mainwp-child/class/class-mainwp-child-patchstack.php

<?php
/**
 * MainWP Patchstack
 *
 * MainWP Patchstack extension handler.
 * Extension URL: https://mainwp.com/extension/patchstack/
 *
 * @package MainWP\Child
 */

namespace MainWP\Child;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// phpcs:disable PSR1.Classes.ClassDeclaration, WordPress.WP.AlternativeFunctions -- required to achieve desired results, pull request solutions appreciated.

/**
 * Class MainWP_Child_Patchstack
 *
 * MainWP Patchstack extension handler
 */
class MainWP_Child_Patchstack { //phpcs:ignore -- NOSONAR - multi methods.

    /**
     * Public static variable to hold the single instance of the class.
     *
     * @var mixed Default null
     */
    public static $instance = null;

    /**
     * Patchstack install status. True if the plugin is installed on the child site.
     *
     * @var bool If Patchstack plugin installed, return true, if not, return false.
     */
    protected $is_plugin_installed = false;

    /**
     * The plugin slug.
     *
     * @var string slug string.
     */
    protected $the_plugin_slug = 'patchstack/patchstack.php';

    /**
     * API URL of Patchstack to communicate with.
     *
     * @var   string API URL.
     */
    protected $api_url = 'https://api.patchstack.com/monitor';

    /**
     * Option name to hide the Patchstack Insights plugin.
     *
     * @var string Option name.
     */
    protected $option_hide_name = 'mainwp_patchstack_hide_plugin';

    /**
     * Whitelist of allowed sanitization functions.
     *
     * @var array $allowed_callbacks allowed sanitization functions.
     */
    protected static $allowed_callbacks = array(
        'sanitize_text_field',
        'sanitize_textarea_field',
        'sanitize_email',
        'sanitize_url',
        'intval',
        'absint',
        'wp_kses_post',
    );

    /**
     * Method instance()
     *
     * Create a public static instance.
     *
     * @return mixed Class instance.
     */
    public static function instance() {
        if ( null === static::$instance ) {
            static::$instance = new self();
        }

        return static::$instance;
    }

    /**
     * MainWP_Child_Patchstack constructor.
     *
     * Run any time class is called.
     */
    public function __construct() {
        $this->is_plugin_installed = is_plugin_active( $this->the_plugin_slug );
    }

    /**
     * Method init()
     *
     * Initiate action hooks.
     *
     * @return void
     */
    public function init() {
        add_filter( 'mainwp_site_sync_others_data', array( $this, 'sync_others_data' ), 10, 2 );
        if ( get_option( $this->option_hide_name ) === 'hide' ) {
            add_filter( 'all_plugins', array( $this, 'all_plugins' ) );
            add_action( 'admin_menu', array( $this, 'remove_menu' ) );
        }
    }

    /**
     * Method actions()
     *
     * Fire off certain Patchstack Insights plugin actions.
     *
     * @uses \MainWP\Child\MainWP_Child_Patchstack::save_settings() Save the plugin settings.
     * @uses \MainWP\Child\MainWP_Child_Patchstack::set_showhide() Hide or unhide the Patchstack Insights plugin.
     * @uses \MainWP\Child\MainWP_Child_Patchstack::install_plugin() Get the Patchstack Insights plugin data and store it in the sync request.
     * @uses \MainWP\Child\MainWP_Helper::write()
     */
    public function action() {
        $information = array();
        $mwp_action  = MainWP_System::instance()->validate_params( 'action' );
        if ( ! empty( $mwp_action ) ) {
            switch ( $mwp_action ) {
                case 'install_plugin':
                    $information = $this->install_plugin();
                    break;
                case 'sync_data':
                    $information = $this->sync_data();
                    break;
                case 'show_hide':
                    $information = $this->set_showhide();
                    break;
                case 'save_settings':
                default:
                    $information = $this->save_settings();
                    break;
            }
        }

        MainWP_Helper::write( $information );
    }

    /**
     * Hide BackWPup Plugin from the WordPress Installed plugin list.
     *
     * @param array $plugins Installed plugins.
     * @return array $plugins Installed plugins without BackWPup Plugin on the list.
     */
    public function all_plugins( $plugins ) {
        foreach ( $plugins as $key => $value ) {
            $plugin_slug = basename( $key, '.php' );
            if ( 'patchstack' === $plugin_slug ) {
                unset( $plugins[ $key ] );
            }
        }

        return $plugins;
    }
    /**
     * Remove Patchstack Plugin from the WordPress Admin.
     */
    public function remove_menu() {
        // Remove patchstack from the admin menu.
        remove_menu_page( 'options-general.php?page=patchstack' );
        global $submenu;

