class-gv-rest-views-route.php

Go to the documentation of this file.

<?php
/**
 * @package   GravityView
 * @license   GPL2+
 * @author    Josh Pollock <[email protected]>
 * @link      http://gravityview.co
 * @copyright Copyright 2015, Katz Web Services, Inc.
 *
 * @since 2.0
 */
namespace GV\REST;

/** If this file is called directly, abort. */
if ( ! defined( 'GRAVITYVIEW_DIR' ) ) {
    die();
}

class Views_Route extends Route {
    /**
     * Route Name
     *
     * @since 2.0
     *
     * @access protected
     * @string
     */
    protected $route_name = 'views';

    /**
     * Sub type, forms {$namespace}/route_name/{id}/sub_type type endpoints
     *
     * @since 2.0
     * @access protected
     * @var string
     */
    protected $sub_type = 'entries';


    /**
     * Get a collection of views
     *
     * Callback for GET /v1/views/
     *
     * @param \WP_REST_Request $request Full data about the request.
     * @return \WP_Error|\WP_REST_Response
     */
    public function get_items( $request ) {

        $page = $request->get_param( 'page' );
        $limit = $request->get_param( 'limit' );

        $items = \GVCommon::get_all_views( array(
            'posts_per_page' => $limit,
            'paged' => $page,
        ) );

        if ( empty( $items ) ) {
            return new \WP_Error( 'gravityview-no-views', __( 'No Views found.', 'gk-gravityview' ) ); //@todo message
        }

        $data = array(
            'views' => array(),
            'total' => wp_count_posts( 'gravityview' )->publish,
        );
        foreach ( $items as $item ) {
            $data['views'][] = $this->prepare_view_for_response( $item, $request );
        }

        return new \WP_REST_Response( $data, 200 );
    }

    /**
     * Get one view
     *
     * Callback for /v1/views/{id}/
     *
     * @since 2.0
     * @param \WP_REST_Request $request Full data about the request.
     * @return \WP_Error|\WP_REST_Response
     */
    public function get_item( $request ) {

        $url = $request->get_url_params();

        $view_id = intval( $url['id'] );

        $item = get_post( $view_id );

        //return a response or error based on some conditional
        if ( $item && ! is_wp_error( $item ) ) {
            $data = $this->prepare_view_for_response( $item, $request );
            return new \WP_REST_Response( $data, 200 );
        }

        return new \WP_Error( 'code', sprintf( 'A View with ID #%d was not found.', $view_id ) );
    }

    /**
     * Prepare the item for the REST response
     *
     * @since 2.0
     * @param \GV\View $view The view.
     * @param \GV\Entry $entry WordPress representation of the item.
     * @param \WP_REST_Request $request Request object.
     * @param string $context The context (directory, single)
     * @param string $class The value renderer. Default: null (raw value)
     *
     * @since 2.1 Add value renderer override $class parameter.
     *
     * @return mixed The data that is sent.
     */
    public function prepare_entry_for_response( $view, $entry, \WP_REST_Request $request, $context, $class = null ) {

        // Only output the fields that should be displayed.
        $allowed = array();
        foreach ( $view->fields->by_position( "{$context}_*" )->by_visible( $view )->all() as $field ) {
            $allowed[] = $field;
        }

        /**
         * @filter `gravityview/rest/entry/fields` Allow more entry fields that are output in regular REST requests.
         * @param array $allowed The allowed ones, default by_visible, by_position( "context_*" ), i.e. as set in the view.
         * @param \GV\View $view The view.
         * @param \GV\Entry $entry The entry.
         * @param \WP_REST_Request $request Request object.
         * @param string $context The context (directory, single)
         */
        $allowed_field_ids = apply_filters( 'gravityview/rest/entry/fields', wp_list_pluck( $allowed, 'ID' ), $view, $entry, $request, $context );

        $allowed = array_filter( $allowed, function( $field ) use ( $allowed_field_ids ) {
            return in_array( $field->ID, $allowed_field_ids, true );
        } );

        // Tack on additional fields if needed
        foreach ( array_diff( $allowed_field_ids, wp_list_pluck( $allowed, 'ID' ) ) as $field_id ) {
            $allowed[] = is_numeric( $field_id ) ? \GV\GF_Field::by_id( $view->form, $field_id ) : \GV\Internal_Field::by_id( $field_id );
        }

