<?php

/**

 * REST API: WP_REST_Server class

 *

 * @package WordPress

 * @subpackage REST_API

 * @since 4.4.0

 */

/**

 * Core class used to implement the WordPress REST API server.

 *

 * @since 4.4.0

 */

class WP_REST_Server {

	/**

	 * Alias for GET transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const READABLE = 'GET';

	/**

	 * Alias for POST transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const CREATABLE = 'POST';

	/**

	 * Alias for POST, PUT, PATCH transport methods together.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const EDITABLE = 'POST, PUT, PATCH';

	/**

	 * Alias for DELETE transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const DELETABLE = 'DELETE';

	/**

	 * Alias for GET, POST, PUT, PATCH & DELETE transport methods together.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const ALLMETHODS = 'GET, POST, PUT, PATCH, DELETE';

	/**

	 * Namespaces registered to the server.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $namespaces = array();

	/**

	 * Endpoints registered to the server.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $endpoints = array();

	/**

	 * Options defined for the routes.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $route_options = array();

	/**

	 * Instantiates the REST server.

	 *

	 * @since 4.4.0

	 */

	public function __construct() {

		$this->endpoints = array(

			// Meta endpoints.

			'/' => array(

				'callback' => array( $this, 'get_index' ),

				'methods' => 'GET',

				'args' => array(

					'context' => array(

						'default' => 'view',

					),

				),

			),

		);

	}

	/**

	 * Checks the authentication headers if supplied.

	 *

	 * @since 4.4.0

	 *

	 * @return WP_Error|null WP_Error indicates unsuccessful login, null indicates successful

	 *                       or no authentication provided

	 */

	public function check_authentication() {

		/**

		 * Filters REST authentication errors.

		 *

		 * This is used to pass a WP_Error from an authentication method back to

		 * the API.

		 *

		 * Authentication methods should check first if they're being used, as

		 * multiple authentication methods can be enabled on a site (cookies,

		 * HTTP basic auth, OAuth). If the authentication method hooked in is

		 * not actually being attempted, null should be returned to indicate

		 * another authentication method should check instead. Similarly,

		 * callbacks should ensure the value is `null` before checking for

		 * errors.

		 *

		 * A WP_Error instance can be returned if an error occurs, and this should

		 * match the format used by API methods internally (that is, the `status`

		 * data should be used). A callback can return `true` to indicate that

		 * the authentication method was used, and it succeeded.

		 *

		 * @since 4.4.0

		 *

		 * @param WP_Error|null|bool WP_Error if authentication error, null if authentication

		 *                              method wasn't used, true if authentication succeeded.

		 */

		return apply_filters( 'rest_authentication_errors', null );

	}

	/**

	 * Converts an error to a response object.

	 *

	 * This iterates over all error codes and messages to change it into a flat

	 * array. This enables simpler client behaviour, as it is represented as a

	 * list in JSON rather than an object/map.

	 *

	 * @since 4.4.0

	 *

	 * @param WP_Error $error WP_Error instance.

	 * @return WP_REST_Response List of associative arrays with code and message keys.

	 */

	protected function error_to_response( $error ) {

		$error_data = $error->get_error_data();

		if ( is_array( $error_data ) && isset( $error_data['status'] ) ) {

			$status = $error_data['status'];

		} else {

			$status = 500;

		}

		$errors = array();

		foreach ( (array) $error->errors as $code => $messages ) {

			foreach ( (array) $messages as $message ) {

				$errors[] = array( 'code' => $code, 'message' => $message, 'data' => $error->get_error_data( $code ) );

			}

		}

		$data = $errors[0];

		if ( count( $errors ) > 1 ) {

			// Remove the primary error.

			array_shift( $errors );

			$data['additional_errors'] = $errors;

		}

		$response = new WP_REST_Response( $data, $status );

		return $response;

	}

	/**

	 * Retrieves an appropriate error representation in JSON.

	 *

	 * Note: This should only be used in WP_REST_Server::serve_request(), as it

	 * cannot handle WP_Error internally. All callbacks and other internal methods

	 * should instead return a WP_Error with the data set to an array that includes

	 * a 'status' key, with the value being the HTTP status to send.

	 *

	 * @since 4.4.0

	 *

	 * @param string $code    WP_Error-style code.

	 * @param string $message Human-readable message.

