<?php

/**

 * REST API: WP_REST_URL_Details_Controller class

 *

 * @package WordPress

 * @subpackage REST_API

 * @since 5.9.0

 */

/**

 * Controller which provides REST endpoint for retrieving information

 * from a remote site's HTML response.

 *

 * @since 5.9.0

 *

 * @see WP_REST_Controller

 */

class WP_REST_URL_Details_Controller extends WP_REST_Controller {

	/**

	 * Constructs the controller.

	 *

	 * @since 5.9.0

	 */

	public function __construct() {

		$this->namespace = 'wp-block-editor/v1';

		$this->rest_base = 'url-details';

	}

	/**

	 * Registers the necessary REST API routes.

	 *

	 * @since 5.9.0

	 */

	public function register_routes() {

		register_rest_route(

			$this->namespace,

			'/' . $this->rest_base,

			array(

				array(

					'methods'             => WP_REST_Server::READABLE,

					'callback'            => array( $this, 'parse_url_details' ),

					'args'                => array(

						'url' => array(

							'required'          => true,

							'description'       => __( 'The URL to process.' ),

							'validate_callback' => 'wp_http_validate_url',

							'sanitize_callback' => 'sanitize_url',

							'type'              => 'string',

							'format'            => 'uri',

						),

					),

					'permission_callback' => array( $this, 'permissions_check' ),

					'schema'              => array( $this, 'get_public_item_schema' ),

				),

			)

		);

	}

	/**

	 * Retrieves the item's schema, conforming to JSON Schema.

	 *

	 * @since 5.9.0

	 *

	 * @return array Item schema data.

	 */

	public function get_item_schema() {

		if ( $this->schema ) {

			return $this->add_additional_fields_schema( $this->schema );

		}

		$this->schema = array(

			'$schema'    => 'http://json-schema.org/draft-04/schema#',

			'title'      => 'url-details',

			'type'       => 'object',

			'properties' => array(

				'title'       => array(

					'description' => sprintf(

						/* translators: %s: HTML title tag. */

						__( 'The contents of the %s element from the URL.' ),

						'<title>'

					),

					'type'        => 'string',

					'context'     => array( 'view', 'edit', 'embed' ),

					'readonly'    => true,

				),

				'icon'        => array(

					'description' => sprintf(

						/* translators: %s: HTML link tag. */

						__( 'The favicon image link of the %s element from the URL.' ),

						'<link rel="icon">'

					),

					'type'        => 'string',

					'format'      => 'uri',

					'context'     => array( 'view', 'edit', 'embed' ),

					'readonly'    => true,

				),

				'description' => array(

					'description' => sprintf(

						/* translators: %s: HTML meta tag. */

						__( 'The content of the %s element from the URL.' ),

						'<meta name="description">'

					),

					'type'        => 'string',

					'context'     => array( 'view', 'edit', 'embed' ),

					'readonly'    => true,

				),

				'image'       => array(

					'description' => sprintf(

						/* translators: 1: HTML meta tag, 2: HTML meta tag. */

						__( 'The Open Graph image link of the %1$s or %2$s element from the URL.' ),

						'<meta property="og:image">',

						'<meta property="og:image:url">'

					),

					'type'        => 'string',

					'format'      => 'uri',

					'context'     => array( 'view', 'edit', 'embed' ),

					'readonly'    => true,

				),

			),

		);

		return $this->add_additional_fields_schema( $this->schema );

	}

	/**

	 * Retrieves the contents of the title tag from the HTML response.

	 *

	 * @since 5.9.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return WP_REST_Response|WP_Error The parsed details as a response object. WP_Error if there are errors.

	 */

	public function parse_url_details( $request ) {

		$url = untrailingslashit( $request['url'] );

		if ( empty( $url ) ) {

			return new WP_Error( 'rest_invalid_url', __( 'Invalid URL' ), array( 'status' => 404 ) );

		}

		// Transient per URL.

		$cache_key = $this->build_cache_key_for_url( $url );

		// Attempt to retrieve cached response.

		$cached_response = $this->get_cache( $cache_key );

		if ( ! empty( $cached_response ) ) {

			$remote_url_response = $cached_response;

		} else {

			$remote_url_response = $this->get_remote_url( $url );

			// Exit if we don't have a valid body or it's empty.

			if ( is_wp_error( $remote_url_response ) || empty( $remote_url_response ) ) {

				return $remote_url_response;

			}

			// Cache the valid response.

