class-wc-helper-api.php — WooCommerce 10.9.4

woocommerce / includes / admin / helper / class-wc-helper-api.php

woocommerce / includes / admin / helper Last commit date

views 5 months ago class-wc-helper-admin.php 4 months ago class-wc-helper-api.php 1 year ago class-wc-helper-compat.php 5 years ago class-wc-helper-options.php 3 years ago class-wc-helper-orders-api.php 2 years ago class-wc-helper-sanitization.php 1 year ago class-wc-helper-subscriptions-api.php 4 months ago class-wc-helper-updater.php 2 months ago class-wc-helper.php 4 months ago class-wc-plugin-api-updater.php 1 year ago class-wc-product-usage-notice.php 1 year ago class-wc-woo-helper-connection.php 4 months ago class-wc-woo-update-manager-plugin.php 2 years ago

class-wc-helper-api.php

224 lines

1	<?php
2	/**
3	* WooCommerce Admin Helper API
4	*
5	* @package WooCommerce\Admin\Helper
6	*/
7
8	if ( ! defined( 'ABSPATH' ) ) {
9	exit;
10	}
11
12	/**
13	* WC_Helper_API Class
14	*
15	* Provides a communication interface with the WooCommerce.com Helper API.
16	*/
17	class WC_Helper_API {
18	/**
19	* Base path for API routes.
20	*
21	* @var $api_base
22	*/
23	public static $api_base;
24
25	/**
26	* Load
27	*
28	* Allow devs to point the API base to a local API development or staging server.
29	* Note that sslverify will be turned off for the woocommerce.dev + WP_DEBUG combination.
30	* The URL can be changed on plugins_loaded before priority 10.
31	*/
32	public static function load() {
33	self::$api_base = apply_filters( 'woocommerce_helper_api_base', 'https://woocommerce.com/wp-json/helper/1.0' );
34	}
35
36	/**
37	* Perform an HTTP request to the Helper API.
38	*
39	* @param string $endpoint The endpoint to request.
40	* @param array $args Additional data for the request. Set authenticated to a truthy value to enable auth.
41	*
42	* @return array\|WP_Error The response from wp_safe_remote_request()
43	*/
44	public static function request( $endpoint, $args = array() ) {
45	if ( ! isset( $args['query_string'] ) ) {
46	$args['query_string'] = '';
47	}
48	$url = self::url( $endpoint, $args['query_string'] );
49
50	if ( ! empty( $args['authenticated'] ) ) {
51	if ( ! self::_authenticate( $url, $args ) ) {
52	return new WP_Error( 'authentication', __( 'Authentication failed. Please try again after a few minutes. If the issue persists, disconnect your store from WooCommerce.com and reconnect.', 'woocommerce' ), 401 );
53	}
54	}
55
56	if ( ! isset( $args['user-agent'] ) ) {
57	$args['user-agent'] = 'WooCommerce/' . WC()->version . '; ' . get_bloginfo( 'url' );
58	}
59
60	/**
61	* Allow developers to filter the request args passed to wp_safe_remote_request().
62	* Useful to remove sslverify when working on a local api dev environment.
63	*/
64	$args = apply_filters( 'woocommerce_helper_api_request_args', $args, $endpoint );
65
66	// TODO: Check response signatures on certain endpoints.
67	return wp_safe_remote_request( $url, $args );
68	}
69
70	/**
71	* Create signature for a request.
72	*
73	* @param string $access_token_secret The access token secret.
74	* @param string $url The URL to add the access token and signature to.
75	* @param string $method The request method.
76	* @param array $body The body of the request.
77	* @return string The signature.
78	*/
79	private static function create_request_signature( string $access_token_secret, string $url, string $method, $body = null ): string {
80
81	$request_uri = wp_parse_url( $url, PHP_URL_PATH );
82	$query_string = wp_parse_url( $url, PHP_URL_QUERY );
83
84	if ( is_string( $query_string ) ) {
85	$request_uri .= '?' . $query_string;
86	}
87
88	$data = array(
89	'host' => wp_parse_url( $url, PHP_URL_HOST ),
90	'request_uri' => $request_uri,
91	'method' => $method,
92	);
93
