<?php
namespace WPForms\Integrations\PayPalCommerce\Admin;
use RuntimeException;
use WPForms\Admin\Payments\BuilderReturnNotice;
use WPForms\Helpers\Transient;
use WPForms\Integrations\PayPalCommerce\Api\Api;
use WPForms\Integrations\PayPalCommerce\Api\WebhooksManager;
use WPForms\Integrations\PayPalCommerce\Connection;
use WPForms\Integrations\PayPalCommerce\Helpers;
use WPForms\Integrations\PayPalCommerce\PaymentMethods\ApplePay\DomainManager;
use WPForms\Integrations\PayPalCommerce\PayPalCommerce;
/**
* PayPal Commerce Connect functionality.
*
* @since 1.10.0
*/
class Connect {
/**
* WPForms website URL.
*
* @since 1.10.0
*/
public const WPFORMS_URL = 'https://wpformsapi.com/paypal/v1';
/**
* Disconnect nonce.
*
* @since 1.10.0
*/
public const DISCONNECT_ACTION_NONCE = 'wpforms_paypal_commerce_disconnect';
/**
* Merchant info name.
*
* @since 1.10.0
*/
public const MERCHANT_INFO_TRANSIENT_NAME = 'wpforms_paypal_commerce_merchant_info_';
/**
* Signup transient name.
*
* @since 1.10.0
*/
private const SIGNUP_TRANSIENT_NAME = 'wpforms_paypal_commerce_signup_link_';
/**
* Signup Site URL transient name.
*
* @since 1.10.1
*/
private const SIGNUP_SITE_URL_TRANSIENT_NAME = 'wpforms_paypal_commerce_signup_site_url';
/**
* Lock Signup transient name.
*
* @since 1.10.0
*/
private const LOCK_SIGNUP_TRANSIENT_NAME = 'wpforms_paypal_commerce_lock_signup_link_';
/**
* Lock Connect option name.
*
* @since 1.10.0
*/
private const LOCK_CONNECT_OPTION_NAME = 'wpforms_paypal_commerce_lock_connect_';
/**
* Unlock Connect transient name.
*
* @since 1.10.0
*/
private const UNLOCK_CONNECT_TRANSIENT_NAME = 'wpforms_paypal_commerce_unlock_connect_';
/**
* Secret Signup transient name.
*
* @since 1.10.0
*/
private const SECRET_SIGNUP_TRANSIENT_NAME = 'wpforms_paypal_commerce_secret_signup_link_';
/**
* Refresh the signup key.
*
* @since 1.10.0
*/
private const REFRESH_SIGNUP_KEY = 'paypal_commerce_refresh_signup';
/**
* Init class.
*
* @since 1.10.0
*/
public function init(): Connect {
$this->hooks();
return $this;
}
/**
* Register hooks.
*
* @since 1.10.0
*/
public function hooks(): void {
add_action( 'admin_init', [ $this, 'handle_actions' ] );
add_action( 'admin_init', [ $this, 'maybe_queue_builder_return_notice' ], 20 );
add_action( 'update_option_wpforms_license', [ $this, 'update_license_option' ], 10, 3 );
add_action( 'add_option_wpforms_license', [ $this, 'add_license_option' ], 10, 2 );
}
/**
* Handle actions.
*
* @since 1.10.0
*/
public function handle_actions(): void {
if ( wp_doing_ajax() || ! wpforms_current_user_can() ) {
return;
}
$this->validate_scopes();
if ( ! wpforms_is_admin_page( 'settings', 'payments' ) ) {
return;
}
if (
isset( $_GET['merchantId'], $_GET['merchantIdInPayPal'] ) // phpcs:ignore WordPress.Security.NonceVerification.Recommended
) {
$this->handle_connect();
return;
}
if (
isset( $_GET['_wpnonce'] ) &&
wp_verify_nonce( sanitize_key( $_GET['_wpnonce'] ), self::DISCONNECT_ACTION_NONCE )
) {
$this->handle_disconnect();
}
}
/**
* Update license for the connected customer.
*
* @since 1.10.0
*
* @param mixed $old_value Old license value.
* @param mixed $value New license value.
* @param string $option Option name.
*
* @noinspection PhpUnusedParameterInspection
* @noinspection PhpMissingParamTypeInspection
*/
public function update_license_option( $old_value, $value, $option ): void { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
$this->update_license( $value['key'] ?? null );
}
/**
* Queue the "Return to your form" success notice after the user completes
* the PayPal Commerce Connect flow that they started from the form builder.