	 * @param int    $status  Optional. HTTP status code to send. Default null.

	 * @return string JSON representation of the error

	 */

	protected function json_error( $code, $message, $status = null ) {

		if ( $status ) {

			$this->set_status( $status );

		}

		$error = compact( 'code', 'message' );

		return wp_json_encode( $error );

	}

	/**

	 * Handles serving an API request.

	 *

	 * Matches the current server URI to a route and runs the first matching

	 * callback then outputs a JSON representation of the returned value.

	 *

	 * @since 4.4.0

	 *

	 * @see WP_REST_Server::dispatch()

	 *

	 * @param string $path Optional. The request route. If not set, `$_SERVER['PATH_INFO']` will be used.

	 *                     Default null.

	 * @return false|null Null if not served and a HEAD request, false otherwise.

	 */

	public function serve_request( $path = null ) {

		$content_type = isset( $_GET['_jsonp'] ) ? 'application/javascript' : 'application/json';

		$this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );

		$this->send_header( 'X-Robots-Tag', 'noindex' );

		$api_root = get_rest_url();

		if ( ! empty( $api_root ) ) {

			$this->send_header( 'Link', '<' . esc_url_raw( $api_root ) . '>; rel="https://api.w.org/"' );

		}

		/*

		 * Mitigate possible JSONP Flash attacks.

		 *

		 * https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

		 */

		$this->send_header( 'X-Content-Type-Options', 'nosniff' );

		$this->send_header( 'Access-Control-Expose-Headers', 'X-WP-Total, X-WP-TotalPages' );

		$this->send_header( 'Access-Control-Allow-Headers', 'Authorization, Content-Type' );

		/**

		 * Send nocache headers on authenticated requests.

		 *

		 * @since 4.4.0

		 *

		 * @param bool $rest_send_nocache_headers Whether to send no-cache headers.

		 */

		$send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() );

		if ( $send_no_cache_headers ) {

			foreach ( wp_get_nocache_headers() as $header => $header_value ) {

				if ( empty( $header_value ) ) {

					$this->remove_header( $header );

				} else {

					$this->send_header( $header, $header_value );

				}

			}

		}

		/**

		 * Filters whether the REST API is enabled.

		 *

		 * @since 4.4.0

		 * @deprecated 4.7.0 Use the rest_authentication_errors filter to restrict access to the API

		 *

		 * @param bool $rest_enabled Whether the REST API is enabled. Default true.

		 */

		apply_filters_deprecated( 'rest_enabled', array( true ), '4.7.0', 'rest_authentication_errors',

			__( 'The REST API can no longer be completely disabled, the rest_authentication_errors filter can be used to restrict access to the API, instead.' )

		);

		/**

		 * Filters whether jsonp is enabled.

		 *

		 * @since 4.4.0

		 *

		 * @param bool $jsonp_enabled Whether jsonp is enabled. Default true.

		 */

		$jsonp_enabled = apply_filters( 'rest_jsonp_enabled', true );

		$jsonp_callback = null;

		if ( isset( $_GET['_jsonp'] ) ) {

			if ( ! $jsonp_enabled ) {

				echo $this->json_error( 'rest_callback_disabled', __( 'JSONP support is disabled on this site.' ), 400 );

				return false;

			}

			$jsonp_callback = $_GET['_jsonp'];

			if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {

				echo $this->json_error( 'rest_callback_invalid', __( 'Invalid JSONP callback function.' ), 400 );

				return false;

			}

		}

		if ( empty( $path ) ) {

			if ( isset( $_SERVER['PATH_INFO'] ) ) {

				$path = $_SERVER['PATH_INFO'];

			} else {

				$path = '/';

			}

		}

		$request = new WP_REST_Request( $_SERVER['REQUEST_METHOD'], $path );

		$request->set_query_params( wp_unslash( $_GET ) );

		$request->set_body_params( wp_unslash( $_POST ) );

		$request->set_file_params( $_FILES );

		$request->set_headers( $this->get_headers( wp_unslash( $_SERVER ) ) );

		$request->set_body( $this->get_raw_data() );

		/*

		 * HTTP method override for clients that can't use PUT/PATCH/DELETE. First, we check

		 * $_GET['_method']. If that is not set, we check for the HTTP_X_HTTP_METHOD_OVERRIDE

		 * header.