94	if ( ! empty( $body ) ) {
95	$data['body'] = $body;
96	}
97
98	return hash_hmac( 'sha256', wp_json_encode( $data ), $access_token_secret );
99	}
100
101	/**
102	* Add the access token and signature to the provided URL.
103	*
104	* @param string $url The URL to add the access token and signature to.
105	* @return string
106	*/
107	public static function add_auth_parameters( string $url ): string {
108	$auth = WC_Helper_Options::get( 'auth' );
109
110	if ( empty( $auth['access_token'] ) \|\| empty( $auth['access_token_secret'] ) ) {
111	return false;
112	}
113
114	$signature = self::create_request_signature( (string) $auth['access_token_secret'], $url, 'GET' );
115
116	return add_query_arg(
117	array(
118	'token' => $auth['access_token'],
119	'signature' => $signature,
120	),
121	$url
122	);
123	}
124
125	/**
126	* Adds authentication headers to an HTTP request.
127	*
128	* @param string $url The request URI.
129	* @param array $args By-ref, the args that will be passed to wp_remote_request().
130	* @return bool Were the headers added?
131	*/
132	private static function _authenticate( &$url, &$args ) {
133	$auth = WC_Helper_Options::get( 'auth' );
134
135	if ( empty( $auth['access_token'] ) \|\| empty( $auth['access_token_secret'] ) ) {
136	return false;
137	}
138
139	$signature = self::create_request_signature(
140	(string) $auth['access_token_secret'],
141	$url,
142	! empty( $args['method'] ) ? $args['method'] : 'GET',
143	$args['body'] ?? null
144	);
145
146	if ( empty( $args['headers'] ) ) {
147	$args['headers'] = array();
148	}
149
150	$headers = array(
151	'Authorization' => 'Bearer ' . $auth['access_token'],
152	'X-Woo-Signature' => $signature,
153	);
154	$args['headers'] = wp_parse_args( $headers, $args['headers'] );
155
156	$url = add_query_arg(
157	array(
158	'token' => $auth['access_token'],
159	'signature' => $signature,
160	),
161	$url
162	);
163
164	return true;
165	}
166
167	/**
168	* Wrapper for self::request().
169	*
170	* @param string $endpoint The helper API endpoint to request.
171	* @param array $args Arguments passed to wp_remote_request().
172	*
173	* @return array The response object from wp_safe_remote_request().
174	*/
175	public static function get( $endpoint, $args = array() ) {
176	$args['method'] = 'GET';
177	return self::request( $endpoint, $args );
178	}
179
180	/**
181	* Wrapper for self::request().
182	*
183	* @param string $endpoint The helper API endpoint to request.
184	* @param array $args Arguments passed to wp_remote_request().
185	*
186	* @return array The response object from wp_safe_remote_request().
187	*/
188	public static function post( $endpoint, $args = array() ) {
189	$args['method'] = 'POST';
190	return self::request( $endpoint, $args );
191	}
192
193	/**
194	* Wrapper for self::request().
195	*
196	* @param string $endpoint The helper API endpoint to request.
197	* @param array $args Arguments passed to wp_remote_request().
198	*
199	* @return array The response object from wp_safe_remote_request().
200	*/
201	public static function put( $endpoint, $args = array() ) {
202	$args['method'] = 'PUT';
203	return self::request( $endpoint, $args );
204	}
205
206	/**
207	* Using the API base, form a request URL from a given endpoint.
208	*
209	* @param string $endpoint The endpoint to request.
210	* @param string $query_string Optional query string to append to the URL.
211	*
212	* @return string The absolute endpoint URL.
213	*/
214	public static function url( $endpoint, $query_string = '' ) {
215	$endpoint = ltrim( $endpoint, '/' );
216	$endpoint = sprintf( '%s/%s/%s', self::$api_base, $endpoint, $query_string );
217	$endpoint = esc_url_raw( $endpoint );
218	$endpoint = rtrim( $endpoint, '/' );
219	return $endpoint;
220	}
221	}
222
223	WC_Helper_API::load();
224