        // Remove the WordPress Admin SubMenu.
        if ( isset( $submenu['patchstack'] ) ) {
            unset( $submenu['patchstack'] );
        }

        if ( isset( $submenu['options-general.php'] ) ) {
            foreach ( $submenu['options-general.php'] as $index => $item ) {
                if ( 'patchstack' === $item[2] ) {
                    unset( $submenu['options-general.php'][ $index ] );
                    break;
                }
            }
        }

        $pos = isset( $_SERVER['REQUEST_URI'] ) ? stripos( wp_unslash( $_SERVER['REQUEST_URI'] ), 'options-general.php?page=patchstack' ) : false;
        if ( false !== $pos ) {
            wp_safe_redirect( get_option( 'siteurl' ) . '/wp-admin/index.php' );
            exit();
        }
    }

    /**
     * Method sync_others_data()
     *
     * Sync the Patchstack plugin settings.
     *
     * @param  array $information Array containing the sync information.
     * @param  array $data        Array containing the Patchstack plugin data to be synced.
     *
     * @return array $information Array containing the sync information.
     */
    public function sync_others_data( $information, $data = array() ) {
        if ( isset( $data['sync_patchstack_data'] ) && ( 'yes' === $data['sync_patchstack_data'] ) ) {
            try {
                $data['plugin_hide_status']          = get_site_option( $this->option_hide_name, false );
                $information['sync_patchstack_data'] = $data;
            } catch ( MainWP_Exception $e ) {
                // ok!
            }
        }
        return $information;
    }

    /**
     * Method install_plugin()
     *
     * Get the Patchstack Insights plugin data and store it in the sync request.
     *
     * @return array $information Array containing the sync information.
     */
    /**
     * Install (overwrite if exists) and activate the Patchstack plugin.
     *
     * @return array|\WP_Error
     */
    private function install_plugin() {  // phpcs:ignore -- NOSONAR -- complexity
        // Read settings.
        $raw_settings = $this->sanitized_post( 'settings' );
        $settings     = json_decode( $raw_settings, true );

        if ( json_last_error() !== JSON_ERROR_NONE ) {
            return new \WP_Error( 'json_decode_error', 'Invalid JSON in settings: ' . json_last_error_msg() );
        }

        if ( empty( $settings['ps_id'] ) || empty( $settings['token'] ) ) {
            return new \WP_Error( 'bad_params', 'Missing ps_id or token.' );
        }

        // Call endpoint returns FILE (ZIP), not JSON.
        $url    = '/download/wordpress/' . intval( $settings['ps_id'] );
        $binary = $this->send_request( $url, $settings['token'], 'GET', array(), false );

        if ( is_wp_error( $binary ) ) {
            return $binary;
        }
        if ( is_array( $binary ) ) {
            // API should return file; if it returns JSON then it is a business error.
            return new \WP_Error( 'api_error', 'Unexpected JSON for download endpoint.', $binary );
        }
        if ( ! is_string( $binary ) || '' === $binary ) {
            return new \WP_Error( 'empty_file', 'Empty plugin file.' );
        }

        require_once ABSPATH . 'wp-admin/includes/plugin.php';  // phpcs:ignore -- NOSONAR
        require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';  // phpcs:ignore -- NOSONAR
        require_once ABSPATH . 'wp-admin/includes/file.php';  // phpcs:ignore -- NOSONAR
        require_once ABSPATH . 'wp-admin/includes/misc.php';  // phpcs:ignore -- NOSONAR

        // Write ZIP to temporary file.
        $tmp = wp_tempnam( 'patchstack.zip' );
        if ( ! $tmp ) {
            return new \WP_Error( 'tmp_fail', 'Failed to create temp file.' );
        }

        $bytes = @file_put_contents( $tmp, $binary, LOCK_EX ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
        if ( false === $bytes || 0 === $bytes ) {
            @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
            return new \WP_Error( 'write_fail', 'Failed to write plugin ZIP to temp file.' );
        }

        // Check slug.
        if ( empty( $this->the_plugin_slug ) || strpos( $this->the_plugin_slug, '/' ) === false ) {
            return new \WP_Error( 'bad_slug', 'Invalid plugin slug (expected "patchstack/patchstack.php").' );
        }

