<?php

/**

 * REST API: WP_REST_Plugins_Controller class

 *

 * @package WordPress

 * @subpackage REST_API

 * @since 5.5.0

 */

/**

 * Core class to access plugins via the REST API.

 *

 * @since 5.5.0

 *

 * @see WP_REST_Controller

 */

class WP_REST_Plugins_Controller extends WP_REST_Controller {

	const PATTERN = '[^.\/]+(?:\/[^.\/]+)?';

	/**

	 * Plugins controller constructor.

	 *

	 * @since 5.5.0

	 */

	public function __construct() {

		$this->namespace = 'wp/v2';

		$this->rest_base = 'plugins';

	}

	/**

	 * Registers the routes for the plugins controller.

	 *

	 * @since 5.5.0

	 */

	public function register_routes() {

		register_rest_route(

			$this->namespace,

			'/' . $this->rest_base,

			array(

				array(

					'methods'             => WP_REST_Server::READABLE,

					'callback'            => array( $this, 'get_items' ),

					'permission_callback' => array( $this, 'get_items_permissions_check' ),

					'args'                => $this->get_collection_params(),

				),

				array(

					'methods'             => WP_REST_Server::CREATABLE,

					'callback'            => array( $this, 'create_item' ),

					'permission_callback' => array( $this, 'create_item_permissions_check' ),

					'args'                => array(

						'slug'   => array(

							'type'        => 'string',

							'required'    => true,

							'description' => __( 'WordPress.org plugin directory slug.' ),

							'pattern'     => '[\w\-]+',

						),

						'status' => array(

							'description' => __( 'The plugin activation status.' ),

							'type'        => 'string',

							'enum'        => is_multisite() ? array( 'inactive', 'active', 'network-active' ) : array( 'inactive', 'active' ),

							'default'     => 'inactive',

						),

					),

				),

				'schema' => array( $this, 'get_public_item_schema' ),

			)

		);

		register_rest_route(

			$this->namespace,

			'/' . $this->rest_base . '/(?P<plugin>' . self::PATTERN . ')',

			array(

				array(

					'methods'             => WP_REST_Server::READABLE,

					'callback'            => array( $this, 'get_item' ),

					'permission_callback' => array( $this, 'get_item_permissions_check' ),

				),

				array(

					'methods'             => WP_REST_Server::EDITABLE,

					'callback'            => array( $this, 'update_item' ),

					'permission_callback' => array( $this, 'update_item_permissions_check' ),

					'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),

				),

				array(

					'methods'             => WP_REST_Server::DELETABLE,

					'callback'            => array( $this, 'delete_item' ),

					'permission_callback' => array( $this, 'delete_item_permissions_check' ),

				),

				'args'   => array(

					'context' => $this->get_context_param( array( 'default' => 'view' ) ),

					'plugin'  => array(

						'type'              => 'string',

						'pattern'           => self::PATTERN,

						'validate_callback' => array( $this, 'validate_plugin_param' ),

						'sanitize_callback' => array( $this, 'sanitize_plugin_param' ),

					),

				),

				'schema' => array( $this, 'get_public_item_schema' ),

			)

		);

	}

	/**

	 * Checks if a given request has access to get plugins.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.

	 */

	public function get_items_permissions_check( $request ) {

		if ( ! current_user_can( 'activate_plugins' ) ) {

			return new WP_Error(

				'rest_cannot_view_plugins',

				__( 'Sorry, you are not allowed to manage plugins for this site.' ),

				array( 'status' => rest_authorization_required_code() )

			);

		}

		return true;

	}

	/**

	 * Retrieves a collection of plugins.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

	 */

	public function get_items( $request ) {

		require_once ABSPATH . 'wp-admin/includes/plugin.php';

		$plugins = array();

		foreach ( get_plugins() as $file => $data ) {

			if ( is_wp_error( $this->check_read_permission( $file ) ) ) {

				continue;

			}

			$data['_file'] = $file;

			if ( ! $this->does_plugin_match_request( $request, $data ) ) {

				continue;

			}

			$plugins[] = $this->prepare_response_for_collection( $this->prepare_item_for_response( $data, $request ) );

		}

		return new WP_REST_Response( $plugins );

	}

	/**

	 * Checks if a given request has access to get a specific plugin.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.