*
* @since 1.10.1.1
*/
public function maybe_queue_builder_return_notice(): void {
BuilderReturnNotice::maybe_queue_oauth( 'paypal_commerce', __( 'PayPal Commerce', 'wpforms-lite' ) );
}
/**
* Update license for the connected customer.
*
* @since 1.10.0
*
* @param string $option Option name.
* @param mixed $value License value.
*
* @noinspection PhpUnusedParameterInspection
* @noinspection PhpMissingParamTypeInspection
*/
public function add_license_option( $option, $value ): void { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
$this->update_license( $value['key'] ?? null );
}
/**
* Update license for the connected customer.
*
* @since 1.10.0
*
* @param string|null $license License key value.
*/
private function update_license( $license ): void {
$connection = Connection::get();
if ( ! $connection ) {
return;
}
$api = PayPalCommerce::get_api( $connection );
if ( ! $api || ! method_exists( $api, 'update_customer' ) ) {
return;
}
$api->update_customer( [ 'license_key' => $license ] );
}
/**
* Handle connection.
*
* @since 1.10.0
*
* @throws RuntimeException Credentials request was failed.
*/
private function handle_connect(): void {
$mode = Helpers::get_mode();
$settings_page = Helpers::get_settings_page_url();
$return_form_id = isset( $_GET['wpforms_return_form_id'] ) ? absint( $_GET['wpforms_return_form_id'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if ( $return_form_id > 0 ) {
$settings_page = add_query_arg(
[
'wpforms_connected' => 'paypal_commerce',
'wpforms_return_form_id' => $return_form_id,
],
$settings_page
);
}
// If already processing, let the first request finish.
if ( ! add_option( self::LOCK_CONNECT_OPTION_NAME . $mode, time() ) ) {
$start = microtime( true );
// Wait up to 5 seconds for the first request to completion.
while ( microtime( true ) - $start < 5 ) {
if ( Transient::get( self::UNLOCK_CONNECT_TRANSIENT_NAME . $mode ) ) {
break;
}
usleep( 200000 ); // 200 ms
}
wp_safe_redirect( $settings_page );
exit;
}
try {
$connection_data = $this->get_credentials();
if ( ! $connection_data ) {
throw new RuntimeException( 'Missing or invalid connection credentials.' );
}
$connection = new Connection( $connection_data );
$api = new Api( $connection );
$connection = self::refresh_access_token( $connection, $api );
$merchant_info = $api->get_merchant_info();
$status = $connection->validate_permissions( $merchant_info );
$connection->set_status( $status )->save();
// Sync the settings mode with a connection mode.
Helpers::set_mode( $mode );
( new WebhooksManager() )->connect();
/**
* Fires after successful PayPal Commerce connection.
*
* @since 1.10.0
*
* @param Connection $connection Connection instance.
* @param string $mode Connection mode.
*/
do_action( 'wpforms_integrations_paypal_commerce_admin_connect_after_handle', $connection, $mode ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName
// Clear the transients.
Transient::delete( self::SECRET_SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::LOCK_SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::SIGNUP_TRANSIENT_NAME . $mode );
} catch ( \Exception $e ) {
Helpers::log_errors(
'PayPal Connect error.',
'',
$e->getMessage()
);
} finally {
delete_option( self::LOCK_CONNECT_OPTION_NAME . $mode );
Transient::set( self::UNLOCK_CONNECT_TRANSIENT_NAME . $mode, 1, 10 );
wp_safe_redirect( $settings_page );
exit;
}
}
/**
* Get credentials.
