• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

wp-graphql / wp-graphql-woocommerce / 6282474781

23 Sep 2023 07:50AM UTC coverage: 84.793% (+0.1%) from 84.684%
6282474781

push

github

web-flow
feat: `collectionStats` query added (#785)

* feat: collectionStats query added

* fix: `collectionStats` query completed and tested.

* chore: Linter and PHPStan compliance met

* chore: ProductTaxonomy values fixed.

* chore: CollectionStatsQueryTest tweaked for CI

563 of 563 new or added lines in 12 files covered. (100.0%)

11029 of 13007 relevant lines covered (84.79%)

58.98 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

39.17
/includes/utils/class-protected-router.php
1
<?php
2
/**
3
 * Sets up the auth endpoint
4
 *
5
 * @package WPGraphQL\WooCommerce\Utils
6
 * @since   0.12.5
7
 */
8

9
namespace WPGraphQL\WooCommerce\Utils;
10

11
use WPGraphQL\WooCommerce\WooCommerce_Filters;
12

13
/**
14
 * Class Protected_Router
15
 */
16
class Protected_Router {
17
        /**
18
         * Stores the instance of the Protected_Router class
19
         *
20
         * @var null|\WPGraphQL\WooCommerce\Utils\Protected_Router
21
         */
22
        private static $instance = null;
23

24
        /**
25
         * The default route
26
         *
27
         * @var string
28
         */
29
        public static $default_route = 'transfer-session';
30

31
        /**
32
         * Sets the route to use as the endpoint
33
         *
34
         * @var string
35
         */
36
        public static $route = null;
37

38
        /**
39
         * Set the default status code to 200.
40
         *
41
         * @var int
42
         */
43
        public static $http_status_code = 200;
44

45
        /**
46
         * Protected_Router constructor
47
         */
48
        private function __construct() {
49
                self::$route = woographql_setting( 'authorizing_url_endpoint', apply_filters( 'woographql_authorizing_url_endpoint', self::$default_route ) );
×
50
                /**
51
                 * Create the rewrite rule for the route
52
                 */
53
                add_action( 'init', [ $this, 'add_rewrite_rule' ], 10 );
×
54

55
                /**
56
                 * Add the query var for the route
57
                 */
58
                add_filter( 'query_vars', [ $this, 'add_query_var' ], 1, 1 );
×
59

60
                /**
61
                 * Redirects the route to the graphql processor
62
                 */
63
                add_action( 'pre_get_posts', [ $this, 'resolve_request' ], 1 );
×
64
        }
65

66
        /**
67
         * Returns the Protected_Router singleton instance.
68
         *
69
         * @return \WPGraphQL\WooCommerce\Utils\Protected_Router
70
         */
71
        public static function instance() {
72
                if ( is_null( self::$instance ) ) {
4✔
73
                        self::$instance = new self();
×
74
                }
75

76
                // Return the Protected_Router Instance.
77
                return self::$instance;
4✔
78
        }
79

80
        /**
81
         * Initializes the Protected_Router singleton.
82
         *
83
         * @return void
84
         */
85
        public static function initialize() {
86
                self::instance();
×
87
        }
88

89
        /**
90
         * Throw error on object clone.
91
         * The whole idea of the singleton design pattern is that there is a single object
92
         * therefore, we don't want the object to be cloned.
93
         *
94
         * @return void
95
         */
96
        public function __clone() {
97
                // Cloning instances of the class is forbidden.
98
                _doing_it_wrong( __FUNCTION__, esc_html__( 'Protected_Router class should not be cloned.', 'wp-graphql-woocommerce' ), esc_html( WPGRAPHQL_WOOCOMMERCE_VERSION ) );
×
99
        }
100

101
        /**
102
         * Disable unserializing of the class.
103
         *
104
         * @return void
105
         */
106
        public function __wakeup() {
107
                // De-serializing instances of the class is forbidden.
108
                _doing_it_wrong( __FUNCTION__, esc_html__( 'De-serializing instances of the Protected_Router class is not allowed', 'wp-graphql-woocommerce' ), esc_html( WPGRAPHQL_WOOCOMMERCE_VERSION ) );
×
109
        }
110

111
        /**
112
         * Adds rewrite rule for the route endpoint
113
         *
114
         * @return void
115
         */
116
        public function add_rewrite_rule() {
117
                add_rewrite_rule(
×
118
                        self::$route . '/?$',
×
119
                        'index.php?' . self::$route . '=true',
×
120
                        'top'
×
121
                );
×
122
        }
123

124
        /**
125
         * Adds the query_var for the route
126
         *
127
         * @param array $query_vars The array of whitelisted query variables.
128
         *
129
         * @return array
130
         */
131
        public function add_query_var( $query_vars ) {
132
                $query_vars[] = self::$route;
1✔
133