	 */

	public function get_item_permissions_check( $request ) {

		if ( ! current_user_can( 'activate_plugins' ) ) {

			return new WP_Error(

				'rest_cannot_view_plugin',

				__( 'Sorry, you are not allowed to manage plugins for this site.' ),

				array( 'status' => rest_authorization_required_code() )

			);

		}

		$can_read = $this->check_read_permission( $request['plugin'] );

		if ( is_wp_error( $can_read ) ) {

			return $can_read;

		}

		return true;

	}

	/**

	 * Retrieves one plugin from the site.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

	 */

	public function get_item( $request ) {

		require_once ABSPATH . 'wp-admin/includes/plugin.php';

		$data = $this->get_plugin_data( $request['plugin'] );

		if ( is_wp_error( $data ) ) {

			return $data;

		}

		return $this->prepare_item_for_response( $data, $request );

	}

	/**

	 * Checks if the given plugin can be viewed by the current user.

	 *

	 * On multisite, this hides non-active network only plugins if the user does not have permission

	 * to manage network plugins.

	 *

	 * @since 5.5.0

	 *

	 * @param string $plugin The plugin file to check.

	 * @return true|WP_Error True if can read, a WP_Error instance otherwise.

	 */

	protected function check_read_permission( $plugin ) {

		if ( ! $this->is_plugin_installed( $plugin ) ) {

			return new WP_Error( 'rest_plugin_not_found', __( 'Plugin not found.' ), array( 'status' => 404 ) );

		}

		if ( ! is_multisite() ) {

			return true;

		}

		if ( ! is_network_only_plugin( $plugin ) || is_plugin_active( $plugin ) || current_user_can( 'manage_network_plugins' ) ) {

			return true;

		}

		return new WP_Error(

			'rest_cannot_view_plugin',

			__( 'Sorry, you are not allowed to manage this plugin.' ),

			array( 'status' => rest_authorization_required_code() )

		);

	}

	/**

	 * Checks if a given request has access to upload plugins.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return true|WP_Error True if the request has access to create items, WP_Error object otherwise.

	 */

	public function create_item_permissions_check( $request ) {

		if ( ! current_user_can( 'install_plugins' ) ) {

			return new WP_Error(

				'rest_cannot_install_plugin',

				__( 'Sorry, you are not allowed to install plugins on this site.' ),

				array( 'status' => rest_authorization_required_code() )

			);

		}

		if ( 'inactive' !== $request['status'] && ! current_user_can( 'activate_plugins' ) ) {

			return new WP_Error(

				'rest_cannot_activate_plugin',

				__( 'Sorry, you are not allowed to activate plugins.' ),

				array(

					'status' => rest_authorization_required_code(),

				)

			);

		}

		return true;

	}

	/**

	 * Uploads a plugin and optionally activates it.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

	 */

	public function create_item( $request ) {

		require_once ABSPATH . 'wp-admin/includes/file.php';

		require_once ABSPATH . 'wp-admin/includes/plugin.php';

		require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';

		require_once ABSPATH . 'wp-admin/includes/plugin-install.php';

		$slug = $request['slug'];

		// Verify filesystem is accessible first.

		$filesystem_available = $this->is_filesystem_available();

		if ( is_wp_error( $filesystem_available ) ) {

			return $filesystem_available;

		}

		$api = plugins_api(

			'plugin_information',

			array(

				'slug'   => $slug,

				'fields' => array(

					'sections'       => false,

					'language_packs' => true,

				),

			)

		);

		if ( is_wp_error( $api ) ) {

			if ( false !== strpos( $api->get_error_message(), 'Plugin not found.' ) ) {

				$api->add_data( array( 'status' => 404 ) );

			} else {

				$api->add_data( array( 'status' => 500 ) );

			}

			return $api;

		}

		$skin     = new WP_Ajax_Upgrader_Skin();

