<?php
namespace WPForms\Integrations\LiteConnect;
use WP_Error; // phpcs:ignore WPForms.PHP.UseStatement.UnusedUseStatement
use WP_User; // phpcs:ignore WPForms.PHP.UseStatement.UnusedUseStatement
use WPForms\Helpers\Transient;
/**
* Class API.
*
* @since 1.7.4
*/
class API {
/**
* Option name.
*
* @since 1.7.4
*
* @var string
*/
const LITE_CONNECT_OPTION = 'wpforms_lite_connect';
/**
* Staging option name.
*
* @since 1.7.4
*
* @var string
*/
const STAGING_LITE_CONNECT_OPTION = 'wpforms_lite_connect_staging';
/**
* Lite Connect API URL.
*
* @since 1.7.4
*
* @var string
*/
const API_URL = 'https://wpformsliteconnect.com';
/**
* Lite Connect staging API URL.
*
* @since 1.7.4
*
* @var string
*/
const STAGING_API_URL = 'https://staging.wpformsliteconnect.com';
/**
* Lite Connect generate_site_key() lock transient name.
*
* @since 1.7.4
*
* @var string
*/
const LITE_CONNECT_SITE_KEY_LOCK = 'lite_connect_site_key_lock';
/**
* Lite Connect generate_access_token() lock transient name.
*
* @since 1.7.4
*/
const LITE_CONNECT_ACCESS_TOKEN_LOCK = 'lite_connect_access_token_lock';
/**
* Lite Connect create_not_logged_in_nonce() action.
*
* @since 1.7.4
*
* @var string
*/
const KEY_NONCE_ACTION = 'lite_connect_key_action';
/**
* Max number of attempts for generate_site_key().
*
* @since 1.7.5
*
* @var integer
*/
const MAX_GENERATE_KEY_ATTEMPTS = 20;
/**
* Generate key attempt counter.
*
* @since 1.7.5
*
* @var string
*/
const GENERATE_KEY_ATTEMPT_COUNTER_OPTION = 'wpforms_lite_connect_generate_key_attempt_counter';
/**
* Lite Connect API URL.
*
* @since 1.7.4
*
* @var string
*/
protected $api_url;
/**
* The site domain.
*
* @since 1.7.4
*
* @var string
*/
protected $domain;
/**
* The site ID.
*
* @since 1.7.4
*
* @var string
*/
protected $site_id;
/**
* API constructor.
*
* @since 1.7.4
*/
public function __construct() {
// Get the domain name.
// Strip protocol `http(s)://` and `www.` from the site URL.
$this->domain = preg_replace( '/(https?:\/\/)?(www\.)?(.*)\/?/', '$3', home_url() );
$this->api_url = self::API_URL;
if ( defined( 'WPFORMS_LITE_CONNECT_STAGING' ) && WPFORMS_LITE_CONNECT_STAGING ) {
$this->api_url = self::STAGING_API_URL;
}
$this->set_site_id();
}
/**
* Generate the site key.
*
* @since 1.7.4
*
* @return false
*/
protected function generate_site_key() {
if ( $this->is_max_generate_key_attempts_reached() ) {
return false;
}
if ( Transient::get( self::LITE_CONNECT_SITE_KEY_LOCK ) ) {
return false;
}
Transient::set( self::LITE_CONNECT_SITE_KEY_LOCK, true, MINUTE_IN_SECONDS );
$admin_email = Integration::get_enabled_email();
$user = get_user_by( 'email', $admin_email );
[ $first_name, $last_name ] = $this->get_registration_names( $user, $admin_email );
$data = [
'domain' => $this->domain,
'admin_email' => $admin_email,
'first_name' => $first_name,
'last_name' => $last_name,
'nonce' => $this->create_not_logged_in_nonce(),
'callback' => add_query_arg( [ LiteConnect::AUTH_KEY_ARG => '' ], trailingslashit( home_url() ) ),
];
$response = $this->request(
'/auth/key',
$data
);
if ( $response !== false ) {
Transient::delete( self::LITE_CONNECT_SITE_KEY_LOCK );
}
$this->update_generate_key_attempts_count();
// At this point, we do not have the site key.
// It will be sent to us in the 'wpforms/auth/key/nonce' callback.
return false;
}
/**
* Get non-empty first and last names to register the site with.
*
* The remote API rejects empty first/last name params, but a blank profile name
* (or an email with no WordPress user behind it) is a valid state.
*
* @since 2.0.1
*
* @param WP_User|false $user User matched by the Lite Connect email.
* @param string|false $admin_email Email that enabled Lite Connect.
*
* @return string[] First and last name.