			$this->set_cache( $cache_key, $remote_url_response );

		}

		$html_head     = $this->get_document_head( $remote_url_response );

		$meta_elements = $this->get_meta_with_content_elements( $html_head );

		$data = $this->add_additional_fields_to_object(

			array(

				'title'       => $this->get_title( $html_head ),

				'icon'        => $this->get_icon( $html_head, $url ),

				'description' => $this->get_description( $meta_elements ),

				'image'       => $this->get_image( $meta_elements, $url ),

			),

			$request

		);

		// Wrap the data in a response object.

		$response = rest_ensure_response( $data );

		/**

		 * Filters the URL data for the response.

		 *

		 * @since 5.9.0

		 *

		 * @param WP_REST_Response $response            The response object.

		 * @param string           $url                 The requested URL.

		 * @param WP_REST_Request  $request             Request object.

		 * @param string           $remote_url_response HTTP response body from the remote URL.

		 */

		return apply_filters( 'rest_prepare_url_details', $response, $url, $request, $remote_url_response );

	}

	/**

	 * Checks whether a given request has permission to read remote URLs.

	 *

	 * @since 5.9.0

	 *

	 */

	public function permissions_check() {

		if ( current_user_can( 'edit_posts' ) ) {

			return true;

		}

		foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {

			if ( current_user_can( $post_type->cap->edit_posts ) ) {

				return true;

			}

		}

		return new WP_Error(

			'rest_cannot_view_url_details',

			__( 'Sorry, you are not allowed to process remote URLs.' ),

			array( 'status' => rest_authorization_required_code() )

		);

	}

	/**

	 * Retrieves the document title from a remote URL.

	 *

	 * @since 5.9.0

	 *

	 * @param string $url The website URL whose HTML to access.

	 * @return string|WP_Error The HTTP response from the remote URL on success.

	 *                         WP_Error if no response or no content.

	 */

	private function get_remote_url( $url ) {

		/*

		 * Provide a modified UA string to workaround web properties which block WordPress "Pingbacks".

		 * Why? The UA string used for pingback requests contains `WordPress/` which is very similar

		 * to that used as the default UA string by the WP HTTP API. Therefore requests from this

		 * REST endpoint are being unintentionally blocked as they are misidentified as pingback requests.

		 * By slightly modifying the UA string, but still retaining the "WordPress" identification (via "WP")

		 * we are able to work around this issue.

		 * Example UA string: `WP-URLDetails/5.9-alpha-51389 (+http://localhost:8888)`.

		*/

		$modified_user_agent = 'WP-URLDetails/' . get_bloginfo( 'version' ) . ' (+' . get_bloginfo( 'url' ) . ')';

		$args = array(

			'limit_response_size' => 150 * KB_IN_BYTES,

			'user-agent'          => $modified_user_agent,

		);

		/**

		 * Filters the HTTP request args for URL data retrieval.

		 *

		 * Can be used to adjust response size limit and other WP_Http::request() args.

		 *

		 * @since 5.9.0

		 *

		 * @param array  $args Arguments used for the HTTP request.

		 * @param string $url  The attempted URL.

		 */

		$args = apply_filters( 'rest_url_details_http_request_args', $args, $url );

		$response = wp_safe_remote_get( $url, $args );

		if ( WP_Http::OK !== wp_remote_retrieve_response_code( $response ) ) {

			// Not saving the error response to cache since the error might be temporary.

			return new WP_Error(

				'no_response',

				__( 'URL not found. Response returned a non-200 status code for this URL.' ),

				array( 'status' => WP_Http::NOT_FOUND )

			);

		}

		$remote_body = wp_remote_retrieve_body( $response );

		if ( empty( $remote_body ) ) {

			return new WP_Error(

				'no_content',

				__( 'Unable to retrieve body from response at this URL.' ),

				array( 'status' => WP_Http::NOT_FOUND )

			);

		}

		return $remote_body;

	}

	/**

	 * Parses the title tag contents from the provided HTML.

	 *

	 * @since 5.9.0

	 *

	 * @param string $html The HTML from the remote website at URL.

	 * @return string The title tag contents on success. Empty string if not found.

	 */

	private function get_title( $html ) {

		$pattern = '#<title[^>]*>(.*?)<\s*/\s*title>#is';

		preg_match( $pattern, $html, $match_title );

		if ( empty( $match_title[1] ) || ! is_string( $match_title[1] ) ) {

			return '';

		}

		$title = trim( $match_title[1] );

		return $this->prepare_metadata_for_output( $title );

	}

	/**

	 * Parses the site icon from the provided HTML.