        // Deactivate if active.
        $was_active = function_exists( 'is_plugin_active' ) ? is_plugin_active( $this->the_plugin_slug ) : false;
        if ( $was_active ) {
            deactivate_plugins( $this->the_plugin_slug, true );
            if ( function_exists( 'is_plugin_active' ) && is_plugin_active( $this->the_plugin_slug ) ) {
                return new \WP_Error( 'deactivate_failed', 'Failed to deactivate existing plugin.' );
            }
        }

        // Delete plugin if exists (file or folder).
        $plugin_dir = WP_PLUGIN_DIR . '/' . dirname( $this->the_plugin_slug );
        if ( file_exists( WP_PLUGIN_DIR . '/' . $this->the_plugin_slug ) || is_dir( $plugin_dir ) ) {
            // delete_plugins() will try to deactivate if needed and remove files.
            $deleted = delete_plugins( array( $this->the_plugin_slug ) );
            if ( is_wp_error( $deleted ) ) {
                return new \WP_Error(
                    'delete_failed',
                    'Failed to delete existing plugin folder.',
                    array( 'error' => $deleted->get_error_message() )
                );
            }
            // In some envs a residual folder may remain; hard-delete with WP_Filesystem.
            if ( is_dir( $plugin_dir ) ) {
                global $wp_filesystem;
                if ( ! $wp_filesystem ) {
                    WP_Filesystem();
                }
                if ( $wp_filesystem && $wp_filesystem->is_dir( $plugin_dir ) ) {
                    $wp_filesystem->delete( $plugin_dir, true );
                }
                if ( is_dir( $plugin_dir ) ) {
                    return new \WP_Error( 'delete_residual_failed', 'Plugin directory still exists after deletion.' );
                }
            }
        }

        // Install/overwrite with Plugin_Upgrader (WordPress core standard).
        $skin     = new \Automatic_Upgrader_Skin();
        $upgrader = new \Plugin_Upgrader( $skin );

        $options_filter = static function ( $options ) {
            $options['clear_destination']           = true;
            $options['abort_if_destination_exists'] = false;
            return $options;
        };
        add_filter( 'upgrader_package_options', $options_filter );

        try {
            $installed = $upgrader->install( $tmp );
        } finally {
            remove_filter( 'upgrader_package_options', $options_filter );
            @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
        }

        if ( is_wp_error( $installed ) ) {
            return $installed;
        }
        if ( ! $installed ) {
            return new \WP_Error( 'install_failed', 'Plugin installation failed.' );
        }

        // Check plugin file.
        $plugin_file = '';
        if ( is_array( $upgrader->result ?? null ) ) {
            if ( ! empty( $upgrader->result['plugin'] ) ) {
                $plugin_file = $upgrader->result['plugin'];
            } elseif ( ! empty( $upgrader->result['destination'] ) ) {
                $dest_dir = trailingslashit( $upgrader->result['destination'] );
                $all      = get_plugins();
                foreach ( $all as $rel => $headers ) {
                    if ( strpos( WP_PLUGIN_DIR . '/' . $rel, $dest_dir ) === 0 ) {
                        $plugin_file = $rel;
                        break;
                    }
                }
            }
        }

        if ( ! $plugin_file && ! empty( $this->the_plugin_slug ) && file_exists( WP_PLUGIN_DIR . '/' . $this->the_plugin_slug ) ) {
            $plugin_file = $this->the_plugin_slug;
        }

        if ( ! $plugin_file ) {
            return new \WP_Error( 'main_file_missing', 'Installed but plugin main file not found.' );
        }

        return array(
            'success'     => 1,
            'is_active'   => is_plugin_active( $this->the_plugin_slug ),
            'plugin_file' => $this->the_plugin_slug,
            'message'     => $message,
        );
    }

    /**
     * Method set_showhide()
     *
     * Hide or unhide the Patchstack Insights plugin.
     *
     * @return array $information Array containing the sync information.
     */
    private function set_showhide() {
        $raw  = $this->sanitized_post( 'show_hide' );
        $hide = ( 'hide' === sanitize_text_field( $raw ) ) ? 'hide' : '';
        update_site_option( $this->option_hide_name, $hide );

        return array( 'success' => 1 );
    }

    /**
     * Summary of sync_data
     *
     * @return array{data: mixed, success: int|array{error: string}}`
     */
    private function sync_data() {
        $oauth = $this->sanitized_post( 'oauth' );
        if ( empty( $oauth ) ) {
            return array( 'error' => 'Missing oauth data.' );
        }
        $response = wp_remote_post(
            admin_url( 'admin-ajax.php' ),
            array(
                'timeout'   => 30,
                'sslverify' => false,
                'body'      => array(
                    'action' => 'patchstack_activate_license',
                    'key'    => $oauth,
                ),
            )
        );

