SessionHandler.php — WooCommerce 10.9.1

woocommerce / src / StoreApi / SessionHandler.php

woocommerce / src / StoreApi Last commit date

Exceptions 2 years ago Formatters 1 year ago Payments 4 months ago Routes 4 weeks ago Schemas 4 weeks ago Utilities 4 weeks ago Authentication.php 4 months ago Formatters.php 2 years ago Legacy.php 1 year ago RoutesController.php 4 weeks ago SchemaController.php 4 weeks ago SessionHandler.php 3 months ago StoreApi.php 4 months ago deprecated.php 2 years ago functions.php 2 years ago

SessionHandler.php

201 lines

1	<?php
2	declare(strict_types=1);
3
4	namespace Automattic\WooCommerce\StoreApi;
5
6	use Automattic\Jetpack\Constants;
7	use Automattic\WooCommerce\StoreApi\Utilities\CartTokenUtils;
8	use WC_Session;
9	defined( 'ABSPATH' ) \|\| exit;
10
11	/**
12	* SessionHandler class
13	*
14	* Token-based session handler for the Store API. Unlike WC_Session_Handler which
15	* uses browser cookies, this handler uses an HTTP_CART_TOKEN header (JWT-like) to
16	* identify sessions. It shares the same database table but has no cookie, cron,
17	* or cache layer.
18	*
19	* @since 10.7.0
20	*/
21	final class SessionHandler extends WC_Session {
22	/**
23	* Token from HTTP headers.
24	*
25	* @var string
26	*/
27	protected $token = '';
28
29	/**
30	* Table name for session data.
31	*
32	* @var string Custom session table name
33	*/
34	protected $table = '';
35
36	/**
37	* Expiration timestamp.
38	*
39	* @var int
40	*/
41	protected $session_expiration = 0;
42
43	/**
44	* Constructor for the session class.
45	*/
46	public function __construct() {
47	$this->token = wc_clean( wp_unslash( $_SERVER['HTTP_CART_TOKEN'] ?? '' ) );
48	$this->table = $GLOBALS['wpdb']->prefix . 'woocommerce_sessions';
49	}
50
51	/**
52	* Init hooks and session data.
53	*/
54	public function init() {
55	$this->init_session_from_token();
56	add_action( 'shutdown', array( $this, 'save_data' ), 20 );
57	}
58
59	/**
60	* Process the token header to load the correct session.
61	*/
62	protected function init_session_from_token() {
63	$payload = CartTokenUtils::get_cart_token_payload( $this->token );
64
65	$this->_customer_id = $payload['user_id'];
66	$this->session_expiration = $payload['exp'];
67	$this->_data = (array) $this->get_session( $this->get_customer_id(), array() );
68	}
69
70	/**
71	* Return true if the current user has an active session.
72	*
73	* @return bool
74	*/
75	public function has_session() {
76	return ! empty( $this->_customer_id );
77	}
78
79	/**
80	* Generate a unique customer ID for guests, or return user ID if logged in.
81	*
82	* @return string
83	*/
84	public function generate_customer_id() {
85	return is_user_logged_in() ? (string) get_current_user_id() : wc_rand_hash( 't_', 30 );
86	}
87
88	/**
89	* Get session unique ID for requests if session is initialized or user ID if logged in.
90	*
91	* @return string
92	*/
93	public function get_customer_unique_id() {
94	if ( $this->has_session() && $this->get_customer_id() ) {
95	return $this->get_customer_id();
96	}
97	return is_user_logged_in() ? (string) get_current_user_id() : '';
98	}
99
100	/**
101	* Get session data fresh from storage.
102	*
103	* This re-reads session data from the database rather than returning
104	* in-memory data, ensuring the latest persisted state is returned.
105	*
106	* @return array
107	*/
108	public function get_session_data() {
109	return $this->has_session() ? (array) $this->get_session( $this->get_customer_id(), array() ) : array();
110	}
111
112	/**
113	* Returns the session.
114	*
115	* @param string $customer_id Customer ID.
116	* @param mixed $default_value Default session value.
117	*
118	* @return mixed Returns either the session data or the default value. Returns false if WP setup is in progress.
119	*/
120	public function get_session( $customer_id, $default_value = false ) {
121	global $wpdb;
122
123	// This mimics behaviour from default WC_Session_Handler class. There will be no sessions retrieved while WP setup is due.
124	if ( Constants::is_defined( 'WP_SETUP_CONFIG' ) ) {
125	return $default_value;
126	}
127
128	$value = $wpdb->get_var(
129	$wpdb->prepare(
130	'SELECT session_value FROM %i WHERE session_key = %s',
131	$this->table,
132	$customer_id
133	)
134	);
135
136	if ( is_null( $value ) ) {
137	$value = $default_value;
138	}
139
140	return maybe_unserialize( $value );
141	}
142
143	/**
144	* Destroy all session data.
145	*
146	* @return void
147	*/
148	public function destroy_session() {
149	$this->delete_session( $this->get_customer_id() );
150	$this->forget_session();
151	}
152
153	/**
154	* Forget all session data without destroying persisted storage.
155	*
156	* @return void
157	*/
158	public function forget_session() {
159	$this->_data = array();
160	$this->_dirty = false;
161	$this->_customer_id = null;
162	}
163
164	/**
165	* Delete the session from the database.
166	*
167	* @param string $customer_id Customer session ID.
168	* @return void
169	*/
170	public function delete_session( $customer_id ) {
171	if ( ! $customer_id ) {
172	return;
173	}
174	$GLOBALS['wpdb']->delete( $this->table, array( 'session_key' => $customer_id ) );
175	}
176
177	/**
178	* Save data and delete user session.
179	*
180	* @return void
181	*/
182	public function save_data() {
183	// Dirty if something changed - prevents saving nothing new.
184	if ( $this->_dirty ) {
185	global $wpdb;
186
187	$wpdb->query(
188	$wpdb->prepare(
189	'INSERT INTO %i (`session_key`, `session_value`, `session_expiry`) VALUES (%s, %s, %d) ON DUPLICATE KEY UPDATE `session_value` = VALUES(`session_value`), `session_expiry` = VALUES(`session_expiry`)',
190	$this->table,
191	$this->get_customer_id(),
192	maybe_serialize( $this->_data ),
193	$this->session_expiration
194	)
195	);
196
197	$this->_dirty = false;
198	}
199	}
200	}
201