wordpress-seo / vendor / wordproof / wordpress-sdk / app / Controllers / RestApiController.php

RestApiController.php in Yoast SEO – Advanced SEO with real-time guidance and built-in AI 18.4, at vendor/wordproof/wordpress-sdk/app/Controllers/RestApiController.php

287 lines 9.2 KB

Raw Download Zip

1	<?php
2
3	namespace WordProof\SDK\Controllers;
4
5	use WordProof\SDK\Helpers\OptionsHelper;
6	use WordProof\SDK\Helpers\RestApiHelper;
7	use WordProof\SDK\Helpers\PostMetaHelper;
8	use WordProof\SDK\Helpers\SchemaHelper;
9	use WordProof\SDK\Helpers\SettingsHelper;
10	use WordProof\SDK\Helpers\AuthenticationHelper;
11	use WordProof\SDK\Helpers\StringHelper;
12	use WordProof\SDK\Support\Authentication;
13
14	class RestApiController
15	{
16	/**
17	* Registers the rest api endpoints.
18	*
19	* @action rest_api_init
20	* @throws \Exception
21	*/
22	public function init()
23	{
24	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('authenticate'), [
25	'methods' => 'POST',
26	'callback' => [$this, 'authenticate'],
27	'permission_callback' => [$this, 'canPublishPermission']
28	]);
29
30	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('webhook'), [
31	'methods' => 'POST',
32	'callback' => [$this, 'webhook'],
33	'permission_callback' => [$this, 'isValidWebhookRequest']
34	]);
35
36	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('hashInput'), [
37	'methods' => 'GET',
38	'callback' => [$this, 'hashInput'],
39	'permission_callback' => function () {
40	return true;
41	},
42	]);
43
44	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('timestamp'), [
45	'methods' => 'POST',
46	'callback' => [$this, 'timestamp'],
47	'permission_callback' => [$this, 'canPublishPermission'],
48	]);
49
50	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('timestamp.transaction.latest'), [
51	'methods' => 'GET',
52	'callback' => [$this, 'showLatestTimestampTransaction'],
53	'permission_callback' => [$this, 'canPublishPermission'],
54	]);
55
56	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('settings'), [
57	'methods' => 'GET',
58	'callback' => [$this, 'settings'],
59	'permission_callback' => [$this, 'canPublishPermission'],
60	]);
61
62	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('saveSettings'), [
63	'methods' => 'POST',
64	'callback' => [$this, 'saveSettings'],
65	'permission_callback' => [$this, 'canPublishPermission'],
66	]);
67
68	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('authentication'), [
69	'methods' => 'GET',
70	'callback' => [$this, 'authentication'],
71	'permission_callback' => [$this, 'canPublishPermission'],
72	]);
73
74	register_rest_route(RestApiHelper::getNamespace(), RestApiHelper::endpoint('authentication.destroy'), [
75	'methods' => 'POST',
76	'callback' => [$this, 'destroyAuthentication'],
77	'permission_callback' => [$this, 'canPublishPermission'],
78	]);
79	}
80
81	/**
82	* Returns an object containing the settings.
83	*
84	* @return \WP_REST_Response Returns the settings.
85	*/
86	public function settings()
87	{
88	$data = SettingsHelper::get();
89	$data->status = 200;
90
91	return new \WP_REST_Response($data, $data->status);
92	}
93
94	/**
95	* Save the settings.
96	*
97	* @return \WP_REST_Response Returns the settings.
98	*/
99	public function saveSettings(\WP_REST_Request $request)
100	{
101	$data = $request->get_params();
102
103	$settings = $data['settings'];
104	$snakeCaseSettings = [];
105	foreach ($settings as $key=> $value) {
106	$key = StringHelper::toUnderscore($key);
107	$snakeCaseSettings[$key] = $value;
108	}
109
110	OptionsHelper::set('settings', $snakeCaseSettings);
111
112	$data = (object)[];
113	$data->status = 200;
114
115	return new \WP_REST_Response($data, $data->status);
116	}
117
118	/**
119	* Returns if the user is authenticated.
120	*
121	* @return \WP_REST_Response Returns if the user is authenticated.
122	*/
123	public function authentication()
124	{
125	$data = (object)[
126	'is_authenticated' => AuthenticationHelper::isAuthenticated(),
127	'status' => 200
128	];
129
130	return new \WP_REST_Response($data, $data->status);
131	}
132
133	/**
134	* Logout the user and return if the user is authenticated.
135	*
136	* @return \WP_REST_Response Returns if the user is authenticated.
137	*/
138	public function destroyAuthentication()
139	{
140	AuthenticationHelper::logout();
