Connection: Add REST support for jsonAPI endpoints

projects/packages/connection/changelog/add-json-api-direct-access

@@ -0,0 +1,4 @@
+Significance: minor
+Type: added
+
+Add the 'is_signed_with_user_token()' method for REST authentication.

projects/packages/connection/src/class-rest-authentication.php

@@ -219,4 +219,17 @@ public static function is_signed_with_blog_token() {
 
 		return true === $instance->rest_authentication_status && 'blog' === $instance->rest_authentication_type;
 	}
+
+	/**
+	 * Whether the request was signed with a user token.
+	 *
+	 * @since $$next-version$$
+	 *
+	 * @return bool True if the request was signed with a valid user token, false otherwise.
+	 */
+	public static function is_signed_with_user_token() {
+		$instance = self::init();
+
+		return true === $instance->rest_authentication_status && 'user' === $instance->rest_authentication_type;
+	}
 }

projects/plugins/jetpack/changelog/add-json-api-direct-access

@@ -0,0 +1,4 @@
+Significance: minor
+Type: other
+
+Add REST support for jsonAPI endpoints.

projects/plugins/jetpack/class-jetpack-xmlrpc-methods.php

@@ -176,9 +176,6 @@ public static function json_api( $args = array() ) {
 		define( 'REST_API_REQUEST', true );
 		define( 'WPCOM_JSON_API__BASE', 'public-api.wordpress.com/rest/v1' );
 
-		// needed?
-		require_once ABSPATH . 'wp-admin/includes/admin.php';
-
 		require_once JETPACK__PLUGIN_DIR . 'class.json-api.php';
 		$api                        = WPCOM_JSON_API::init( $method, $url, $post_body );
 		$api->token_details['user'] = $user_details;

projects/plugins/jetpack/class.jetpack.php

@@ -855,8 +855,11 @@ function ( $methods ) {
 		if ( $is_connection_ready ) {
 			require_once JETPACK__PLUGIN_DIR . '_inc/lib/class.jetpack-iframe-embed.php';
 			add_action( 'init', array( 'Jetpack_Iframe_Embed', 'init' ), 9, 0 );
+
 			require_once JETPACK__PLUGIN_DIR . '_inc/lib/class.jetpack-keyring-service-helper.php';
 			add_action( 'init', array( 'Jetpack_Keyring_Service_Helper', 'init' ), 9, 0 );
+
+			add_action( 'rest_api_init', array( $this, 'maybe_initialize_rest_jsonapi' ) );
 		}
 	}
 
@@ -6111,6 +6114,21 @@ public function run_initialize_tracking_action() {
 		do_action( 'jetpack_initialize_tracking' );
 	}
 
+	/**
+	 * Initialize REST jsonAPI if needed.
+	 *
+	 * @return void
+	 */
+	public function maybe_initialize_rest_jsonapi() {
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		if ( ! empty( $_GET['jsonapi'] ) && ( ! defined( 'IS_WPCOM' ) || ! IS_WPCOM ) ) {
+			require_once ABSPATH . 'wp-admin/includes/admin.php'; // JSON API relies on WP functionality not autoloaded in REST.
+
+			define( 'WPCOM_JSON_API__BASE', 'public-api.wordpress.com/rest/v1' );
+			require_once JETPACK__PLUGIN_DIR . 'class.json-api-endpoints.php';
+		}
+	}
+
 	/**
 	 * Run plugin post-activation actions if we need to.
 	 *

projects/plugins/jetpack/class.json-api-endpoints.php

@@ -6,6 +6,9 @@
  */
 
 use Automattic\Jetpack\Connection\Client;
+use Automattic\Jetpack\Connection\Manager;
+use Automattic\Jetpack\Connection\Rest_Authentication;
+use Automattic\Jetpack\Connection\Tokens;
 use Automattic\Jetpack\Status;
 
 require_once __DIR__ . '/json-api-config.php';
@@ -124,6 +127,20 @@ abstract class WPCOM_JSON_API_Endpoint {
 	 */
 	public $path_labels = array();
 
+	/**
+	 * The REST endpoint if available.
+	 *
+	 * @var string
+	 */
+	public $rest_route;
+
+	/**
+	 * Jetpack Version in which REST support was introduced.
+	 *
+	 * @var string
+	 */
+	public $rest_min_jp_version;
+
 	/**
 	 * Accepted query parameters
 	 *
@@ -277,6 +294,11 @@ abstract class WPCOM_JSON_API_Endpoint {
 	 */
 	public $allow_fallback_to_jetpack_blog_token = false;
 
+	/**
+	 * REST namespace.
+	 */
+	const REST_NAMESPACE = 'jetpack/rest';
+
 	/**
 	 * Constructor.
 	 *
@@ -300,6 +322,8 @@ public function __construct( $args ) {
 			'new_version'                          => WPCOM_JSON_API__CURRENT_VERSION,
 			'jp_disabled'                          => false,
 			'path_labels'                          => array(),
+			'rest_route'                           => null,
+			'rest_min_jp_version'                  => null,
 			'request_format'                       => array(),
 			'response_format'                      => array(),
 			'query_parameters'                     => array(),
@@ -339,6 +363,9 @@ public function __construct( $args ) {
 		$this->deprecated  = $args['deprecated'];
 		$this->new_version = $args['new_version'];
 
