class-wp-rest-post-statuses-controller.php 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373
  1. <?php
  2. /**
  3. * REST API: WP_REST_Post_Statuses_Controller class
  4. *
  5. * @package WordPress
  6. * @subpackage REST_API
  7. * @since 4.7.0
  8. */
  9. /**
  10. * Core class used to access post statuses via the REST API.
  11. *
  12. * @since 4.7.0
  13. *
  14. * @see WP_REST_Controller
  15. */
  16. class WP_REST_Post_Statuses_Controller extends WP_REST_Controller {
  17. /**
  18. * Constructor.
  19. *
  20. * @since 4.7.0
  21. */
  22. public function __construct() {
  23. $this->namespace = 'wp/v2';
  24. $this->rest_base = 'statuses';
  25. }
  26. /**
  27. * Registers the routes for post statuses.
  28. *
  29. * @since 4.7.0
  30. *
  31. * @see register_rest_route()
  32. */
  33. public function register_routes() {
  34. register_rest_route(
  35. $this->namespace,
  36. '/' . $this->rest_base,
  37. array(
  38. array(
  39. 'methods' => WP_REST_Server::READABLE,
  40. 'callback' => array( $this, 'get_items' ),
  41. 'permission_callback' => array( $this, 'get_items_permissions_check' ),
  42. 'args' => $this->get_collection_params(),
  43. ),
  44. 'schema' => array( $this, 'get_public_item_schema' ),
  45. )
  46. );
  47. register_rest_route(
  48. $this->namespace,
  49. '/' . $this->rest_base . '/(?P<status>[\w-]+)',
  50. array(
  51. 'args' => array(
  52. 'status' => array(
  53. 'description' => __( 'An alphanumeric identifier for the status.' ),
  54. 'type' => 'string',
  55. ),
  56. ),
  57. array(
  58. 'methods' => WP_REST_Server::READABLE,
  59. 'callback' => array( $this, 'get_item' ),
  60. 'permission_callback' => array( $this, 'get_item_permissions_check' ),
  61. 'args' => array(
  62. 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
  63. ),
  64. ),
  65. 'schema' => array( $this, 'get_public_item_schema' ),
  66. )
  67. );
  68. }
  69. /**
  70. * Checks whether a given request has permission to read post statuses.
  71. *
  72. * @since 4.7.0
  73. *
  74. * @param WP_REST_Request $request Full details about the request.
  75. * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
  76. */
  77. public function get_items_permissions_check( $request ) {
  78. if ( 'edit' === $request['context'] ) {
  79. $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
  80. foreach ( $types as $type ) {
  81. if ( current_user_can( $type->cap->edit_posts ) ) {
  82. return true;
  83. }
  84. }
  85. return new WP_Error(
  86. 'rest_cannot_view',
  87. __( 'Sorry, you are not allowed to manage post statuses.' ),
  88. array( 'status' => rest_authorization_required_code() )
  89. );
  90. }
  91. return true;
  92. }
  93. /**
  94. * Retrieves all post statuses, depending on user context.
  95. *
  96. * @since 4.7.0
  97. *
  98. * @param WP_REST_Request $request Full details about the request.
  99. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  100. */
  101. public function get_items( $request ) {
  102. $data = array();
  103. $statuses = get_post_stati( array( 'internal' => false ), 'object' );
  104. $statuses['trash'] = get_post_status_object( 'trash' );
  105. foreach ( $statuses as $slug => $obj ) {
  106. $ret = $this->check_read_permission( $obj );
  107. if ( ! $ret ) {
  108. continue;
  109. }
  110. $status = $this->prepare_item_for_response( $obj, $request );
  111. $data[ $obj->name ] = $this->prepare_response_for_collection( $status );
  112. }
  113. return rest_ensure_response( $data );
  114. }
  115. /**
  116. * Checks if a given request has access to read a post status.
  117. *
  118. * @since 4.7.0
  119. *
  120. * @param WP_REST_Request $request Full details about the request.
  121. * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
  122. */
  123. public function get_item_permissions_check( $request ) {
  124. $status = get_post_status_object( $request['status'] );
  125. if ( empty( $status ) ) {
  126. return new WP_Error(
  127. 'rest_status_invalid',
  128. __( 'Invalid status.' ),
  129. array( 'status' => 404 )
  130. );
  131. }
  132. $check = $this->check_read_permission( $status );
  133. if ( ! $check ) {
  134. return new WP_Error(
  135. 'rest_cannot_read_status',
  136. __( 'Cannot view status.' ),
  137. array( 'status' => rest_authorization_required_code() )
  138. );
  139. }
  140. return true;
  141. }
  142. /**
  143. * Checks whether a given post status should be visible.
  144. *
  145. * @since 4.7.0
  146. *
  147. * @param object $status Post status.
  148. * @return bool True if the post status is visible, otherwise false.
  149. */
  150. protected function check_read_permission( $status ) {
  151. if ( true === $status->public ) {
  152. return true;
  153. }
  154. if ( false === $status->internal || 'trash' === $status->name ) {
  155. $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
  156. foreach ( $types as $type ) {
  157. if ( current_user_can( $type->cap->edit_posts ) ) {
  158. return true;
  159. }
  160. }
  161. }
  162. return false;
  163. }
  164. /**
  165. * Retrieves a specific post status.
  166. *
  167. * @since 4.7.0
  168. *
  169. * @param WP_REST_Request $request Full details about the request.
  170. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  171. */
  172. public function get_item( $request ) {
  173. $obj = get_post_status_object( $request['status'] );
  174. if ( empty( $obj ) ) {
  175. return new WP_Error(
  176. 'rest_status_invalid',
  177. __( 'Invalid status.' ),
  178. array( 'status' => 404 )
  179. );
  180. }
  181. $data = $this->prepare_item_for_response( $obj, $request );
  182. return rest_ensure_response( $data );
  183. }
  184. /**
  185. * Prepares a post status object for serialization.
