SessionHandler.php — WooCommerce 11.1.0

woocommerce / src / StoreApi / SessionHandler.php

woocommerce / src / StoreApi Last commit date

Exceptions 2 weeks ago Formatters 1 month ago Payments 6 months ago Routes 2 weeks ago Schemas 2 weeks ago Utilities 2 weeks ago Authentication.php 3 weeks ago Formatters.php 2 years ago Legacy.php 1 year ago RoutesController.php 2 months ago SchemaController.php 2 months ago SessionHandler.php 3 weeks ago StoreApi.php 6 months ago deprecated.php 2 years ago functions.php 2 years ago

SessionHandler.php

210 lines

1	<?php
2	declare(strict_types=1);
3
4	namespace Automattic\WooCommerce\StoreApi;
5
6	use Automattic\Jetpack\Constants;
7	use Automattic\WooCommerce\StoreApi\Utilities\CartTokenUtils;
8	use WC_Session;
9	defined( 'ABSPATH' ) \|\| exit;
10
11	/**
12	* SessionHandler class
13	*
14	* Token-based session handler for the Store API. Unlike WC_Session_Handler which
15	* uses browser cookies, this handler uses an HTTP_CART_TOKEN header (JWT-like) to
16	* identify sessions. It shares the same database table but has no cookie, cron,
17	* or cache layer.
18	*
19	* @since 10.7.0
20	*/
21	final class SessionHandler extends WC_Session {
22	/**
23	* Token from HTTP headers.
24	*
25	* @var string
26	*/
27	protected $token = '';
28
29	/**
30	* Table name for session data.
31	*
32	* @var string Custom session table name
33	*/
34	protected $table = '';
35
36	/**
37	* Expiration timestamp.
38	*
39	* @var int
40	*/
41	protected $session_expiration = 0;
42
43	/**
44	* Constructor for the session class.
45	*/
46	public function __construct() {
47	$this->token = CartTokenUtils::get_request_cart_token();
48	$this->table = $GLOBALS['wpdb']->prefix . 'woocommerce_sessions';
49	}
50
51	/**
52	* Init hooks and session data.
53	*/
54	public function init() {
55	$this->init_session_from_token();
56	add_action( 'shutdown', array( $this, 'save_data' ), 20 );
57	}
58
59	/**
60	* Process the token header to load the correct session.
61	*
62	* Verifies the signature here rather than trusting the caller that selected this handler.
63	*/
64	protected function init_session_from_token() {
65	if ( ! CartTokenUtils::validate_cart_token( $this->token ) ) {
66	$this->_customer_id = $this->generate_customer_id();
67	$this->session_expiration = CartTokenUtils::get_cart_token_expiration();
68	$this->_data = array();
69	return;
70	}
71
72	$payload = CartTokenUtils::get_cart_token_payload( $this->token );
73
74	$this->_customer_id = $payload['user_id'];
75	$this->session_expiration = $payload['exp'];
76	$this->_data = (array) $this->get_session( $this->get_customer_id(), array() );
77	}
78
79	/**
80	* Return true if the current user has an active session.
81	*
82	* @return bool
83	*/
84	public function has_session() {
85	return ! empty( $this->_customer_id );
86	}
87
88	/**
89	* Generate a unique customer ID for guests, or return user ID if logged in.
90	*
91	* @return string
92	*/
93	public function generate_customer_id() {
94	return is_user_logged_in() ? (string) get_current_user_id() : wc_rand_hash( 't_', 30 );
95	}
96
97	/**
98	* Get session unique ID for requests if session is initialized or user ID if logged in.
99	*
100	* @return string
101	*/
102	public function get_customer_unique_id() {
103	if ( $this->has_session() && $this->get_customer_id() ) {
104	return $this->get_customer_id();
105	}
106	return is_user_logged_in() ? (string) get_current_user_id() : '';
107	}
108
109	/**
110	* Get session data fresh from storage.
111	*
112	* This re-reads session data from the database rather than returning
113	* in-memory data, ensuring the latest persisted state is returned.
114	*
115	* @return array
116	*/
117	public function get_session_data() {
118	return $this->has_session() ? (array) $this->get_session( $this->get_customer_id(), array() ) : array();
119	}
120
121	/**
122	* Returns the session.
123	*
124	* @param string $customer_id Customer ID.
125	* @param mixed $default_value Default session value.
126	*
127	* @return mixed Returns either the session data or the default value. Returns false if WP setup is in progress.
128	*/
129	public function get_session( $customer_id, $default_value = false ) {
130	global $wpdb;
131
132	// This mimics behaviour from default WC_Session_Handler class. There will be no sessions retrieved while WP setup is due.
133	if ( Constants::is_defined( 'WP_SETUP_CONFIG' ) ) {
134	return $default_value;
135	}
136
137	$value = $wpdb->get_var(
138	$wpdb->prepare(
139	'SELECT session_value FROM %i WHERE session_key = %s',
140	$this->table,
141	$customer_id
142	)
143	);
144
145	if ( is_null( $value ) ) {
146	$value = $default_value;
147	}
148
149	return maybe_unserialize( $value );
150	}
151
152	/**
153	* Destroy all session data.
154	*
155	* @return void
156	*/
157	public function destroy_session() {
158	$this->delete_session( $this->get_customer_id() );
159	$this->forget_session();
160	}
161
162	/**
163	* Forget all session data without destroying persisted storage.
164	*
165	* @return void
166	*/
167	public function forget_session() {
168	$this->_data = array();
169	$this->_dirty = false;
170	$this->_customer_id = null;
171	}
172
173	/**
174	* Delete the session from the database.
175	*
176	* @param string $customer_id Customer session ID.
177	* @return void
178	*/
179	public function delete_session( $customer_id ) {
180	if ( ! $customer_id ) {
181	return;
182	}
183	$GLOBALS['wpdb']->delete( $this->table, array( 'session_key' => $customer_id ) );
184	}
185
186	/**
187	* Save data and delete user session.
188	*
189	* @return void
190	*/
191	public function save_data() {
192	// Dirty if something changed - prevents saving nothing new.
193	if ( $this->_dirty ) {
194	global $wpdb;
195
196	$wpdb->query(
197	$wpdb->prepare(
198	'INSERT INTO %i (`session_key`, `session_value`, `session_expiry`) VALUES (%s, %s, %d) ON DUPLICATE KEY UPDATE `session_value` = VALUES(`session_value`), `session_expiry` = VALUES(`session_expiry`)',
199	$this->table,
200	$this->get_customer_id(),
201	maybe_serialize( $this->_data ),
202	$this->session_expiration
203	)
204	);
205
206	$this->_dirty = false;
207	}
208	}
209	}
210