        $r = new Request( $request );
        $return = array();

        $renderer = new \GV\Field_Renderer();

        $used_ids = array();

        foreach ( $allowed as $field ) {
            $source = is_numeric( $field->ID ) ? $view->form : new \GV\Internal_Source();

            $field_id = $field->ID;
            $index = null;

            if ( ! isset( $used_ids[ $field_id ] ) ) {
                $used_ids[ $field_id ] = 0;
            } else {
                $index = ++$used_ids[ $field_id ];
            }

            if ( $index ) {
                /**
                 * Modify non-unique IDs (custom, id, etc.) to be unique and not gobbled up.
                 */
                $field_id = sprintf( '%s(%d)', $field_id, $index + 1 );
            }

            /**
             * @filter `gravityview/api/field/key` Filter the key name in the results for JSON output.
             * @param string $field_id The ID. Should be unique or keys will be gobbled up.
             * @param \GV\View $view The view.
             * @param \GV\Entry $entry The entry.
             * @param \WP_REST_Request $request Request object.
             * @param string $context The context (directory, single)
             */
            $field_id = apply_filters( 'gravityview/api/field/key', $field_id, $view, $entry, $request, $context );

            if ( ! $class && in_array( $field->ID, array( 'custom' ) ) ) {
                /**
                 * Custom fields (and perhaps some others) will require rendering as they don't
                 * contain an intrinsic value (for custom their value is stored in the view and requires a renderer).
                 * We force the CSV template to take over in such cases, it's good enough for most cases.
                 */
                $return[ $field_id ] = $renderer->render( $field, $view, $source, $entry, $r, '\GV\Field_CSV_Template' );
            } else if ( $class ) {
                $return[ $field_id ] = $renderer->render( $field, $view, $source, $entry, $r, $class );
            } else {
                switch ( $field->type ):
                    case 'list':
                        $return[ $field_id ] = unserialize( $field->get_value( $view, $source, $entry, $r ) );
                        break;
                    case 'fileupload':
                    case 'business_hours':
                        $return[ $field_id ] = json_decode( $field->get_value( $view, $source, $entry, $r ) );
                        break;
                    default;
                        $return[ $field_id ] = $field->get_value( $view, $source, $entry, $r );
                endswitch;
            }
        }

        return $return;
    }

    /**
     * Get entries from a view
     *
     * Callback for /v1/views/{id}/entries/
     *
     * @since 2.0
     * @param \WP_REST_Request $request Full data about the request.
     * @return \WP_Error|\WP_REST_Response
     */
    public function get_sub_items( $request ) {

        $url     = $request->get_url_params();
        $view_id = intval( $url['id'] );
        $format  = \GV\Utils::get( $url, 'format', 'json' );

        if( $post_id = $request->get_param('post_id') ) {
            global $post;

            $post = get_post( $post_id );

            if ( ! $post || is_wp_error( $post ) ) {
                return new \WP_Error( 'gravityview-post-not-found', sprintf( 'A post with ID #%d was not found.', $post_id ) );
            }

            $collection = \GV\View_Collection::from_post( $post );

            if ( ! $collection->contains( $view_id ) ) {
                return new \WP_Error( 'gravityview-post-not-contains', sprintf( 'The post with ID #%d does not contain a View with ID #%d', $post_id, $view_id ) );
            }
        }

        $view = \GV\View::by_id( $view_id );

        if ( 'html' === $format ) {

            $renderer = new \GV\View_Renderer();
            $count = $total = 0;

            /** @var \GV\Template_Context $context */
            add_action( 'gravityview/template/view/render', function( $context ) use ( &$count, &$total ) {
                $count = $context->entries->count();
                $total = $context->entries->total();
            } );

            $output = $renderer->render( $view, new Request( $request ) );

            /**
             * @filter `gravityview/rest/entries/html/insert_meta` Whether to include `http-equiv` meta tags in the HTML output describing the data
             * @since 2.0
             * @param bool $insert_meta Add <meta> tags? [Default: true]
             * @param int $count The number of entries being rendered
             * @param \GV\View $view The view.
             * @param \WP_REST_Request $request Request object.
             * @param int $total The number of total entries for the request
             */
            $insert_meta = apply_filters( 'gravityview/rest/entries/html/insert_meta', true, $count, $view, $request, $total );

            if ( $insert_meta ) {
                $output = '<meta http-equiv="X-Item-Count" content="' . $count . '" />' . $output;
                $output = '<meta http-equiv="X-Item-Total" content="' . $total . '" />' . $output;
            }