*/
private function get_registration_names( $user, $admin_email ): array {
$first_name = ! empty( $user->first_name ) ? $user->first_name : '';
$last_name = ! empty( $user->last_name ) ? $user->last_name : '';
if ( $first_name !== '' && $last_name !== '' ) {
return [ $first_name, $last_name ];
}
$fallback = $this->get_fallback_name( $user, $admin_email );
if ( $first_name === '' && $last_name === '' ) {
// Split a multi-word fallback between the params.
$parts = preg_split( '/\s+/', trim( $fallback ), 2 );
return [ $parts[0], $parts[1] ?? $parts[0] ];
}
return [
$first_name === '' ? $fallback : $first_name,
$last_name === '' ? $fallback : $last_name,
];
}
/**
* Get a non-empty name to register the site with.
*
* @since 2.0.1
*
* @param WP_User|false $user User matched by the Lite Connect email.
* @param string|false $admin_email Email that enabled Lite Connect.
*
* @return string
*/
private function get_fallback_name( $user, $admin_email ) {
if ( ! empty( $user->display_name ) ) {
return $user->display_name;
}
$local_part = strstr( (string) $admin_email, '@', true );
return ! empty( $local_part ) ? $local_part : 'WPForms';
}
/**
* Generate the access token.
*
* @since 1.7.4
*
* @param string $site_key The site key.
*
* @return false|string
*/
protected function generate_access_token( $site_key ) {
// Verify if an access token is already being generated.
if ( Transient::get( self::LITE_CONNECT_ACCESS_TOKEN_LOCK ) ) {
return false;
}
// Set a lock to avoid multiple requests to generate the access token.
Transient::set( self::LITE_CONNECT_ACCESS_TOKEN_LOCK, true, MINUTE_IN_SECONDS );
$response = $this->request(
'/auth/access_token',
[
'domain' => $this->domain,
'site_id' => $this->site_id,
'wp_version' => get_bloginfo( 'version' ),
],
[
'X-WPForms-Lite-Connect-Site-Key' => $site_key,
]
);
if ( $response && strpos( $response, '{"error":' ) === false ) {
// Delete lock.
Transient::delete( self::LITE_CONNECT_ACCESS_TOKEN_LOCK );
}
return $response;
}
/**
* Add an entry to the Lite Connect API.
*
* @since 1.7.4
*
* @param string $access_token The access token.
* @param int $form_id The form ID.
* @param string $entry_data The entry data.
*
* @return false|string
*/
public function add_form_entry( $access_token, $form_id, $entry_data ) {
return $this->request(
'/storage/entries',
[
'site_id' => $this->site_id,
'form_id' => $form_id,
'data' => $entry_data,
],
[
'X-WPForms-Lite-Connect-Access-Token' => $access_token,
]
);
}
/**
* Build the user-agent string for Lite Connect API requests.
*
* @since 2.0.2
*
* @return string
*/
private static function get_user_agent(): string {
return 'WPForms/' . WPFORMS_VERSION . '; ' . home_url();
}
/**
* Send a POST request to a Lite Connect API endpoint.
*
* Shared transport for both instance-based `request()` and static callers
* like `Integration::get_stats()`. Applies the canonical timeout filter
* and user-agent header.
*
* @since 2.0.2
*
* @param string $url Full endpoint URL.
* @param array $body Request body.
* @param array $headers HTTP headers.
*
* @return array|WP_Error Raw `wp_remote_post()` response.
*/
public static function post( string $url, array $body, array $headers = [] ) {
/**
* Allow to filter Lite Connect request timeout.
*
* @since 1.8.8
*
* @param int $timeout Timeout value in seconds.
*/
$timeout = (int) apply_filters( 'wpforms_integrations_lite_connect_api_request_timeout', 60 );
return wp_remote_post(
$url,
[
'timeout' => $timeout,
'headers' => $headers,
'body' => $body,
'user-agent' => self::get_user_agent(),
]
);
}
/**
* Send a request to the Lite Connect API.
*
* @since 1.7.4
*
* @param string $uri The request's URI.
* @param array $body The request's body.
* @param array $headers The HTTP headers.
*
* @return false|string
*/
protected function request( $uri, $body, $headers = [] ) {
$url = $this->api_url . $uri;
$response = self::post( $url, $body, $headers );
if (
is_wp_error( $response ) ||
(
isset( $response['response']['code'] ) &&
(int) $response['response']['code'] !== 200
)
) {
if ( ! is_wp_error( $response ) ) {
unset( $response['headers'], $response['http_response'], $response['cookies'], $response['filename'] );
}
$args = [
'type' => [ 'error' ],
];
if ( isset( $body['form_id'] ) ) {
$args['form_id'] = $body['form_id'];
}
wpforms_log(
'Lite Connect: remote API request error',
[
'response' => $response,
'request' => [
'url' => $url,
'body' => $this->prepare_log_data( $body ),
'headers' => $this->prepare_log_data( $headers ),
'user-agent' => self::get_user_agent(),
],
],
$args
);
}
if ( is_wp_error( $response ) ) {
return false;
}
return wp_remote_retrieve_body( $response );
}
/**
* Prepare data for logging.