134
                return $query_vars;
1✔
135
        }
136

137
        /**
138
         * Returns true when the current request is a request to download the plugin.
139
         *
140
         * @return boolean
141
         */
142
        public static function is_auth_request() {
143
                $is_auth_request = false;
113✔
144
                if ( isset( $_GET[ self::$route ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
113✔
145
                        $is_auth_request = true;
×
146
                } else {
147
                        // Check the server to determine if the auth endpoint is being requested.
148
                        if ( isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_URI'] ) ) {
113✔
149
                                $host = wp_unslash( $_SERVER['HTTP_HOST'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102✔
150
                                $uri  = wp_unslash( $_SERVER['REQUEST_URI'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102✔
151

152
                                if ( ! is_string( $host ) ) {
102✔
153
                                        return false;
×
154
                                }
155

156
                                if ( ! is_string( $uri ) ) {
102✔
157
                                        return false;
×
158
                                }
159

160
                                $parsed_site_url    = wp_parse_url( site_url( self::$route ), PHP_URL_PATH );
102✔
161
                                $auth_url           = ! empty( $parsed_site_url ) ? wp_unslash( $parsed_site_url ) : self::$route;
102✔
162
                                $parsed_request_url = wp_parse_url( $uri, PHP_URL_PATH );
102✔
163
                                $request_url        = ! empty( $parsed_request_url ) ? wp_unslash( $parsed_request_url ) : '';
102✔
164

165
                                // Determine if the route is indeed a download request.
166
                                $is_auth_request = false !== strpos( $request_url, $auth_url );
102✔
167
                        }//end if
168
                }//end if
169

170
                /**
171
                 * Filter whether the request is a download request. Default is false.
172
                 *
173
                 * @param boolean $is_download_request Whether the request is a request to download the plugin. Default false.
174
                 */
175
                return apply_filters( 'woographql_is_auth_request', $is_auth_request );
113✔
176
        }
177

178
        /**
179
         * This resolves the http request and ensures that WordPress can respond with the appropriate
180
         * response instead of responding with a template from the standard WordPress Template
181
         * Loading process
182
         *
183
         * @return void
184
         */
185
        public function resolve_request() {
186

187
                /**
188
                 * Access the $wp_query object
189
                 */
190
                global $wp_query;
103✔
191

192
                /**
193
                 * Ensure we're on the registered route for graphql route
194
                 */
195
                if ( ! $this->is_auth_request() ) {
103✔
196
                        return;
103✔
197
                }
198

199
                /**
200
                 * Set is_home to false
201
                 */
202
                $wp_query->is_home = false;
×
203

204
                /**
205
                 * Process the GraphQL query Request
206
                 */
207
                $this->process_auth_request();
×
208
        }
209

210
        /**
211
         * Returns the name of all the valid nonce names.
212
         *
213
         * @return array
214
         */
215
        public static function get_nonce_names() {
216
                $enabled_authorizing_url_fields = WooCommerce_Filters::enabled_authorizing_url_fields();
4✔
217
                if ( empty( $enabled_authorizing_url_fields ) ) {
4✔
218
                        return [];
×
219
                }
220
                $nonce_names = [];
4✔
221
                foreach ( array_keys( $enabled_authorizing_url_fields ) as $field ) {
4✔
222
                        $nonce_names[ $field ] = WooCommerce_Filters::get_authorizing_url_nonce_param_name( $field );
4✔
223
                }
224

225
                return array_filter( $nonce_names );
4✔
226
        }
227

228
        /**
229
         * Returns the nonce action prefix for the provided field.
230
         *
231
         * @param string $field  Field.
232
         * @return string|null
233
         */
234
        public function get_nonce_prefix( $field ) {
235
                switch ( $field ) {
236
                        case 'cart_url':
2✔
237
                                return 'load-cart_';
1✔
238
                        case 'checkout_url':
2✔
239
                                return 'load-checkout_';
1✔
240
                        case 'account_url':
2✔
241
                                return 'load-account_';
1✔
242
                        case 'add_payment_method_url':
2✔
243
                                return 'add-payment-method_';
1✔
244
                        default:
245
                                return apply_filters( 'woographql_auth_nonce_prefix', null, $field, $this );
2✔
246
                }
247
        }
248

249
        /**
250
         * Returns the target endpoint url for the provided field.
251
         *
252
         * @todo Add error logging here when WC Page needs to be created.
253
         *
254
         * @param string $field  Field.
255
         * @return string|null
256
         */
257
        public function get_target_endpoint( $field ) {
258
                switch ( $field ) {
259
                        case 'cart_url':
1✔
260
                                $cart_page_id  = wc_get_page_id( 'cart' );
1✔
261
                                $cart_page_url = get_permalink( $cart_page_id );
1✔
262
                                return $cart_page_url ? $cart_page_url : null;
1✔
263
                        case 'checkout_url':
1✔
264
                                return wc_get_endpoint_url( 'checkout' );
1✔
265
                        case 'account_url':
1✔
266
                                $account_page_id  = get_option( 'woocommerce_myaccount_page_id' );
1✔
267
                                $account_page_url = get_permalink( $account_page_id );
1✔
268
                                return $account_page_url ? $account_page_url : null;
1✔
269
                        case 'add_payment_method_url':
1✔
270
                                return wc_get_account_endpoint_url( 'add-payment-method' );
1✔
271
                        default:
272
                                return apply_filters( 'woographql_auth_target_endpoint', null, $field, $this );
×
273
                }
274
        }
275