	 *

	 * @since 5.9.0

	 *

	 * @param string $html The HTML from the remote website at URL.

	 * @param string $url  The target website URL.

	 * @return string The icon URI on success. Empty string if not found.

	 */

	private function get_icon( $html, $url ) {

		// Grab the icon's link element.

		$pattern = '#<link\s[^>]*rel=(?:[\"\']??)\s*(?:icon|shortcut icon|icon shortcut)\s*(?:[\"\']??)[^>]*\/?>#isU';

		preg_match( $pattern, $html, $element );

		if ( empty( $element[0] ) || ! is_string( $element[0] ) ) {

			return '';

		}

		$element = trim( $element[0] );

		// Get the icon's href value.

		$pattern = '#href=([\"\']??)([^\" >]*?)\\1[^>]*#isU';

		preg_match( $pattern, $element, $icon );

		if ( empty( $icon[2] ) || ! is_string( $icon[2] ) ) {

			return '';

		}

		$icon = trim( $icon[2] );

		// If the icon is a data URL, return it.

		$parsed_icon = parse_url( $icon );

		if ( isset( $parsed_icon['scheme'] ) && 'data' === $parsed_icon['scheme'] ) {

			return $icon;

		}

		// Attempt to convert relative URLs to absolute.

		if ( ! is_string( $url ) || '' === $url ) {

			return $icon;

		}

		$parsed_url = parse_url( $url );

		if ( isset( $parsed_url['scheme'] ) && isset( $parsed_url['host'] ) ) {

			$root_url = $parsed_url['scheme'] . '://' . $parsed_url['host'] . '/';

			$icon     = WP_Http::make_absolute_url( $icon, $root_url );

		}

		return $icon;

	}

	/**

	 * Parses the meta description from the provided HTML.

	 *

	 * @since 5.9.0

	 *

	 * @param array $meta_elements {

	 *

	 *     @type string[] $0 Meta elements with a content attribute.

	 *     @type string[] $1 Content attribute's opening quotation mark.

	 *     @type string[] $2 Content attribute's value for each meta element.

	 * }

	 * @return string The meta description contents on success. Empty string if not found.

	 */

	private function get_description( $meta_elements ) {

		// Bail out if there are no meta elements.

		if ( empty( $meta_elements[0] ) ) {

			return '';

		}

		$description = $this->get_metadata_from_meta_element(

			$meta_elements,

			'name',

			'(?:description|og:description)'

		);

		// Bail out if description not found.

		if ( '' === $description ) {

			return '';

		}

		return $this->prepare_metadata_for_output( $description );

	}

	/**

	 * Parses the Open Graph (OG) Image from the provided HTML.

	 *

	 * See: https://ogp.me/.

	 *

	 * @since 5.9.0

	 *

	 * @param array  $meta_elements {

	 *

	 *     @type string[] $0 Meta elements with a content attribute.

	 *     @type string[] $1 Content attribute's opening quotation mark.

	 *     @type string[] $2 Content attribute's value for each meta element.

	 * }

	 * @param string $url The target website URL.

	 * @return string The OG image on success. Empty string if not found.

	 */

	private function get_image( $meta_elements, $url ) {

		$image = $this->get_metadata_from_meta_element(

			$meta_elements,

			'property',

			'(?:og:image|og:image:url)'

		);

		// Bail out if image not found.

		if ( '' === $image ) {

			return '';

		}

		// Attempt to convert relative URLs to absolute.

		$parsed_url = parse_url( $url );

		if ( isset( $parsed_url['scheme'] ) && isset( $parsed_url['host'] ) ) {

			$root_url = $parsed_url['scheme'] . '://' . $parsed_url['host'] . '/';

			$image    = WP_Http::make_absolute_url( $image, $root_url );

		}

		return $image;

	}

	/**

	 * Prepares the metadata by:

	 *    - stripping all HTML tags and tag entities.

	 *    - converting non-tag entities into characters.

	 *

	 * @since 5.9.0

	 *

	 * @param string $metadata The metadata content to prepare.

	 * @return string The prepared metadata.

	 */

	private function prepare_metadata_for_output( $metadata ) {

		$metadata = html_entity_decode( $metadata, ENT_QUOTES, get_bloginfo( 'charset' ) );

		$metadata = wp_strip_all_tags( $metadata );

		return $metadata;

	}

	/**

	 * Utility function to build cache key for a given URL.

	 *

	 * @since 5.9.0

	 *

	 * @param string $url The URL for which to build a cache key.

	 * @return string The cache key.

	 */

	private function build_cache_key_for_url( $url ) {