*
* @since 1.10.0
*
* @return array
*/
private function get_credentials(): array {
$mode = Helpers::get_mode();
$merchant_id = sanitize_text_field( wp_unslash( $_GET['merchantIdInPayPal'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
$secret = sanitize_text_field( wp_unslash( $_GET['merchantId'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
$referral_link = Transient::get( self::SIGNUP_TRANSIENT_NAME . $mode );
$referral_params = [];
if ( $secret !== Transient::get( self::SECRET_SIGNUP_TRANSIENT_NAME . $mode ) ) {
Helpers::log_errors(
'PayPal Secret mismatch detected.',
'',
$referral_link
);
return [];
}
if ( $referral_link ) {
$referral_query = wp_parse_url( $referral_link, PHP_URL_QUERY );
parse_str( $referral_query, $referral_params );
}
$credentials_response = wp_remote_post(
self::get_server_url() . '/oauth/credentials',
[
'body' => [
'secret' => $secret,
'merchant_id' => $merchant_id,
'referral_token' => $referral_params['referralToken'] ?? '',
'license_key' => wpforms_get_license_key(),
'webhooks_url' => Helpers::get_webhook_url(),
'site_url' => site_url(),
'live_mode' => (int) ( $mode === Helpers::PRODUCTION ),
],
'timeout' => 15,
]
);
if ( is_wp_error( $credentials_response ) ) {
Helpers::log_errors(
'PayPal Credentials Error.',
'',
$credentials_response
);
return [];
}
$body = wp_remote_retrieve_body( $credentials_response );
$connection_data = json_decode( $body, true );
$required_keys = [ 'partner_merchant_id', 'client_id', 'client_token', 'client_token_expires_in', 'sdk_client_token', 'sdk_client_token_expires_in' ];
if ( empty( $connection_data ) || count( array_diff( $required_keys, array_keys( $connection_data ) ) ) !== 0 ) {
Helpers::log_errors(
'PayPal Connection data missed required keys.',
'',
$connection_data
);
return [];
}
$connection_data['merchant_id'] = $merchant_id;
$connection_data['secret'] = $secret;
$connection_data['type'] = Connection::TYPE_THIRD_PARTY;
return $connection_data;
}
/**
* Handle disconnection.
*
* @since 1.10.0
*/
private function handle_disconnect(): void {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
$live_mode = isset( $_GET['live_mode'] ) ? absint( $_GET['live_mode'] ) : 0;
$mode = $live_mode ? Helpers::PRODUCTION : Helpers::SANDBOX;
$connection = Connection::get( $mode );
if ( ! $connection ) {
return;
}
if ( ! Helpers::is_legacy() ) {
if ( Helpers::is_webhook_enabled() ) {
// Disconnect webhooks.
PayPalCommerce::get_webhooks_manager()->disconnect_webhook();
}
$api = PayPalCommerce::get_api( $connection );
// Ensure we have a fresh access token before any API calls.
self::refresh_access_token( $connection, $api );
/**
* Fires before PayPal Commerce disconnection.
*
* @since 1.10.0
*
* @param Connection $connection Connection instance.
* @param string $mode Connection mode.
*/
do_action( 'wpforms_integrations_paypal_commerce_admin_disconnect_before_handle', $connection, $mode ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName
$disconnected = $api->disconnect();
if ( ! $disconnected ) {
Helpers::log_errors(
'PayPal Disconnect failed.',
'',
'Unauthorized or other API failure.'
);
wp_safe_redirect( add_query_arg( 'paypal_commerce_disconnect', 'failed', Helpers::get_settings_page_url() ) );
exit;
}
}
$connection->delete();
Transient::delete( self::SECRET_SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::LOCK_SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::MERCHANT_INFO_TRANSIENT_NAME . $mode );
Transient::delete( DomainManager::DOMAIN_REGISTERED_TRANSIENT_NAME . $mode );
wp_safe_redirect( Helpers::get_settings_page_url() );
exit;
}
/**
* Refresh access token.
*
* @since 1.10.0
*
* @param Connection|\WPFormsPaypalCommerce\Connection $connection Current Connection.
* @param Api|\WPFormsPaypalCommerce\Api\Api $api Current API.
*
* @return Connection|\WPFormsPaypalCommerce\Connection
*/
public static function refresh_access_token( $connection, $api = null ) {
if ( is_null( $api ) ) {
$api = PayPalCommerce::get_api( $connection );
}
if ( is_null( $api ) ) {
return $connection;
}
$access_token = $api->generate_access_token();
if ( ! empty( $access_token['access_token'] ) ) {
$connection->set_access_token( $access_token['access_token'] )->set_access_token_expires_in( time() + $access_token['expires_in'] )->save();
}
return $connection;
}
/**
* Refresh client token.
*
* @since 1.10.0
*
* @param Connection|\WPFormsPaypalCommerce\Connection $connection Current Connection.
*
* @return Connection|\WPFormsPaypalCommerce\Connection
*/
public static function refresh_client_token( $connection ) {
$api = PayPalCommerce::get_api( $connection );
if ( is_null( $api ) ) {
return $connection;
}
$client_token = $api->generate_client_token();
if ( ! empty( $client_token['client_token'] ) ) {
$connection->set_client_token( $client_token['client_token'] )->set_client_token_expires_in( time() + $client_token['expires_in'] )->save();
}
return $connection;
}
/**
* Refresh client token.
*
* @since 1.10.0
*
* @param Connection|\WPFormsPaypalCommerce\Connection $connection Current Connection.
