296 lines
8.5 KiB
PHP
296 lines
8.5 KiB
PHP
<?php
|
|
/**
|
|
* Identity_Crisis package.
|
|
*
|
|
* @package automattic/jetpack-identity-crisis
|
|
*/
|
|
|
|
namespace Automattic\Jetpack\IdentityCrisis;
|
|
|
|
use Automattic\Jetpack\Connection\Manager as Connection_Manager;
|
|
use Automattic\Jetpack\Connection\Rest_Authentication;
|
|
use Jetpack_Options;
|
|
use WP_Error;
|
|
use WP_REST_Server;
|
|
|
|
/**
|
|
* This class will handle Identity Crisis Endpoints
|
|
*
|
|
* @since 0.2.0
|
|
*/
|
|
class REST_Endpoints {
|
|
|
|
/**
|
|
* Initialize REST routes.
|
|
*/
|
|
public static function initialize_rest_api() {
|
|
|
|
// Confirm that a site in identity crisis should be in staging mode.
|
|
register_rest_route(
|
|
'jetpack/v4',
|
|
'/identity-crisis/confirm-safe-mode',
|
|
array(
|
|
'methods' => WP_REST_Server::EDITABLE,
|
|
'callback' => __CLASS__ . '::confirm_safe_mode',
|
|
'permission_callback' => __CLASS__ . '::identity_crisis_mitigation_permission_check',
|
|
)
|
|
);
|
|
|
|
// Handles the request to migrate stats and subscribers during an identity crisis.
|
|
register_rest_route(
|
|
'jetpack/v4',
|
|
'identity-crisis/migrate',
|
|
array(
|
|
'methods' => WP_REST_Server::EDITABLE,
|
|
'callback' => __CLASS__ . '::migrate_stats_and_subscribers',
|
|
'permission_callback' => __CLASS__ . '::identity_crisis_mitigation_permission_check',
|
|
)
|
|
);
|
|
|
|
// IDC resolve: create an entirely new shadow site for this URL.
|
|
register_rest_route(
|
|
'jetpack/v4',
|
|
'/identity-crisis/start-fresh',
|
|
array(
|
|
'methods' => WP_REST_Server::EDITABLE,
|
|
'callback' => __CLASS__ . '::start_fresh_connection',
|
|
'permission_callback' => __CLASS__ . '::identity_crisis_mitigation_permission_check',
|
|
'args' => array(
|
|
'redirect_uri' => array(
|
|
'description' => __( 'URI of the admin page where the user should be redirected after connection flow', 'jetpack-idc' ),
|
|
'type' => 'string',
|
|
),
|
|
),
|
|
)
|
|
);
|
|
|
|
// Fetch URL verification secret.
|
|
register_rest_route(
|
|
'jetpack/v4',
|
|
'/identity-crisis/url-secret',
|
|
array(
|
|
'methods' => WP_REST_Server::READABLE,
|
|
'callback' => array( static::class, 'fetch_url_secret' ),
|
|
'permission_callback' => array( static::class, 'url_secret_permission_check' ),
|
|
)
|
|
);
|
|
|
|
// Fetch URL verification secret.
|
|
register_rest_route(
|
|
'jetpack/v4',
|
|
'/identity-crisis/compare-url-secret',
|
|
array(
|
|
'methods' => WP_REST_Server::EDITABLE,
|
|
'callback' => array( static::class, 'compare_url_secret' ),
|
|
'permission_callback' => array( static::class, 'compare_url_secret_permission_check' ),
|
|
'args' => array(
|
|
'secret' => array(
|
|
'description' => __( 'URL secret to compare to the ones stored in the database.', 'jetpack-idc' ),
|
|
'type' => 'string',
|
|
'required' => true,
|
|
),
|
|
),
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Handles identity crisis mitigation, confirming safe mode for this site.
|
|
*
|
|
* @since 0.2.0
|
|
* @since-jetpack 4.4.0
|
|
*
|
|
* @return bool | WP_Error True if option is properly set.
|
|
*/
|
|
public static function confirm_safe_mode() {
|
|
$updated = Jetpack_Options::update_option( 'safe_mode_confirmed', true );
|
|
if ( $updated ) {
|
|
return rest_ensure_response(
|
|
array(
|
|
'code' => 'success',
|
|
)
|
|
);
|
|
}
|
|
|
|
return new WP_Error(
|
|
'error_setting_jetpack_safe_mode',
|
|
esc_html__( 'Could not confirm safe mode.', 'jetpack-idc' ),
|
|
array( 'status' => 500 )
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Handles identity crisis mitigation, migrating stats and subscribers from old url to this, new url.
|
|
*
|
|
* @since 0.2.0
|
|
* @since-jetpack 4.4.0
|
|
*
|
|
* @return bool | WP_Error True if option is properly set.
|
|
*/
|
|
public static function migrate_stats_and_subscribers() {
|
|
if ( Jetpack_Options::get_option( 'sync_error_idc' ) && ! Jetpack_Options::delete_option( 'sync_error_idc' ) ) {
|
|
return new WP_Error(
|
|
'error_deleting_sync_error_idc',
|
|
esc_html__( 'Could not delete sync error option.', 'jetpack-idc' ),
|
|
array( 'status' => 500 )
|
|
);
|
|
}
|
|
|
|
if ( Jetpack_Options::get_option( 'migrate_for_idc' ) || Jetpack_Options::update_option( 'migrate_for_idc', true ) ) {
|
|
return rest_ensure_response(
|
|
array(
|
|
'code' => 'success',
|
|
)
|
|
);
|
|
}
|
|
return new WP_Error(
|
|
'error_setting_jetpack_migrate',
|
|
esc_html__( 'Could not confirm migration.', 'jetpack-idc' ),
|
|
array( 'status' => 500 )
|
|
);
|
|
}
|
|
|
|
/**
|
|
* This IDC resolution will disconnect the site and re-connect to a completely new
|
|
* and separate shadow site than the original.
