Changeset 59032 for trunk/src/wp-includes/rest-api/class-wp-rest-server.php

Timestamp:

09/17/2024 09:50:38 PM (8 months ago)

Author:

TimothyBlynJacobs

Message:

REST API: Automatically populate targetHints for the Allow header.

The REST API uses the "Allow" header to communicate what methods a user is authorized to perform on a resource. This works great when operating on a single item route, but can break down when needing to determine authorization over a collection of items.

This commit uses the "targetHints" property of JSON Hyper Schema to provide access to the "allow" header for "self" links. This alleviates needing to make a separate network request for each item in a collection.

Props mamaduka, noisysocks, peterwilsoncc, spacedmonkey, swissspidy, timothyblynjacobs, tyxla, youknowriad.
Fixes #61739.

File:

• trunk/src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -637 +637 @@
                 $attributes         = $item['attributes'];
                 $attributes['href'] = $item['href'];
-                $data[ $rel ][]     = $attributes;
+
+                if ( 'self' !== $rel ) {
+                    $data[ $rel ][] = $attributes;
+                    continue;
+                }
+
+                $target_hints = self::get_target_hints_for_link( $attributes );
+                if ( $target_hints ) {
+                    $attributes['targetHints'] = $target_hints;
+                }
+
+                $data[ $rel ][] = $attributes;
             }
         }
 
         return $data;
+    }
+
+    /**
+     * Gets the target links for a REST API Link.
+     *
+     * @since 6.7.0
+     *
+     * @param array $link
+     *
+     * @return array|null
+     */
+    protected static function get_target_hints_for_link( $link ) {
+        // Prefer targetHints that were specifically designated by the developer.
+        if ( isset( $link['targetHints']['allow'] ) ) {
+            return null;
+        }
+
+        $request = WP_REST_Request::from_url( $link['href'] );
+        if ( ! $request ) {
+            return null;
+        }
+
+        $server = rest_get_server();
+        $match  = $server->match_request_to_handler( $request );
+
+        if ( is_wp_error( $match ) ) {
+            return null;
+        }
+
+        if ( is_wp_error( $request->has_valid_params() ) ) {
+            return null;
+        }
+
+        if ( is_wp_error( $request->sanitize_params() ) ) {
+            return null;
+        }
+
+        $target_hints = array();
+
+        $response = new WP_REST_Response();
+        $response->set_matched_route( $match[0] );
+        $response->set_matched_handler( $match[1] );
+        $headers = rest_send_allow_header( $response, $server, $request )->get_headers();
+
+        foreach ( $headers as $name => $value ) {
+            $name = WP_REST_Request::canonicalize_header_name( $name );
+
+            $target_hints[ $name ] = array_map( 'trim', explode( ',', $value ) );
+        }
+
+        return $target_hints;
     }