  186. *
  187. * @since 4.7.0
  188. * @since 5.9.0 Renamed `$status` to `$item` to match parent class for PHP 8 named parameter support.
  189. *
  190. * @param stdClass $item Post status data.
  191. * @param WP_REST_Request $request Full details about the request.
  192. * @return WP_REST_Response Post status data.
  193. */
  194. public function prepare_item_for_response( $item, $request ) {
  195. // Restores the more descriptive, specific name for use within this method.
  196. $status = $item;
  197. $fields = $this->get_fields_for_response( $request );
  198. $data = array();
  199. if ( in_array( 'name', $fields, true ) ) {
  200. $data['name'] = $status->label;
  201. }
  202. if ( in_array( 'private', $fields, true ) ) {
  203. $data['private'] = (bool) $status->private;
  204. }
  205. if ( in_array( 'protected', $fields, true ) ) {
  206. $data['protected'] = (bool) $status->protected;
  207. }
  208. if ( in_array( 'public', $fields, true ) ) {
  209. $data['public'] = (bool) $status->public;
  210. }
  211. if ( in_array( 'queryable', $fields, true ) ) {
  212. $data['queryable'] = (bool) $status->publicly_queryable;
  213. }
  214. if ( in_array( 'show_in_list', $fields, true ) ) {
  215. $data['show_in_list'] = (bool) $status->show_in_admin_all_list;
  216. }
  217. if ( in_array( 'slug', $fields, true ) ) {
  218. $data['slug'] = $status->name;
  219. }
  220. if ( in_array( 'date_floating', $fields, true ) ) {
  221. $data['date_floating'] = $status->date_floating;
  222. }
  223. $context = ! empty( $request['context'] ) ? $request['context'] : 'view';
  224. $data = $this->add_additional_fields_to_object( $data, $request );
  225. $data = $this->filter_response_by_context( $data, $context );
  226. $response = rest_ensure_response( $data );
  227. $rest_url = rest_url( rest_get_route_for_post_type_items( 'post' ) );
  228. if ( 'publish' === $status->name ) {
  229. $response->add_link( 'archives', $rest_url );
  230. } else {
  231. $response->add_link( 'archives', add_query_arg( 'status', $status->name, $rest_url ) );
  232. }
  233. /**
  234. * Filters a post status returned from the REST API.
  235. *
  236. * Allows modification of the status data right before it is returned.
  237. *
  238. * @since 4.7.0
  239. *
  240. * @param WP_REST_Response $response The response object.
  241. * @param object $status The original post status object.
  242. * @param WP_REST_Request $request Request used to generate the response.
  243. */
  244. return apply_filters( 'rest_prepare_status', $response, $status, $request );
  245. }
  246. /**
  247. * Retrieves the post status' schema, conforming to JSON Schema.
  248. *
  249. * @since 4.7.0
  250. *
  251. * @return array Item schema data.
  252. */
  253. public function get_item_schema() {
  254. if ( $this->schema ) {
  255. return $this->add_additional_fields_schema( $this->schema );
  256. }
  257. $schema = array(
  258. '$schema' => 'http://json-schema.org/draft-04/schema#',
  259. 'title' => 'status',
  260. 'type' => 'object',
  261. 'properties' => array(
  262. 'name' => array(
  263. 'description' => __( 'The title for the status.' ),
  264. 'type' => 'string',
  265. 'context' => array( 'embed', 'view', 'edit' ),
  266. 'readonly' => true,
  267. ),
  268. 'private' => array(
  269. 'description' => __( 'Whether posts with this status should be private.' ),
  270. 'type' => 'boolean',
  271. 'context' => array( 'edit' ),
  272. 'readonly' => true,
  273. ),
  274. 'protected' => array(
  275. 'description' => __( 'Whether posts with this status should be protected.' ),
  276. 'type' => 'boolean',
  277. 'context' => array( 'edit' ),
  278. 'readonly' => true,
  279. ),
  280. 'public' => array(
  281. 'description' => __( 'Whether posts of this status should be shown in the front end of the site.' ),
  282. 'type' => 'boolean',
  283. 'context' => array( 'view', 'edit' ),
  284. 'readonly' => true,
  285. ),
  286. 'queryable' => array(
  287. 'description' => __( 'Whether posts with this status should be publicly-queryable.' ),
  288. 'type' => 'boolean',
  289. 'context' => array( 'view', 'edit' ),
  290. 'readonly' => true,
  291. ),
  292. 'show_in_list' => array(
  293. 'description' => __( 'Whether to include posts in the edit listing for their post type.' ),
  294. 'type' => 'boolean',
  295. 'context' => array( 'edit' ),
  296. 'readonly' => true,
  297. ),
  298. 'slug' => array(
  299. 'description' => __( 'An alphanumeric identifier for the status.' ),
  300. 'type' => 'string',
  301. 'context' => array( 'embed', 'view', 'edit' ),
  302. 'readonly' => true,
  303. ),
  304. 'date_floating' => array(
  305. 'description' => __( 'Whether posts of this status may have floating published dates.' ),
  306. 'type' => 'boolean',
  307. 'context' => array( 'view', 'edit' ),
  308. 'readonly' => true,
  309. ),
  310. ),
  311. );
  312. $this->schema = $schema;
  313. return $this->add_additional_fields_schema( $this->schema );
  314. }
  315. /**
  316. * Retrieves the query params for collections.
  317. *
  318. * @since 4.7.0
  319. *
  320. * @return array Collection parameters.
  321. */
  322. public function get_collection_params() {
  323. return array(
  324. 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
  325. );
  326. }
  327. }