*
* @since 1.7.4
*
* @param mixed $data Data to log.
*
* @return mixed
*/
private function prepare_log_data( $data ) {
$asterisks = '***';
if ( ! empty( $data['X-WPForms-Lite-Connect-Access-Token'] ) ) {
$data['X-WPForms-Lite-Connect-Access-Token'] = $asterisks;
}
if ( ! empty( $data['X-WPForms-Lite-Connect-Site-Key'] ) ) {
$data['X-WPForms-Lite-Connect-Site-Key'] = $asterisks;
}
if ( ! empty( $data['nonce'] ) ) {
$data['nonce'] = $asterisks;
}
return $data;
}
/**
* Get debug setting.
*
* @since 1.7.4
*
* @param string $name Setting name.
*
* @return false|mixed
*/
protected function get_debug_setting( $name ) {
// To be defined in wp-config.php.
if ( ! defined( 'WPFORMS_DEBUG_LITE_CONNECT' ) || ! is_array( WPFORMS_DEBUG_LITE_CONNECT ) ) {
return false;
}
return ! empty( WPFORMS_DEBUG_LITE_CONNECT[ $name ] ) ? WPFORMS_DEBUG_LITE_CONNECT[ $name ] : false;
}
/**
* Create not logged in nonce.
* We need it, because callback from the server to the wpforms/auth/key/nonce will be processed as not logged in.
*
* @since 1.7.4
*
* @return string
*/
private function create_not_logged_in_nonce() {
$user = wp_get_current_user();
$user_id = $user ? $user->ID : 0;
wp_set_current_user( 0 );
$saved_cookie = $_COOKIE;
$_COOKIE = [];
$nonce = wp_create_nonce( self::KEY_NONCE_ACTION );
$_COOKIE = $saved_cookie;
wp_set_current_user( $user_id );
return $nonce;
}
/**
* Set site ID.
*
* @since 1.7.4
*
* @return void
*/
private function set_site_id() {
// At first, try to use the site ID from the wp-config.php file.
$debug_site_id = $this->get_debug_setting( 'id' );
if ( $debug_site_id !== false ) {
$this->site_id = $debug_site_id;
return;
}
// Otherwise, use the site ID generated and saved as setting.
$site = wpforms_setting( 'site', false, Integration::get_option_name() );
if ( ! isset( $site['id'] ) ) {
return;
}
$this->site_id = $site['id'];
}
/**
* Check that we have not reached the max number of attempts to get keys from API using generate_keys().
*
* @since 1.7.5
*
* @return bool
*/
private function is_max_generate_key_attempts_reached() {
$attempts_count = get_option( self::GENERATE_KEY_ATTEMPT_COUNTER_OPTION, 0 );
return $attempts_count >= self::MAX_GENERATE_KEY_ATTEMPTS;
}
/**
* Update count of the attempts to get keys from API using generate_keys().
* It allows us to prevent sending requests to the API server infinitely.
*
* @since 1.7.5
*/
private function update_generate_key_attempts_count() {
global $wpdb;
$counter = get_option( self::GENERATE_KEY_ATTEMPT_COUNTER_OPTION, 0 );
if ( $counter >= self::MAX_GENERATE_KEY_ATTEMPTS - 1 ) {
// Disable Lite Connect.
$wpforms_settings = get_option( 'wpforms_settings', [] );
$wpforms_settings[ LiteConnect::SETTINGS_SLUG ] = 0;
update_option( 'wpforms_settings', $wpforms_settings );
}
// Store actual attempt counter value to the option.
// We need here an atomic operation to avoid race conditions with getting site key via callback.
// phpcs:disable WordPress.PHP.DiscouragedPHPFunctions.serialize_serialize
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
$wpdb->query(
$wpdb->prepare(
"INSERT INTO $wpdb->options
(option_name, option_value, autoload)
VALUES ( %s, 1, 'no' )
ON DUPLICATE KEY UPDATE
option_value = option_value + 1",
self::GENERATE_KEY_ATTEMPT_COUNTER_OPTION
)
);
// phpcs:enable WordPress.PHP.DiscouragedPHPFunctions.serialize_serialize
wp_cache_delete( self::GENERATE_KEY_ATTEMPT_COUNTER_OPTION, 'options' );
}
}