Changeset 59032 for trunk/src/wp-includes/rest-api/class-wp-rest-server.php

Timestamp:

09/17/2024 09:50:38 PM (2 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Automatically populate targetHints for the Allow header.

The REST API uses the "Allow" header to communicate what methods a user is authorized to perform on a resource. This works great when operating on a single item route, but can break down when needing to determine authorization over a collection of items.

This commit uses the "targetHints" property of JSON Hyper Schema to provide access to the "allow" header for "self" links. This alleviates needing to make a separate network request for each item in a collection.

Props mamaduka, noisysocks, peterwilsoncc, spacedmonkey, swissspidy, timothyblynjacobs, tyxla, youknowriad.
Fixes #61739.

File:

• trunk/src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -637 +637 @@
                                 $attributes         = $item['attributes'];
                                 $attributes['href'] = $item['href'];
-                                $data[ $rel ][]     = $attributes;
+
+                                if ( 'self' !== $rel ) {
+                                        $data[ $rel ][] = $attributes;
+                                        continue;
+                                }
+
+                                $target_hints = self::get_target_hints_for_link( $attributes );
+                                if ( $target_hints ) {
+                                        $attributes['targetHints'] = $target_hints;
+                                }
+
+                                $data[ $rel ][] = $attributes;
                         }
                 }
 
                 return $data;
+        }
+
+        /**
+         * Gets the target links for a REST API Link.
+         *
+         * @since 6.7.0
+         *
+         * @param array $link
+         *
+         * @return array|null
+         */
+        protected static function get_target_hints_for_link( $link ) {
+                // Prefer targetHints that were specifically designated by the developer.
+                if ( isset( $link['targetHints']['allow'] ) ) {
+                        return null;
+                }
+
+                $request = WP_REST_Request::from_url( $link['href'] );
+                if ( ! $request ) {
+                        return null;
+                }
+
+                $server = rest_get_server();
+                $match  = $server->match_request_to_handler( $request );
+
+                if ( is_wp_error( $match ) ) {
+                        return null;
+                }
+
+                if ( is_wp_error( $request->has_valid_params() ) ) {
+                        return null;
+                }
+
+                if ( is_wp_error( $request->sanitize_params() ) ) {
+                        return null;
+                }
+
+                $target_hints = array();
+
+                $response = new WP_REST_Response();
+                $response->set_matched_route( $match[0] );
+                $response->set_matched_handler( $match[1] );
+                $headers = rest_send_allow_header( $response, $server, $request )->get_headers();
+
+                foreach ( $headers as $name => $value ) {
+                        $name = WP_REST_Request::canonicalize_header_name( $name );
+
+                        $target_hints[ $name ] = array_map( 'trim', explode( ',', $value ) );
+                }
+
+                return $target_hints;
         }