_verification_route ) {
418	if ( ! current_user_can( 'access_woocommerce_pos' ) ) {
419	if ( ! is_user_logged_in() ) {
420	return new \WP_Error(
421	'woocommerce_pos_rest_unauthorized',
422	__( 'Authentication required.', 'woocommerce-pos' ),
423	array( 'status' => 401 )
424	);
425	}
426
427	return new \WP_Error(
428	'woocommerce_pos_rest_forbidden',
429	__( 'You do not have permission to access the POS.', 'woocommerce-pos' ),
430	array( 'status' => 403 )
431	);
432	}
433	}
434
435	$max_length = 10000;
436
437	// Process 'include' parameter.
438	$include = $request->get_param( 'include' );
439	if ( $include ) {
440	$processed_include = $this->shorten_param_array( $include, $max_length );
441	$request->set_param( 'wcpos_include', $processed_include );
442	unset( $request['include'] );
443	}
444
445	// Process 'exclude' parameter.
446	$exclude = $request->get_param( 'exclude' );
447	if ( $exclude ) {
448	$processed_exclude = $this->shorten_param_array( $exclude, $max_length );
449	$request->set_param( 'wcpos_exclude', $processed_exclude );
450	unset( $request['exclude'] );
451	}
452
453	return $result;
454	}
455
456	/**
457	* Filters the REST API dispatch request result.
458	*
459	* @param mixed $dispatch_result Dispatch result, will be used if not empty.
460	* @param WP_REST_Request $request Request used to generate the response.
461	* @param string $route Route matched for the request.
462	* @param array $handler Route handler used for the request.
463	*
464	* @return mixed
465	*/
466	public function rest_dispatch_request( $dispatch_result, $request, $route, $handler ) {
467	// Only process wcpos/v1 routes.
468	if ( ! isset( $this->route_map[ $route ] ) ) {
469	return $dispatch_result;
470	}
471
472	/*
473	* POS-specific PHP settings to prevent errors in JSON and float weirdness.
474	*
475	* - error_reporting(0) - Turn off error reporting
476	* - ini_set('display_errors', 0) - Turn off error display
477	* - ini_set('precision', 10) - Set the precision of floating point numbers
478	* - ini_set('serialize_precision', 10) - Set the precision of floating point numbers for serialization
479	*
480	* This is to prevent any PHP errors from being displayed in the response.
481	*
482	* The precision settings are to prevent floating point weirdness, eg: stock_quantity 3.6 becomes 3.6000000000000001
483	*/
484	error_reporting( 0 );
485	@ini_set( 'display_errors', '0' ); // phpcs:ignore WordPress.PHP.IniSet.display_errors_Disallowed -- intentionally disabling error display for POS API responses.
486	@ini_set( 'precision', '10' );
487	@ini_set( 'serialize_precision', '10' );
488
489	$key = $this->route_map[ $route ];
490	$controller = $this->controllers[ $key ] ?? null;
491
492	if ( $controller && method_exists( $controller, 'wcpos_dispatch_request' ) ) {
493	return $controller->wcpos_dispatch_request( $dispatch_result, $request, $route, $handler );
494	}
495
496	return $dispatch_result;
497	}
498
499	/**
500	* Some servers have a limit on the number of include/exclude we can use in a request.
501	* Worst thing is there is often no error message, the request returns an empty response.
502	*
503	* For example, WP Engine has a limit of 1024 characters?
504	* https://wpengine.com/support/using-dev-tools/#Long_Queries_in_wp_db
505	*
506	* @TODO - For long queries, I should find a better solution than this.
507	*
508	* @param array\|string $param_value The parameter value.
509	* @param int $max_length The maximum length.
510	*
511	* @return array
512	*/
513	private function shorten_param_array( $param_value, $max_length ) {
514	$param_array = \is_array( $param_value ) ? $param_value : explode( ',', $param_value );
515	$param_string = implode( ',', $param_array );
516
517	if ( \strlen( $param_string ) > $max_length ) {
518	shuffle( $param_array ); // Shuffle to randomize.
519
520	$new_param_string = '';
521	$random_param_array = array();
522
523	foreach ( $param_array as $id ) {
524	if ( \strlen( $new_param_string . $id ) < $max_length ) {
525	$new_param_string .= $id . ',';
526	$random_param_array[] = $id;
527	} else {
528	break; // Stop when maximum length is reached.
529	}
530	}
531
532	return $random_param_array;
533	}
534
535	return $param_array;
536	}
537
538	/**
539	* Check the Authorization header for a Bearer token.
540	*
541	* @param false\|int $user_id User ID if one has been determined, false otherwise.
542	*
543	* @return false\|int\|\WP_Error
544	*/
545	private function authenticate( $user_id ) {
546	// check if there is an auth header.
547	$auth_header = $this->get_auth_header();
548	if ( ! \is_string( $auth_header ) ) {
549	return $user_id;
550	}
551
552	// Extract Bearer token from Authorization Header.
553	list($token) = sscanf( $auth_header, 'Bearer %s' );
554
555	if ( $token ) {
556	$auth_service = Auth::instance();
557	$decoded_token = $auth_service->validate_token( $token );
558
559	// Check if validate_token returned WP_Error and user_id is null.
560	if ( is_wp_error( $decoded_token ) && false === $user_id ) {
561	return $decoded_token;
562	}
563
564	// If the token is valid, set the user_id.
565	if ( ! is_wp_error( $decoded_token ) ) {
566	$user_id = $decoded_token->data->user->id;
567
568	return absint( $user_id );
569	}
570	}
571
572	return $user_id;
573	}
574	}
575