<?php

/**

 * REST API: WP_REST_Attachments_Controller class

 *

 * @package WordPress

 * @subpackage REST_API

 * @since 4.7.0

 */

/**

 * Core controller used to access attachments via the REST API.

 *

 * @since 4.7.0

 *

 * @see WP_REST_Posts_Controller

 */

class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {

	/**

	 * Whether the controller supports batching.

	 *

	 * @since 5.9.0

	 * @var false

	 */

	protected $allow_batch = false;

	/**

	 * Registers the routes for attachments.

	 *

	 * @since 5.3.0

	 *

	 * @see register_rest_route()

	 */

	public function register_routes() {

		parent::register_routes();

		register_rest_route(

			$this->namespace,

			'/' . $this->rest_base . '/(?P<id>[\d]+)/post-process',

			array(

				'methods'             => WP_REST_Server::CREATABLE,

				'callback'            => array( $this, 'post_process_item' ),

				'permission_callback' => array( $this, 'post_process_item_permissions_check' ),

				'args'                => array(

					'id'     => array(

						'description' => __( 'Unique identifier for the attachment.' ),

						'type'        => 'integer',

					),

					'action' => array(

						'type'     => 'string',

						'enum'     => array( 'create-image-subsizes' ),

						'required' => true,

					),

				),

			)

		);

		register_rest_route(

			$this->namespace,

			'/' . $this->rest_base . '/(?P<id>[\d]+)/edit',

			array(

				'methods'             => WP_REST_Server::CREATABLE,

				'callback'            => array( $this, 'edit_media_item' ),

				'permission_callback' => array( $this, 'edit_media_item_permissions_check' ),

				'args'                => $this->get_edit_media_item_args(),

			)

		);

	}

	/**

	 * Determines the allowed query_vars for a get_items() response and

	 * prepares for WP_Query.

	 *

	 * @since 4.7.0

	 *

	 * @param array           $prepared_args Optional. Array of prepared arguments. Default empty array.

	 * @param WP_REST_Request $request       Optional. Request to prepare items for.

	 * @return array Array of query arguments.

	 */

	protected function prepare_items_query( $prepared_args = array(), $request = null ) {

		$query_args = parent::prepare_items_query( $prepared_args, $request );

		if ( empty( $query_args['post_status'] ) ) {

			$query_args['post_status'] = 'inherit';

		}

		$media_types = $this->get_media_types();

		if ( ! empty( $request['media_type'] ) && isset( $media_types[ $request['media_type'] ] ) ) {

			$query_args['post_mime_type'] = $media_types[ $request['media_type'] ];

		}

		if ( ! empty( $request['mime_type'] ) ) {

			$parts = explode( '/', $request['mime_type'] );

			if ( isset( $media_types[ $parts[0] ] ) && in_array( $request['mime_type'], $media_types[ $parts[0] ], true ) ) {

				$query_args['post_mime_type'] = $request['mime_type'];

			}

		}

		// Filter query clauses to include filenames.

		if ( isset( $query_args['s'] ) ) {

			add_filter( 'wp_allow_query_attachment_by_filename', '__return_true' );

		}

		return $query_args;

	}

	/**

	 * Checks if a given request has access to create an attachment.

	 *

	 * @since 4.7.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return true|WP_Error Boolean true if the attachment may be created, or a WP_Error if not.

	 */

	public function create_item_permissions_check( $request ) {

		$ret = parent::create_item_permissions_check( $request );

		if ( ! $ret || is_wp_error( $ret ) ) {

			return $ret;

		}

		if ( ! current_user_can( 'upload_files' ) ) {

			return new WP_Error(

				'rest_cannot_create',

				__( 'Sorry, you are not allowed to upload media on this site.' ),

				array( 'status' => 400 )

			);

		}

		// Attaching media to a post requires ability to edit said post.

		if ( ! empty( $request['post'] ) && ! current_user_can( 'edit_post', (int) $request['post'] ) ) {

			return new WP_Error(

				'rest_cannot_edit',

				__( 'Sorry, you are not allowed to upload media to this post.' ),

				array( 'status' => rest_authorization_required_code() )

			);

		}

		return true;

	}

	/**

	 * Creates a single attachment.