            $response = new \WP_REST_Response( $output, 200 );
            $response->header( 'X-Item-Count', $count );
            $response->header( 'X-Item-Total', $total );

            return $response;
        }

        $entries = $view->get_entries( new Request( $request ) );

        if ( ! $entries->all() ) {
            return new \WP_Error( 'gravityview-no-entries', __( 'No Entries found.', 'gk-gravityview' ) );
        }

        if ( in_array( $format, array( 'csv', 'tsv' ), true ) ) {

            ob_start();

            $csv_or_tsv = fopen( 'php://output', 'w' );

            /** Da' BOM :) */
            if ( apply_filters( 'gform_include_bom_export_entries', true, $view->form ? $view->form->form : null ) ) {
                fputs( $csv_or_tsv, "\xef\xbb\xbf" );
            }

            $headers_done = false;

            // If not "tsv" then use comma
            $delimiter = ( 'tsv' === $format ) ? "\t" : ',';

            foreach ( $entries->all() as $entry ) {
                $entry = $this->prepare_entry_for_response( $view, $entry, $request, 'directory', '\GV\Field_CSV_Template' );

                if ( ! $headers_done ) {
                    $headers_done = fputcsv( $csv_or_tsv, array_map( array( '\GV\Utils', 'strip_excel_formulas' ), array_keys( $entry ) ), $delimiter );
                }

                fputcsv( $csv_or_tsv, array_map( array( '\GV\Utils', 'strip_excel_formulas' ), $entry ), $delimiter );
            }

            $response = new \WP_REST_Response( '', 200 );
            $response->header( 'X-Item-Count', $entries->count() );
            $response->header( 'X-Item-Total', $entries->total() );
            $response->header( 'Content-Type', 'text/' . $format );

            fflush( $csv_or_tsv );

            $data = rtrim( ob_get_clean() );

            add_filter( 'rest_pre_serve_request', function() use ( $data ) {
                echo $data;
                return true;
            } );

            if ( defined( 'DOING_GRAVITYVIEW_TESTS' ) && DOING_GRAVITYVIEW_TESTS ) {
                echo $data; // rest_pre_serve_request is not called in tests
            }

            return $response;
        }

        $data = array( 'entries' => $entries->all(), 'total' => $entries->total() );

        foreach ( $data['entries'] as &$entry ) {
            $entry = $this->prepare_entry_for_response( $view, $entry, $request, 'directory' );
        }

        return new \WP_REST_Response( $data, 200 );
    }

    /**
     * Get one entry from view
     *
     * Callback for /v1/views/{id}/entries/{id}/
     *
     * @uses GVCommon::get_entry
     * @since 2.0
     * @param \WP_REST_Request $request Full data about the request.
     * @return \WP_Error|\WP_REST_Response
     */
    public function get_sub_item( $request ) {
        $url      = $request->get_url_params();
        $view_id  = intval( $url['id'] );
        $entry_id = intval( $url['s_id'] );
        $format   = \GV\Utils::get( $url, 'format', 'json' );

        $view  = \GV\View::by_id( $view_id );
        $entry = \GV\GF_Entry::by_id( $entry_id );

        if ( $format === 'html' ) {
            $renderer = new \GV\Entry_Renderer();
            return $renderer->render( $entry, $view, new Request( $request ) );
        }

        return $this->prepare_entry_for_response( $view, $entry, $request, 'single' );
    }

    /**
     * Prepare the item for the REST response
     *
     * @since 2.0
     * @param \WP_Post $view_post WordPress representation of the item.
     * @param \WP_REST_Request $request Request object.
     * @return mixed
     */
    public function prepare_view_for_response( $view_post, \WP_REST_Request $request ) {
        if ( is_wp_error( $this->get_item_permissions_check( $request, $view_post->ID ) ) ) {
            // Redacted out view.
            return array( 'ID' => $view_post->ID, 'post_content' => __( 'You are not allowed to access this content.', 'gk-gravityview' ) );
        }

        $view = \GV\View::from_post( $view_post );

        $item = $view->as_data();

        // Add all the WP_Post data
        $view_post = $view_post->to_array();

        unset( $view_post['to_ping'], $view_post['ping_status'], $view_post['pinged'], $view_post['post_type'], $view_post['filter'], $view_post['post_category'], $view_post['tags_input'], $view_post['post_content'], $view_post['post_content_filtered'] );