|
|
*
|
|
* It will first will disconnect the site without phoning home as to not disturb the production site.
|
|
* It then builds a fresh connection URL and sends it back along with the response.
|
|
*
|
|
* @since 0.2.0
|
|
* @since-jetpack 4.4.0
|
|
*
|
|
* @param \WP_REST_Request $request The request sent to the WP REST API.
|
|
*
|
|
* @return \WP_REST_Response|WP_Error
|
|
*/
|
|
public static function start_fresh_connection( $request ) {
|
|
/**
|
|
* Fires when Users have requested through Identity Crisis for the connection to be reset.
|
|
* Should be used to disconnect any connections and reset options.
|
|
*
|
|
* @since 0.2.0
|
|
*/
|
|
do_action( 'jetpack_idc_disconnect' );
|
|
|
|
$connection = new Connection_Manager();
|
|
$result = $connection->try_registration( true );
|
|
|
|
// early return if site registration fails.
|
|
if ( ! $result || is_wp_error( $result ) ) {
|
|
return rest_ensure_response( $result );
|
|
}
|
|
|
|
$redirect_uri = $request->get_param( 'redirect_uri' ) ? admin_url( $request->get_param( 'redirect_uri' ) ) : null;
|
|
|
|
/**
|
|
* Filters the connection url that users should be redirected to for re-establishing their connection.
|
|
*
|
|
* @since 0.2.0
|
|
*
|
|
* @param \WP_REST_Response|WP_Error $connection_url Connection URL user should be redirected to.
|
|
*/
|
|
return apply_filters( 'jetpack_idc_authorization_url', rest_ensure_response( $connection->get_authorization_url( null, $redirect_uri ) ) );
|
|
}
|
|
|
|
/**
|
|
* Verify that user can mitigate an identity crisis.
|
|
*
|
|
* @since 0.2.0
|
|
* @since-jetpack 4.4.0
|
|
*
|
|
* @return true|WP_Error True if the user has capability 'jetpack_disconnect', an error object otherwise.
|
|
*/
|
|
public static function identity_crisis_mitigation_permission_check() {
|
|
if ( current_user_can( 'jetpack_disconnect' ) ) {
|
|
return true;
|
|
}
|
|
$error_msg = esc_html__(
|
|
'You do not have the correct user permissions to perform this action.
|
|
Please contact your site admin if you think this is a mistake.',
|
|
'jetpack-idc'
|
|
);
|
|
|
|
return new WP_Error( 'invalid_user_permission_identity_crisis', $error_msg, array( 'status' => rest_authorization_required_code() ) );
|
|
}
|
|
|
|
/**
|
|
* Endpoint for fetching the existing secret.
|
|
*
|
|
* @return WP_Error|\WP_REST_Response
|
|
*/
|
|
public static function fetch_url_secret() {
|
|
$secret = new URL_Secret();
|
|
|
|
if ( ! $secret->exists() ) {
|
|
return new WP_Error( 'missing_url_secret', esc_html__( 'URL secret does not exist.', 'jetpack-idc' ) );
|
|
}
|
|
|
|
return rest_ensure_response(
|
|
array(
|
|
'code' => 'success',
|
|
'data' => array(
|
|
'secret' => $secret->get_secret(),
|
|
'expires_at' => $secret->get_expires_at(),
|
|
),
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Endpoint for comparing the existing secret.
|
|
*
|
|
* @param \WP_REST_Request $request The request sent to the WP REST API.
|
|
*
|
|
* @return WP_Error|\WP_REST_Response
|
|
*/
|
|
public static function compare_url_secret( $request ) {
|
|
$match = false;
|
|
|
|
$storage = new URL_Secret();
|
|
|
|
if ( $storage->exists() ) {
|
|
$remote_secret = $request->get_param( 'secret' );
|
|
$match = $remote_secret && hash_equals( $storage->get_secret(), $remote_secret );
|
|
}
|
|
|
|
return rest_ensure_response(
|
|
array(
|
|
'code' => 'success',
|
|
'match' => $match,
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Verify url_secret create/fetch permissions (valid blog token authentication).
|
|
*
|
|
* @return true|WP_Error
|
|
*/
|
|
public static function url_secret_permission_check() {
|
|
return Rest_Authentication::is_signed_with_blog_token()
|
|
? true
|
|
: new WP_Error(
|
|
'invalid_user_permission_identity_crisis',
|
|
esc_html__( 'You do not have the correct user permissions to perform this action.', 'jetpack-idc' ),
|
|
array( 'status' => rest_authorization_required_code() )
|
|
);
|
|
}
|
|
|
|
/**
|
|
* The endpoint is only available on non-connected sites.
|
|
* use `/identity-crisis/url-secret` for connected sites.
|
|
*
|
|
* @return true|WP_Error
|
|
*/
|
|
public static function compare_url_secret_permission_check() {
|
|
return ( new Connection_Manager() )->is_connected()
|
|
? new WP_Error(
|
|
'invalid_connection_status',
|
|
esc_html__( 'The endpoint is not available on connected sites.', 'jetpack-idc' ),
|
|
array( 'status' => 403 )
|
|
)
|
|
: true;
|
|
}
|
|
}
|