		$upgrader = new Plugin_Upgrader( $skin );

		$result = $upgrader->install( $api->download_link );

		if ( is_wp_error( $result ) ) {

			$result->add_data( array( 'status' => 500 ) );

			return $result;

		}

		// This should be the same as $result above.

		if ( is_wp_error( $skin->result ) ) {

			$skin->result->add_data( array( 'status' => 500 ) );

			return $skin->result;

		}

		if ( $skin->get_errors()->has_errors() ) {

			$error = $skin->get_errors();

			$error->add_data( array( 'status' => 500 ) );

			return $error;

		}

		if ( is_null( $result ) ) {

			global $wp_filesystem;

			// Pass through the error from WP_Filesystem if one was raised.

			if ( $wp_filesystem instanceof WP_Filesystem_Base && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors() ) {

				return new WP_Error( 'unable_to_connect_to_filesystem', $wp_filesystem->errors->get_error_message(), array( 'status' => 500 ) );

			}

			return new WP_Error( 'unable_to_connect_to_filesystem', __( 'Unable to connect to the filesystem. Please confirm your credentials.' ), array( 'status' => 500 ) );

		}

		$file = $upgrader->plugin_info();

		if ( ! $file ) {

			return new WP_Error( 'unable_to_determine_installed_plugin', __( 'Unable to determine what plugin was installed.' ), array( 'status' => 500 ) );

		}

		if ( 'inactive' !== $request['status'] ) {

			$can_change_status = $this->plugin_status_permission_check( $file, $request['status'], 'inactive' );

			if ( is_wp_error( $can_change_status ) ) {

				return $can_change_status;

			}

			$changed_status = $this->handle_plugin_status( $file, $request['status'], 'inactive' );

			if ( is_wp_error( $changed_status ) ) {

				return $changed_status;

			}

		}

		// Install translations.

		$installed_locales = array_values( get_available_languages() );

		/** This filter is documented in wp-includes/update.php */

		$installed_locales = apply_filters( 'plugins_update_check_locales', $installed_locales );

		$language_packs = array_map(

			function( $item ) {

				return (object) $item;

			},

			$api->language_packs

		);

		$language_packs = array_filter(

			$language_packs,

			function( $pack ) use ( $installed_locales ) {

				return in_array( $pack->language, $installed_locales, true );

			}

		);

		if ( $language_packs ) {

			$lp_upgrader = new Language_Pack_Upgrader( $skin );

			// Install all applicable language packs for the plugin.

			$lp_upgrader->bulk_upgrade( $language_packs );

		}

		$path          = WP_PLUGIN_DIR . '/' . $file;

		$data          = get_plugin_data( $path, false, false );

		$data['_file'] = $file;

		$response = $this->prepare_item_for_response( $data, $request );

		$response->set_status( 201 );

		$response->header( 'Location', rest_url( sprintf( '%s/%s/%s', $this->namespace, $this->rest_base, substr( $file, 0, - 4 ) ) ) );

		return $response;

	}

	/**

	 * Checks if a given request has access to update a specific plugin.

	 *

	 * @since 5.5.0

	 *

	 * @param WP_REST_Request $request Full details about the request.

	 * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.

	 */

	public function update_item_permissions_check( $request ) {

		require_once ABSPATH . 'wp-admin/includes/plugin.php';

		if ( ! current_user_can( 'activate_plugins' ) ) {

			return new WP_Error(

				'rest_cannot_manage_plugins',

				__( 'Sorry, you are not allowed to manage plugins for this site.' ),

				array( 'status' => rest_authorization_required_code() )

			);

		}

		$can_read = $this->check_read_permission( $request['plugin'] );

		if ( is_wp_error( $can_read ) ) {

			return $can_read;

		}

		$status = $this->get_plugin_status( $request['plugin'] );

		if ( $request['status'] && $status !== $request['status'] ) {

			$can_change_status = $this->plugin_status_permission_check( $request['plugin'], $request['status'], $status );

			if ( is_wp_error( $can_change_status ) ) {

				return $can_change_status;

			}