		 */

		if ( isset( $_GET['_method'] ) ) {

			$request->set_method( $_GET['_method'] );

		} elseif ( isset( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ) ) {

			$request->set_method( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] );

		}

		$result = $this->check_authentication();

		if ( ! is_wp_error( $result ) ) {

			$result = $this->dispatch( $request );

		}

		// Normalize to either WP_Error or WP_REST_Response...

		$result = rest_ensure_response( $result );

		// ...then convert WP_Error across.

		if ( is_wp_error( $result ) ) {

			$result = $this->error_to_response( $result );

		}

		/**

		 * Filters the API response.

		 *

		 * Allows modification of the response before returning.

		 *

		 * @since 4.4.0

		 * @since 4.5.0 Applied to embedded responses.

		 *

		 * @param WP_HTTP_Response $result  Result to send to the client. Usually a WP_REST_Response.

		 * @param WP_REST_Server   $this    Server instance.

		 * @param WP_REST_Request  $request Request used to generate the response.

		 */

		$result = apply_filters( 'rest_post_dispatch', rest_ensure_response( $result ), $this, $request );

		// Wrap the response in an envelope if asked for.

		if ( isset( $_GET['_envelope'] ) ) {

			$result = $this->envelope_response( $result, isset( $_GET['_embed'] ) );

		}

		// Send extra data from response objects.

		$headers = $result->get_headers();

		$this->send_headers( $headers );

		$code = $result->get_status();

		$this->set_status( $code );

		/**

		 * Filters whether the request has already been served.

		 *

		 * Allow sending the request manually - by returning true, the API result

		 * will not be sent to the client.

		 *

		 * @since 4.4.0

		 *

		 * @param bool             $served  Whether the request has already been served.

		 *                                           Default false.

		 * @param WP_HTTP_Response $result  Result to send to the client. Usually a WP_REST_Response.

		 * @param WP_REST_Request  $request Request used to generate the response.

		 * @param WP_REST_Server   $this    Server instance.

		 */

		$served = apply_filters( 'rest_pre_serve_request', false, $result, $request, $this );

		if ( ! $served ) {

			if ( 'HEAD' === $request->get_method() ) {

				return null;

			}

			// Embed links inside the request.

			$result = $this->response_to_data( $result, isset( $_GET['_embed'] ) );

			/**

			 * Filters the API response.

			 *

			 * Allows modification of the response data after inserting

			 * embedded data (if any) and before echoing the response data.

			 *

			 * @since 4.8.1

			 *

			 * @param array            $result  Response data to send to the client.

			 * @param WP_REST_Server   $this    Server instance.

			 * @param WP_REST_Request  $request Request used to generate the response.

			 */

			$result = apply_filters( 'rest_pre_echo_response', $result, $this, $request );

			$result = wp_json_encode( $result );

			$json_error_message = $this->get_json_last_error();

			if ( $json_error_message ) {

				$json_error_obj = new WP_Error( 'rest_encode_error', $json_error_message, array( 'status' => 500 ) );

				$result = $this->error_to_response( $json_error_obj );

				$result = wp_json_encode( $result->data[0] );

			}

			if ( $jsonp_callback ) {

				// Prepend '/**/' to mitigate possible JSONP Flash attacks.

				// https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

				echo '/**/' . $jsonp_callback . '(' . $result . ')';

			} else {

				echo $result;

			}

		}

		return null;

	}

	/**

	 * Converts a response to data to send.

	 *

	 * @since 4.4.0

	 *

	 * @param WP_REST_Response $response Response object.

	 * @param bool             $embed    Whether links should be embedded.

	 * @return array {

	 *     Data with sub-requests embedded.

	 *

	 *     @type array [$_links]    Links.

	 *     @type array [$_embedded] Embeddeds.

	 * }

	 */

	public function response_to_data( $response, $embed ) {

		$data  = $response->get_data();

		$links = $this->get_compact_response_links( $response );

		if ( ! empty( $links ) ) {

			// Convert links to part of the data.

			$data['_links'] = $links;

		}

		if ( $embed ) {

			// Determine if this is a numeric array.

			if ( wp_is_numeric_array( $data ) ) {

				$data = array_map( array( $this, 'embed_links' ), $data );

			} else {

				$data = $this->embed_links( $data );

			}

		}

		return $data;