141
142	return $this->authentication();
143	}
144
145	/**
146	* Send a post request to WordProof to timestamp a post.
147	*
148	* @param \WP_REST_Request $request The Rest Request.
149	* @return bool\|void Returns if the request was successful.
150	*/
151	public function timestamp(\WP_REST_Request $request)
152	{
153	$data = $request->get_params();
154	$postId = intval($data['id']);
155
156	return TimestampController::timestamp($postId);
157	}
158
159	public function showLatestTimestampTransaction(\WP_REST_Request $request)
160	{
161	$data = $request->get_params();
162	$postId = intval($data['id']);
163
164	$transactions = PostMetaHelper::get($postId, '_wordproof_blockchain_transaction', false);
165	$transaction = array_pop($transactions);
166
167	return new \WP_REST_Response((object)$transaction);
168	}
169
170	/**
171	* Returns the hash input of a post.
172	*
173	* @param \WP_REST_Request $request The Rest Request.
174	* @return \WP_REST_Response The hash input of a post.
175	*/
176	public function hashInput(\WP_REST_Request $request)
177	{
178	$data = $request->get_params();
179
180	$postId = intval($data['id']);
181	$hash = sanitize_text_field($data['hash']);
182
183	$hashInput = PostMetaHelper::get($postId, '_wordproof_hash_input_' . $hash);
184
185	return new \WP_REST_Response((object)$hashInput);
186	}
187
188	/**
189	* Retrieves the access token when the code and state are retrieved in the frontend.
190	*
191	* @throws \Exception
192	*/
193	public function authenticate(\WP_REST_Request $request)
194	{
195	$state = sanitize_text_field($request->get_param('state'));
196	$code = sanitize_text_field($request->get_param('code'));
197
198	return Authentication::token($state, $code);
199	}
200
201	/**
202	* Handles webhooks sent by WordProof.
203	*
204	* @param \WP_REST_Request $request The Rest Request.
205	* @return bool\|null\|\WP_REST_Response\|void The value returned by the action undertaken.
206	*
207	* TODO: Improve
208	*/
209	public function webhook(\WP_REST_Request $request)
210	{
211	$response = json_decode($request->get_body());
212
213	/**
214	* Handle webhooks with type and data
215	*/
216	if (isset($response->type) && isset($response->data)) {
217	switch ($response->type) {
218	case 'source_settings':
219	return OptionsHelper::set('settings', $response->data);
220	case 'ping':
221	$data = (object)['status' => 200, 'source_id' => OptionsHelper::sourceId()];
222	return new \WP_REST_Response($data, $data->status);
223	case 'logout':
224	AuthenticationHelper::logout();
225	break;
226	case 'dump_item':
227
228	$key = '_wordproof_hash_input_' . $response->data->hash;
229	PostMetaHelper::update($response->data->uid, $key, json_decode($response->data->hash_input));
230
231	$this->setBlockchainTransaction($response->data);
232
233	break;
234	default:
235	break;
236	}
237	}
238
239	/**
240	* Handle timestamping webhooks without type
241	*/
242	if (isset($response->uid) && isset($response->schema)) {
243	$this->setBlockchainTransaction($response);
244	}
245	}
246
247	/**
248	* @param $response
249	*
250	* TODO: Improve
251	*/
252	private function setBlockchainTransaction($response)
253	{
254	$postId = intval($response->uid);
255
256	$blockchainTransaction = SchemaHelper::getBlockchainTransaction($response);
257	PostMetaHelper::add($postId, '_wordproof_blockchain_transaction', $blockchainTransaction);
258
259	$schema = SchemaHelper::getSchema($postId);
260	PostMetaHelper::update($postId, '_wordproof_schema', $schema);
261	}
262
263	/**
264	* Checks if the user has permission to publish a post.
265	*
266	* @return bool Returns if a user has permission to publish.
267	*/
268	public function canPublishPermission()
269	{
270	return current_user_can('publish_posts') && current_user_can('publish_pages');
271	}
272
273	/**
274	* Validates if the webhook is valid and signed with the correct secret.
275	*
276	* @param \WP_REST_Request $request The Rest Request.
277	* @return bool If the webhook can be accepted.
278	*/
279	public static function isValidWebhookRequest(\WP_REST_Request $request)
280	{
281	$hashedToken = hash('sha256', OptionsHelper::accessToken());
282	$hmac = hash_hmac('sha256', $request->get_body(), $hashedToken);
283
284	return $request->get_header('signature') === $hmac;
285	}
286	}
287