+		$this->rest_route          = $args['rest_route'];
+		$this->rest_min_jp_version = $args['rest_min_jp_version'];
+
 		// Ensure max version is not less than min version.
 		if ( version_compare( $this->min_version, $this->max_version, '>' ) ) {
 			$this->max_version = $this->min_version;
@@ -387,6 +414,10 @@ public function __construct( $args ) {
 		$this->example_response     = $args['example_response'];
 
 		$this->api->add( $this );
+
+		if ( ( ! defined( 'IS_WPCOM' ) || ! IS_WPCOM ) && $this->rest_route && ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) ) {
+			$this->create_rest_route_for_endpoint();
+		}
 	}
 
 	/**
@@ -2618,6 +2649,133 @@ public function get_amp_cache_origins( $siteurl ) {
 		);
 	}
 
+	/**
+	 * Register a REST route for this jsonAPI endpoint.
+	 *
+	 * @return void
+	 * @throws Exception The exception if something goes wrong.
+	 */
+	public function create_rest_route_for_endpoint() {
+		register_rest_route(
+			static::REST_NAMESPACE,
+			$this->build_rest_route(),
+			array(
+				'methods'             => $this->method,
+				'callback'            => array( $this, 'rest_callback' ),
+				'permission_callback' => array( $this, 'rest_permission_callback' ),
+			)
+		);
+	}
+
+	/**
+	 * Handle the rest call.
+	 *
+	 * @param WP_REST_Request $request The request object.
+	 *
+	 * @return mixed|WP_Error
+	 */
+	public function rest_callback( WP_REST_Request $request ) {
+		$blog_id = Jetpack_Options::get_option( 'id' );
+
+		$this->api->initialize();
+		$this->api->endpoint = $this;
+
+		$response = call_user_func_array(
+			array( $this, 'callback' ),
+			array_values( array( $this->path, $blog_id ) + $request->get_url_params() )
+		);
+
+		$token_data = ( new Manager() )->verify_xml_rpc_signature();
+
+		if ( ! $token_data || empty( $token_data['token_key'] ) || ! array_key_exists( 'user_id', $token_data ) ) {
+			return new WP_Error( 'response_signature_error' );
+		}
+
+		$token = ( new Tokens() )->get_access_token( $token_data['user_id'], $token_data['token_key'] );
+		if ( is_wp_error( $token ) ) {
+			return $token;
+		}
+		if ( ! $token ) {
+			return new WP_Error( 'response_signature_error' );
+		}
+
+		$response = wp_json_encode( $response );
+		$nonce    = wp_generate_password( 10, false );
+		$hmac     = hash_hmac( 'sha1', $nonce . $response, $token->secret );
+
+		return array(
+			$response,
+			(string) $nonce,
+			(string) $hmac,
+		);
+	}
+
+	/**
+	 * The REST endpoint should only be available for requests signed with a valid blog or user token.
+	 * Declaring it "final" so individual endpoints couldn't remove this requirement.
+	 *
+	 * @return true|WP_Error
+	 */
+	final public function rest_permission_callback() {
+		$manager = new Manager( 'jetpack' );
+		if ( ! $manager->is_connected() ) {
+			return new WP_Error( 'site_not_connected' );
+		}
+
+		$user_id          = get_current_user_id();
+		$allow_blog_token = $this->allow_fallback_to_jetpack_blog_token || $this->allow_jetpack_site_auth;
+
+		if ( ( $allow_blog_token && Rest_Authentication::is_signed_with_blog_token() ) || ( $user_id && Rest_Authentication::is_signed_with_user_token() ) ) {
+			$custom_permission_result = $this->rest_permission_callback_custom();
+
+			// Successful custom permission check.
+			if ( $custom_permission_result === true ) {
+				return true;
+			}
+
+			// Custom permission check errored, returning the error.
+			if ( is_wp_error( $custom_permission_result ) ) {
+				return $custom_permission_result;
+			}
+
+			// Custom permission check failed, but didn't return a specific error. Proceed to returning the generic error.
+		}
+
+		$message = esc_html__(
+			'You do not have the correct user permissions to perform this action. Please contact your site admin if you think this is a mistake.',
+			'jetpack'
+		);
+		return new WP_Error( 'rest_api_invalid_permission', $message, array( 'status' => rest_authorization_required_code() ) );
+	}
+
+	/**
+	 * Redefine in individual endpoint classes to further customize the permission check.
+	 *
+	 * @return true|WP_Error
+	 */
+	public function rest_permission_callback_custom() {
+		return true;
+	}
+
+	/**
+	 * Build the REST endpoint URL.
+	 *
+	 * @return string
+	 */
+	public function build_rest_route() {
+		$version_prefix = $this->max_version ? 'v' . $this->max_version : '';
+		return $version_prefix . $this->rest_route;
+	}
+
+	/**
+	 * Get Jetpack Version where support for the endpoint was introduced.
+	 *
+	 * @return string
+	 */
+	public function get_rest_min_jp_version() {
+		return $this->rest_min_jp_version;
+	}
+
 	/**
 	 * Return endpoint response
 	 *

projects/plugins/jetpack/json-endpoints/jetpack/class.jetpack-json-api-plugins-list-endpoint.php

@@ -5,6 +5,8 @@
 		'description'             => 'Get installed Plugins on your blog',
 		'method'                  => 'GET',
 		'path'                    => '/sites/%s/plugins',
+		'rest_route'              => '/plugins',
+		'rest_min_jp_version'     => '14.0-a.7',
 		'stat'                    => 'plugins',
 		'min_version'             => '1',
 		'max_version'             => '1.1',