*
* @return Connection|\WPFormsPaypalCommerce\Connection
*/
public static function refresh_sdk_client_token( $connection ) {
$api = PayPalCommerce::get_api( $connection );
if ( is_null( $api ) ) {
return $connection;
}
$sdk_client_token = $api->generate_sdk_client_token();
if ( ! empty( $sdk_client_token['sdk_client_token'] ) ) {
$connection->set_sdk_client_token( $sdk_client_token['sdk_client_token'] )->set_sdk_client_token_expires_in( time() + $sdk_client_token['expires_in'] )->save();
}
return $connection;
}
/**
* Get Connect URL.
*
* @since 1.10.0
* @since 1.10.1.1 Added `$site_url` parameter to override the default
* post-OAuth callback URL.
*
* @param string $mode Connection mode.
* @param string $site_url Optional. Absolute URL that PayPal will redirect
* to after onboarding. Must point at a page where
* the OAuth handshake handler is registered (the
* Payments settings page). Defaults to the current
* admin URL for backwards compatibility.
*
* @return string
*/
public function get_connect_url( string $mode, string $site_url = '' ): string {
$mode = Helpers::validate_mode( $mode );
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
if ( isset( $_GET[ self::REFRESH_SIGNUP_KEY ] ) ) {
Transient::delete( self::LOCK_SIGNUP_TRANSIENT_NAME . $mode );
Transient::delete( self::SIGNUP_TRANSIENT_NAME . $mode );
}
if ( Transient::get( self::LOCK_SIGNUP_TRANSIENT_NAME . $mode ) ) {
return '';
}
$link = Transient::get( self::SIGNUP_TRANSIENT_NAME . $mode );
$site_url = $site_url !== '' ? $site_url : remove_query_arg( self::REFRESH_SIGNUP_KEY, wpforms_current_url() );
if ( ! empty( $link ) && $site_url === Transient::get( self::SIGNUP_SITE_URL_TRANSIENT_NAME ) ) {
return (string) $link;
}
$secret = Transient::get( self::SECRET_SIGNUP_TRANSIENT_NAME . $mode );
if ( empty( $secret ) ) {
$secret = bin2hex( random_bytes( 16 ) );
Transient::set( self::SECRET_SIGNUP_TRANSIENT_NAME . $mode, $secret );
}
$response = wp_remote_post(
self::get_server_url() . '/oauth/partner-referral',
[
'body' => [
'secret' => $secret,
'site_url' => $site_url,
'live_mode' => (int) ( $mode === Helpers::PRODUCTION ),
],
'timeout' => 15,
]
);
if ( ! is_wp_error( $response ) && wp_remote_retrieve_response_code( $response ) === 200 ) {
$body = json_decode( wp_remote_retrieve_body( $response ), true );
$link = isset( $body['url'] ) ? $body['url'] . '&displayMode=minibrowser' : '';
if ( $link ) {
Transient::set( self::SIGNUP_TRANSIENT_NAME . $mode, $link, $body['expires_in'] );
Transient::set( self::SIGNUP_SITE_URL_TRANSIENT_NAME, $site_url );
return $link;
}
}
Transient::set( self::LOCK_SIGNUP_TRANSIENT_NAME . $mode, true, HOUR_IN_SECONDS );
return '';
}
/**
* Validate connection scopes.
*
* @since 1.10.0
*/
private function validate_scopes(): void {
$connection = Connection::get();
if ( ! $connection || ! $connection->is_configured() || ! Helpers::is_legacy() ) {
return;
}
$status = Helpers::is_license_ok() && Helpers::is_addon_active() ? 'valid' : 'invalid';
$connection->update_connection_status( $status );
}
/**
* Retrieve connect server URL.
*
* @since 1.10.0
*
* @return string
*/
public static function get_server_url(): string {
// Use a local server if constant set.
if ( defined( 'WPFORMS_PAYPAL_COMMERCE_LOCAL_CONNECT_SERVER' ) && WPFORMS_PAYPAL_COMMERCE_LOCAL_CONNECT_SERVER ) {
return home_url();
}
// Use a custom server if constant set.
if ( defined( 'WPFORMS_PAYPAL_COMMERCE_CONNECT_SERVER' ) && WPFORMS_PAYPAL_COMMERCE_CONNECT_SERVER ) {
return WPFORMS_PAYPAL_COMMERCE_CONNECT_SERVER;
}
/**
* Filter connect server URL.
*
* @since 1.10.0
*
* @param string $server_url Server URL.
*/
return (string) apply_filters( 'wpforms_paypal_commerce_connect_server_url', self::WPFORMS_URL ); // phpcs:ignore WPForms.PHP.ValidateHooks.InvalidHookName
}
}