	 *

	 * @since 4.7.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return WP_REST_Response|WP_Error Response object on success, WP_Error object on failure.

	 */

	public function create_item( $request ) {

		if ( ! empty( $request['post'] ) && in_array( get_post_type( $request['post'] ), array( 'revision', 'attachment' ), true ) ) {

			return new WP_Error(

				'rest_invalid_param',

				__( 'Invalid parent type.' ),

				array( 'status' => 400 )

			);

		}

		$insert = $this->insert_attachment( $request );

		if ( is_wp_error( $insert ) ) {

			return $insert;

		}

		$schema = $this->get_item_schema();

		// Extract by name.

		$attachment_id = $insert['attachment_id'];

		$file          = $insert['file'];

		if ( isset( $request['alt_text'] ) ) {

			update_post_meta( $attachment_id, '_wp_attachment_image_alt', sanitize_text_field( $request['alt_text'] ) );

		}

		if ( ! empty( $schema['properties']['featured_media'] ) && isset( $request['featured_media'] ) ) {

			$thumbnail_update = $this->handle_featured_media( $request['featured_media'], $attachment_id );

			if ( is_wp_error( $thumbnail_update ) ) {

				return $thumbnail_update;

			}

		}

		if ( ! empty( $schema['properties']['meta'] ) && isset( $request['meta'] ) ) {

			$meta_update = $this->meta->update_value( $request['meta'], $attachment_id );

			if ( is_wp_error( $meta_update ) ) {

				return $meta_update;

			}

		}

		$attachment    = get_post( $attachment_id );

		$fields_update = $this->update_additional_fields_for_object( $attachment, $request );

		if ( is_wp_error( $fields_update ) ) {

			return $fields_update;

		}

		$terms_update = $this->handle_terms( $attachment_id, $request );

		if ( is_wp_error( $terms_update ) ) {

			return $terms_update;

		}

		$request->set_param( 'context', 'edit' );

		/**

		 * Fires after a single attachment is completely created or updated via the REST API.

		 *

		 * @since 5.0.0

		 *

		 * @param WP_Post         $attachment Inserted or updated attachment object.

		 * @param WP_REST_Request $request    Request object.

		 * @param bool            $creating   True when creating an attachment, false when updating.

		 */

		do_action( 'rest_after_insert_attachment', $attachment, $request, true );

		wp_after_insert_post( $attachment, false, null );

		if ( wp_is_serving_rest_request() ) {

			/*

			 * Set a custom header with the attachment_id.

			 * Used by the browser/client to resume creating image sub-sizes after a PHP fatal error.

			 */

			header( 'X-WP-Upload-Attachment-ID: ' . $attachment_id );

		}

		// Include media and image functions to get access to wp_generate_attachment_metadata().

		require_once ABSPATH . 'wp-admin/includes/media.php';

		require_once ABSPATH . 'wp-admin/includes/image.php';

		/*

		 * Post-process the upload (create image sub-sizes, make PDF thumbnails, etc.) and insert attachment meta.

		 * At this point the server may run out of resources and post-processing of uploaded images may fail.

		 */

		wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $file ) );

		$response = $this->prepare_item_for_response( $attachment, $request );

		$response = rest_ensure_response( $response );

		$response->set_status( 201 );

		$response->header( 'Location', rest_url( sprintf( '%s/%s/%d', $this->namespace, $this->rest_base, $attachment_id ) ) );

		return $response;

	}

	/**

	 * Inserts the attachment post in the database. Does not update the attachment meta.

	 *

	 * @since 5.3.0

	 *

	 * @param WP_REST_Request $request

	 * @return array|WP_Error

	 */

	protected function insert_attachment( $request ) {

		// Get the file via $_FILES or raw data.