        $return = wp_parse_args( $item, $view_post );

        $return['title'] = $return['post_title'];

        $return['settings'] = isset( $return['atts'] ) ? $return['atts'] : array();
        unset( $return['atts'], $return['view_id'] );

        $return['search_criteria'] = array(
            'page_size' => rgars( $return, 'settings/page_size' ),
            'sort_field' => rgars( $return, 'settings/sort_field' ),
            'sort_direction' => rgars( $return, 'settings/sort_direction' ),
            'offset' => rgars( $return, 'settings/offset' ),
        );

        unset( $return['settings']['page_size'], $return['settings']['sort_field'], $return['settings']['sort_direction'] );

        // Redact for non-logged ins
        if ( ! \GVCommon::has_cap( 'edit_others_gravityviews' ) ) {
            unset( $return['settings'] );
            unset( $return['search_criteria'] );
        }

        if ( ! \GFCommon::current_user_can_any( 'gravityforms_edit_forms' ) ) {
            unset( $return['form'] );
        }

        return $return;
    }

    /**
     * @param \WP_REST_Request $request
     *
     * @return bool|\WP_Error
     */
    public function get_item_permissions_check( $request ) {
        if ( func_num_args() === 2 ) {
            $view_id = func_get_arg( 1 ); // $view_id override
        } else {
            $url     = $request->get_url_params();
            $view_id = intval( $url['id'] );
        }

        if ( ! $view = \GV\View::by_id( $view_id ) ) {
            return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gk-gravityview' ) );
        }

        while ( $error = $view->can_render( array( 'rest' ), $request ) ) {

            if ( ! is_wp_error( $error ) ) {
                break;
            }

            switch ( str_replace( 'gravityview/', '', $error->get_error_code() ) ) {
                case 'rest_disabled':
                case 'post_password_required':
                case 'not_public':
                case 'embed_only':
                case 'no_direct_access':
                    return new \WP_Error( 'rest_forbidden_access_denied', __( 'You are not allowed to access this content.', 'gk-gravityview' ) );
                case 'no_form_attached':
                    return new \WP_Error( 'rest_forbidden_no_form_attached', __( 'This View is not configured properly.', 'gk-gravityview' ) );
                default:
                    return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gk-gravityview' ) );
            }
        }

        /**
         * @filter `gravityview/view/output/rest` Disable rest output. Final chance.
         * @param bool Enable or not.
         * @param \GV\View $view The view.
         */
        if ( ! apply_filters( 'gravityview/view/output/rest', true, $view ) ) {
            return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gk-gravityview' ) );
        }

        return true;
    }

    public function get_sub_item_permissions_check( $request ) {
        // Accessing a single entry needs the View access permissions.
        if ( is_wp_error( $error = $this->get_items_permissions_check( $request ) ) ) {
            return $error;
        }

        $url     = $request->get_url_params();
        $view_id = intval( $url['id'] );
        $entry_id = intval( $url['s_id'] );

        $view = \GV\View::by_id( $view_id );

        if ( ! $entry = \GV\GF_Entry::by_id( $entry_id ) ) {
            return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
        }

        if ( $entry['form_id'] != $view->form->ID ) {
            return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
        }

        if ( $entry['status'] != 'active' ) {
            return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
        }

        if ( apply_filters( 'gravityview_custom_entry_slug', false ) && $entry->slug != get_query_var( \GV\Entry::get_endpoint_name() ) ) {
            return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
        }

        $is_admin_and_can_view = $view->settings->get( 'admin_show_all_statuses' ) && \GVCommon::has_cap('gravityview_moderate_entries', $view->ID );

        if ( $view->settings->get( 'show_only_approved' ) && ! $is_admin_and_can_view ) {
            if ( ! \GravityView_Entry_Approval_Status::is_approved( gform_get_meta( $entry->ID, \GravityView_Entry_Approval::meta_key ) )  ) {
                return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
            }
        }

        return true;
    }

    public function get_items_permissions_check( $request ) {
        // Getting a list of all Views is always possible.
        return true;
    }

    public function get_sub_items_permissions_check( $request ) {
        // Accessing all entries of a View needs the same permissions as accessing the View.
        return $this->get_item_permissions_check( $request );
    }
}