        $body = wp_remote_retrieve_body( $response );
        $data = json_decode( $body, true );
        return array(
            'success' => 1,
            'data'    => $data,
        );
    }

    /**
     * Method save_settings()
     *
     * Save the Patchstack Insights plugin settings.
     *
     * @return array $information Array containing the sync information.
     */
    private function save_settings() {
        return array( 'success' => 1 );
    }

    /**
     * Send an HTTP request to the API and return JSON (array) or raw string (binary).
     *
     * @param string            $url         API endpoint (e.g. '/site/plugin/resync/123').
     * @param string            $token       API token.
     * @param string            $method      HTTP method. Default 'GET'.
     * @param array|string|null $data        Data for non-GET methods (auto JSON-encoded if array).
     * @param bool              $expect_json Expect JSON response (true) or raw/binary (false).
     *
     * @return array|string|\WP_Error JSON array, raw string, or WP_Error on failure.
     */
    private function send_request( $url, $token, $method = 'GET', $data = array(), $expect_json = true ) {  // phpcs:ignore -- NOSONAR
        if ( empty( $token ) ) {
            return new \WP_Error( 'no_token', 'Missing API token.' );
        }

        $method = strtoupper( $method );
        $args   = array(
            'method'      => $method,
            'timeout'     => 90,
            'redirection' => 5,
            'blocking'    => true,
            'headers'     => array(
                'UserToken' => $token,
                'Accept'    => $expect_json ? 'application/json' : '*/*', // NOSONAR.
            ),
        );

        // Only send body when not GET/HEAD.
        if ( ! empty( $data ) && ! in_array( $method, array( 'GET', 'HEAD' ), true ) ) {
            if ( is_array( $data ) ) {
                $args['headers']['Content-Type'] = 'application/json';
                $args['body']                    = wp_json_encode( $data );
            } else {
                $args['body'] = (string) $data;
            }
        }

        $response = wp_remote_request( trailingslashit( $this->api_url ) . ltrim( $url, '/' ), $args );
        if ( is_wp_error( $response ) ) {
            return $response;
        }

        $code  = (int) wp_remote_retrieve_response_code( $response );
        $body  = wp_remote_retrieve_body( $response );
        $ctype = (string) wp_remote_retrieve_header( $response, 'content-type' );

        if ( 200 !== $code ) {
            // If the server returns an error JSON → try to parse it to get specific information.
            $message = "HTTP $code";
            if ( stripos( $ctype, 'application/json' ) !== false ) {
                $json = json_decode( $body, true );
                if ( is_array( $json ) ) {
                    $message = $json['error'] ?? $json['message'] ?? $message;
                }
            }
            return new \WP_Error(
                'http_error',
                $message,
                array(
                    'status' => $code,
                    'body'   => $body,
                    'ctype'  => $ctype,
                )
            );
        }

        if ( $expect_json || stripos( $ctype, 'application/json' ) !== false ) {
            if ( '' === $body ) {
                return array();
            }
            $decoded = json_decode( $body, true );
            if ( json_last_error() !== JSON_ERROR_NONE ) {
                return new \WP_Error(
                    'json_decode',
                    'Invalid JSON: ' . json_last_error_msg(),
                    array(
                        'body' => $body,
                    )
                );
            }
            return $decoded;
        }

        return $body;
    }

    /**
     * Method sanitized_post()
     *
     * Sanitized post field.
     *
     * @param string $key key to get from POST.
     * @param string $callback cleaning method.
     * @param mixed  $default_value Default return value.
     *
     * @return mixed data value.
     */
    private static function sanitized_post( $key, $callback = 'sanitize_text_field', $default_value = '' ) {
        if ( ! in_array( $callback, self::$allowed_callbacks, true ) ) {
            $callback = 'sanitize_text_field';
        }

        return isset( $_POST[ $key ] ) ? $callback( wp_unslash( $_POST[ $key ] ) ) : $default_value; // phpcs:ignore WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
    }
}