		$files   = $request->get_file_params();

		$headers = $request->get_headers();

		$time = null;

		// Matches logic in media_handle_upload().

		if ( ! empty( $request['post'] ) ) {

			$post = get_post( $request['post'] );

			// The post date doesn't usually matter for pages, so don't backdate this upload.

			if ( $post && 'page' !== $post->post_type && substr( $post->post_date, 0, 4 ) > 0 ) {

				$time = $post->post_date;

			}

		}

		if ( ! empty( $files ) ) {

			$file = $this->upload_from_file( $files, $headers, $time );

		} else {

			$file = $this->upload_from_data( $request->get_body(), $headers, $time );

		}

		if ( is_wp_error( $file ) ) {

			return $file;

		}

		$name       = wp_basename( $file['file'] );

		$name_parts = pathinfo( $name );

		$name       = trim( substr( $name, 0, -( 1 + strlen( $name_parts['extension'] ) ) ) );

		$url  = $file['url'];

		$type = $file['type'];

		$file = $file['file'];

		// Include image functions to get access to wp_read_image_metadata().

		require_once ABSPATH . 'wp-admin/includes/image.php';

		// Use image exif/iptc data for title and caption defaults if possible.

		$image_meta = wp_read_image_metadata( $file );

		if ( ! empty( $image_meta ) ) {

			if ( empty( $request['title'] ) && trim( $image_meta['title'] ) && ! is_numeric( sanitize_title( $image_meta['title'] ) ) ) {

				$request['title'] = $image_meta['title'];

			}

			if ( empty( $request['caption'] ) && trim( $image_meta['caption'] ) ) {

				$request['caption'] = $image_meta['caption'];

			}

		}

		$attachment = $this->prepare_item_for_database( $request );

		$attachment->post_mime_type = $type;

		$attachment->guid           = $url;

		// If the title was not set, use the original filename.

		if ( empty( $attachment->post_title ) && ! empty( $files['file']['name'] ) ) {

			// Remove the file extension (after the last `.`)

			$tmp_title = substr( $files['file']['name'], 0, strrpos( $files['file']['name'], '.' ) );

			if ( ! empty( $tmp_title ) ) {

				$attachment->post_title = $tmp_title;

			}

		}

		// Fall back to the original approach.

		if ( empty( $attachment->post_title ) ) {

			$attachment->post_title = preg_replace( '/\.[^.]+$/', '', wp_basename( $file ) );

		}

		// $post_parent is inherited from $attachment['post_parent'].

		$id = wp_insert_attachment( wp_slash( (array) $attachment ), $file, 0, true, false );

		if ( is_wp_error( $id ) ) {

			if ( 'db_update_error' === $id->get_error_code() ) {

				$id->add_data( array( 'status' => 500 ) );

			} else {

				$id->add_data( array( 'status' => 400 ) );

			}

			return $id;

		}

		$attachment = get_post( $id );

		/**

		 * Fires after a single attachment is created or updated via the REST API.

		 *

		 * @since 4.7.0

		 *

		 * @param WP_REST_Request $request    The request sent to the API.

		 * @param bool            $creating   True when creating an attachment, false when updating.

		 */

		do_action( 'rest_insert_attachment', $attachment, $request, true );

		return array(

			'attachment_id' => $id,

			'file'          => $file,

		);

	}

	/**

	 * Determines the featured media based on a request param.

	 *

	 * @since 6.5.0

	 *

	 * @param int $featured_media Featured Media ID.

	 * @param int $post_id        Post ID.

	 * @return bool|WP_Error Whether the post thumbnail was successfully deleted, otherwise WP_Error.

	 */

	protected function handle_featured_media( $featured_media, $post_id ) {

		$post_type         = get_post_type( $post_id );

		$thumbnail_support = current_theme_supports( 'post-thumbnails', $post_type ) && post_type_supports( $post_type, 'thumbnail' );