276
        /**
277
         * Redirects to homepage.
278
         *
279
         * @return void
280
         */
281
        private function redirect_to_home() {
282
                status_header( 404 );
×
283
                wp_safe_redirect( home_url() );
×
284
                exit;
×
285
        }
286

287
        /**
288
         * Send stable version of plugin to download.
289
         *
290
         * @throws \Exception Session not found.
291
         *
292
         * @return void
293
         */
294
        private function process_auth_request() {
295
                // Bail early if session ID or nonce not found.
296
                $nonce_names = $this->get_nonce_names();
×
297
                if ( empty( $nonce_names ) ) {
×
298
                        $this->redirect_to_home();
×
299
                        return;
×
300
                }
301

302
                /**
303
                 * Nonce prefix
304
                 *
305
                 * @var string $nonce_prefix
306
                 */
307
                $nonce_prefix = null;
×
308

309
                /**
310
                 * Session ID
311
                 *
312
                 * @var string $session_id
313
                 */
314
                $session_id = null;
×
315

316
                /**
317
                 * Nonce
318
                 *
319
                 * @var string $nonce
320
                 */
321
                $nonce = null;
×
322

323
                /**
324
                 * Field
325
                 *
326
                 * @var string $field
327
                 */
328
                $field = null;
×
329
                foreach ( $nonce_names as $possible_field => $nonce_param ) {
×
330
                        if ( in_array( $nonce_param, array_keys( $_REQUEST ), true ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
331
                                $field        = $possible_field;
×
332
                                $nonce_prefix = $this->get_nonce_prefix( $field );
×
333
                                $session_id   = isset( $_REQUEST['session_id'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['session_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
334
                                $nonce        = isset( $_REQUEST[ $nonce_param ] ) ? sanitize_text_field( wp_unslash( $_REQUEST[ $nonce_param ] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
×
335
                                break;
×
336
                        }
337
                }
338

339
                if ( empty( $field ) || empty( $nonce_prefix ) || empty( $session_id ) || empty( $nonce ) ) {
×
340
                        $this->redirect_to_home();
×
341
                        return;
×
342
                }
343

344
                // Bail early if session user already authenticated.
345
                if ( 0 !== get_current_user_id() && get_current_user_id() === absint( $session_id ) ) {
×
346
                        $redirect_url = $this->get_target_endpoint( (string) $field );
×
347
                        if ( empty( $redirect_url ) ) {
×
348
                                $this->redirect_to_home();
×
349
                                return;
×
350
                        }
351
                        wp_safe_redirect( $redirect_url );
×
352
                        exit;
×
353
                }
354

355
                // Unauthenticate if current user not session user.
356
                if ( 0 !== get_current_user_id() ) {
×
357
                        wp_clear_auth_cookie();
×
358
                        wp_set_current_user( 0 );
×
359
                }
360

361
                // Verify nonce.
362
                if ( null !== $nonce && ! woographql_verify_nonce( $nonce, $nonce_prefix . $session_id ) ) {
×
363
                        $this->redirect_to_home();
×
364
                }
365

366
                do_action( 'woographql_process_auth_request_nonce_verified' );
×
367

368
                // If Session ID is a user ID authenticate as session user.
369
                if ( 0 !== absint( $session_id ) ) {
×
370
                        $user_id = absint( $session_id );
×
371
                        wp_clear_auth_cookie();
×
372
                        wp_set_current_user( $user_id );
×
373
                        wp_set_auth_cookie( $user_id );
×
374
                }
375

376
                /**
377
                 * Session object
378
                 *
379
                 * @var \WPGraphQL\WooCommerce\Utils\Transfer_Session_Handler $session
380
                 */
381
                $session = \WC()->session;
×
382

383
                // Read session data connected to session ID.
384
                $session_data = $session->get_session( $session_id );
×
385

386
                // We were passed a session ID, yet no session was found. Let's log this and bail.
387
                if ( ! is_array( $session_data ) || empty( $session_data ) ) {
×
388
                        // TODO: Switch to WC Notices.
389
                        throw new \Exception( 'Could not locate WooCommerce session on checkout' );
×
390
                }
391

392
                // Reinitialize session and save session cookie before redirect.
393
                $session->init_session_cookie();
×
394

395
                // Set the session variable.
396
                foreach ( $session_data as $key => $value ) {
×
397
                        $session->set( $key, maybe_unserialize( $value ) );
×
398
                }
399
                $session->set_customer_session_cookie( true );
×
400

401
                // After session has been restored on redirect to destination.
402
                $redirect_url = $this->get_target_endpoint( (string) $field );
×
403
                if ( empty( $redirect_url ) ) {
×
404
                        $this->redirect_to_home();
×
405
                        return;
×
406
                }
407
                wp_safe_redirect( $redirect_url );
×
408
                exit;
×
409
        }
410
}
411

STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc