nextpress-core 2.1.0 → 3.0.0

package/lib/wp-lib/src/acf/acf_add_options.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Nextpress\ACF;
+
+/**
+ * Registers a custom global ACF options page for App Options.
+ *
+ * @return void
+ */
+function acf_add_options(): void {
+    \acf_add_options_page([
+        'page_title' => "App Options",
+        'menu_title' => "App Options",
+        'menu_slug' => "app_options",
+        'capability' => "manage_options",
+        'redirect' => false,
+    ]);
+}

package/lib/wp-lib/src/acf/load_acf_fields.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Nextpress\ACF;
+
+/**
+ * Loads ACF field groups remotely from the fronend API service.
+ *
+ * @return void
+ */
+
+function load_acf_fields_from_api(): void {
+    $nextjs_service_url = getenv_docker('NEXTJS_SERVICE_URL', '');
+    $api_key = getenv_docker('CROSS_CONTAINER_API_KEY', '');
+    if (!$nextjs_service_url || !\is_scalar($nextjs_service_url) || !\is_scalar($api_key)) return;
+
+    $response = wp_remote_get($nextjs_service_url . '/api/field-groups', [
+        'headers' => [
+            'Authorization' => 'api-key ' . $api_key,
+            'Content-Type' => 'application/json'
+        ]
+    ]);
+
+    if (!is_wp_error($response)) {
+        $body = wp_remote_retrieve_body($response);
+        $field_groups_data = json_decode($body, true);
+        if (!\is_array($field_groups_data)) return;
+
+        foreach ($field_groups_data as $field_group) {
+            if (!\is_array($field_group)) continue;
+
+            acf_add_local_field_group($field_group);
+        }
+    }
+}

package/lib/wp-lib/src/api/nextpress_get_admin_bar.php

@@ -0,0 +1,260 @@
+<?php
+
+namespace Nextpress;
+
+use WP_Admin_Bar;
+use WP_Post;
+use WP_Error;
+use WP_Query;
+use WP_REST_Request;
+use WP_REST_Response;
+use WP_Rewrite;
+use WP_Scripts;
+use WP_Styles;
+
+add_action('rest_api_init', function() {
+    register_rest_route(
+        'nextpress/v1',
+        '/get-admin-bar/',
+        [
+            'methods' => 'GET',
+            'callback' => __NAMESPACE__ . '\handle_get_admin_bar_response',
+            'permission_callback' => __NAMESPACE__ . '\validate_get_admin_bar',
+            'args' => [
+                'user_id' => [
+                    'type' => 'integer',
+                    'required' => true,
+                    'sanitize_callback' => 'absint',
+                ],
+                'path' => [
+                    'type' => 'string',
+                    'required' => false,
+                    'sanitize_callback' => 'sanitize_text_field',
+                ]
+            ]
+        ]
+    );
+});
+
+/**
+ * Permission callback to validate the API key for the get-admin-bar REST route.
+ *
+ * This function ensures that requests to the admin bar endpoint are securely authenticated using server-to-server authentication. It verifies that the `Authorization: api-key <key>`
+ * header matches the expected `CROSS_CONTAINER_API_KEY` defined in the Docker environment.
+ *
+ * @since 1.0.0
+ * @access public
+ *
+ * @param WP_REST_Request $request The incoming REST API request object.
+ * @return bool|WP_Error Returns `true` if the API key is valid. Returns a `WP_Error` (401 status) if authorization fails.
+ */
+function validate_get_admin_bar(WP_REST_Request $request): bool | WP_Error {
+    $api_key = getenv_docker('CROSS_CONTAINER_API_KEY', '');
+    $auth_header = $request->get_header('Authorization');
+
+    $passed_key = '';
+    if (!empty($auth_header) && preg_match('/api-key\s(\S+)/', $auth_header, $matches)) {
+        $passed_key = $matches[1];
+    }
+
+    if (!\is_string($api_key) || empty($api_key) || !hash_equals($api_key, $passed_key)) {
+        return new WP_Error('rest_forbidden', __('Unauthorized API Key.'), ['status' => 401]);
+    }
+
+    return true;
+}
+
+/**
+ * Handles the GET request to generate and return the WordPress admin bar HTML and assets.
+ *
+ * This function acts as the primary callback for the `/nextpress/v1/get-admin-bar/` endpoint.
+ * Because REST API requests do not run the standard WordPress frontend loop, this function artificially constructs the main query (`WP_Query`), global objects, and context based
+ * on the provided `path`. This ensures that context-sensitive admin bar items (like "Edit Post") point to the correct URLs.
+ *
+ * ### API Endpoint Information
+ * - URL: `/wp-json/nextpress/v1/get-admin-bar/`
+ * - Method: `GET`
+ * - Auth Required: Yes (via `Authorization` header)
+ *
+ * ### Request Headers
+ * - `Authorization`: `api-key <CROSS_CONTAINER_API_KEY>`
+ *
+ * ### Request Parameters
+ * - `user_id` (integer|required): The ID of the authenticated user to generate the admin bar for.
+ * - `path` (string|optional): The frontend path/URL being viewed. Used to figure out the current queried object.
+ *
+ * ### Success Response
+ * - Code: 200 OK
+ * - Content:
+ * ```json
+ * {
+ *  "success": true,
+ *  "html": "<div id=\"wpadminbar\" class=\"...\">...</div>",
+ *  "assets": {
+ *      "css": {
+ *          "admin_bar": "[https://yoursite.com/wp-includes/css/admin-bar.min.css](https://yoursite.com/wp-includes/css/admin-bar.min.css)",
+ *          "dashicons": "[https://yoursite.com/wp-includes/css/dashicons.min.css](https://yoursite.com/wp-includes/css/dashicons.min.css)"
+ *      },
+ *      "js": {
+ *          "admin_bar": "[https://yoursite.com/wp-includes/js/admin-bar.min.js](https://yoursite.com/wp-includes/js/admin-bar.min.js)"
+ *      }
+ *  }
+ * }
+ * ```
+ *
+ * ### Error Responses
+ * - Code: 400 Bad Request (`Empty user`) - Missing or invalid `user_id` parameter.
+ * - Code: 401 Unauthorized (`rest_forbidden`) - Missing or invalid API key (handled by permission callback).
+ *
+ * @since 1.0.0
+ * @access public
+ *
+ * @param WP_REST_Request $request The incoming REST API request object containing the path and user_id.
+ * @return WP_REST_Response Response object containing success status, generated HTML, and required CSS/JS assets.
+ */
+function handle_get_admin_bar_response(WP_REST_Request $request): WP_REST_Response {
+
+    // STEP 1: Set Up Global Scope and Require Classes
+    // Because REST API requests do not run the standard frontend WordPress loop, many variables
+    // and classes needed to render the admin bar are missing. We bring in essential global variables.
+    global $post, $wp_admin_bar, $wp_query, $wp_the_query, $wp_styles, $wp_scripts, $wp_rewrite;
+
+    // The WP_Admin_Bar class might not be loaded in a REST API context, so we manually require it.
+    if (!class_exists('WP_Admin_Bar')) {
+        if (file_exists(ABSPATH . WPINC . '/class-wp-admin-bar.php')) {
+            require_once ABSPATH . WPINC . '/class-wp-admin-bar.php';
+        }
+    }
+
+    // STEP 2: Initialize Core WordPress Objects
+    // Check if the core globals exist. If they don't, create fresh instances.
+    // This establishes the foundation needed to simulate a normal page load.
+    $wp_admin_bar = new WP_Admin_Bar();
+
+    if (!($wp_query instanceof WP_Query)) {
+        $wp_query = new WP_Query();
+    }
+    if (!($wp_rewrite instanceof WP_Rewrite)) {
+        $wp_rewrite = new WP_Rewrite();
+    }
+    if (!($wp_styles instanceof WP_Styles)) {
+        $wp_styles = new WP_Styles();
+    }
+    if (!($wp_scripts instanceof WP_Scripts)) {
+        $wp_scripts = new WP_Scripts();
+    }
+
+    // STEP 3: Authenticate the User Context
+    /** @var string */
+    $user_id = $request->get_param('user_id');
+
+    if (!$user_id) {
+        return new WP_REST_Response(['success' => false, 'error' => 'Empty user'], 400);
+    }
+
+    // Force WordPress to recognize the request as coming from this specific user.
+    // This ensures the admin bar shows the correct personalized details and proper permission-based nodes.
+    wp_set_current_user(absint($user_id));
+
+    // STEP 4: Resolve the Requested Path
+    /** @var string */
+    $path = $request->get_param('path');
+    $full_url = home_url((string)$path);
+    $cleaned_path = trim((string)$path, '/');
+
+    // Try to map the provided URL path to a specific WordPress post or page ID.
+    $post_id = url_to_postid($full_url);
+    $query_vars = [];
+
+    if ($post_id) {
+        // If it finds a match, set up the internal query variables ('p' or 'page_id').
+        $target_post = get_post($post_id);
+        if ($target_post) {
+            $query_vars[$target_post->post_type === 'page' ? 'page_id' : 'p'] = $post_id;
+        }
+    } elseif ($cleaned_path === '') {
+        // If the path is empty, check the WordPress reading settings to determine if the homepage is a static page or the blog archive, and set the query variables accordingly.
+        $front_page_id = get_option('page_on_front');
+        if ($front_page_id > 0) {
+            $query_vars['page_id'] = $front_page_id;
+        } else {
+            $query_vars['is_home'] = 1;
+        }
+    }
+
+    // STEP 5: Run the Simulated Query
+    // @phpstan-ignore argument.type
+    $wp_query->parse_query($query_vars);
+    $posts = $wp_query->get_posts();
+
+    // STEP 6: Establish the "Queried Object" Context
+    // The WordPress admin bar relies heavily on knowing *what* is currently being viewed so it can
+    // generate contextual links like "Edit Page". We manually inspect the query results and populate context.
+    if ($wp_query->is_singular && !empty($posts)) {
+        $post = $posts[0];
+
+        $wp_query->queried_object = $post instanceof WP_Post ? $post : get_post($post);
+        $wp_query->queried_object_id = $post instanceof WP_post ? $post->ID : $post;
+    } elseif ($wp_query->is_archive || $wp_query->is_home) {
+        $wp_query->queried_object = $wp_query->get_queried_object();
+
+        if (isset($wp_query->queried_object->term_id)) {
+            $wp_query->queried_object_id = is_numeric($wp_query->queried_object->term_id) ? absint($wp_query->queried_object->term_id) : 0;
+        }
+    }
+
+    // STEP 7: Render and Capture the HTML
+    $admin_bar_html = '';
+
+    // Force the admin bar to display by adding a filter.
+    add_filter('show_admin_bar', '__return_true', 999);
+
+    // Initialize the standard admin bar hooks.
+    _wp_admin_bar_init();
+    do_action('admin_bar_init');
+
+    // Use output buffering to intercept and capture the HTML that wp_admin_bar_render() echoes directly.
+    ob_start();
+        wp_admin_bar_render();
+    $admin_bar_html = ob_get_clean();
+
+    // STEP 8: Extract Required Assets
+    // Load the default styles and scripts into the simulated queues so we can extract their direct URLs.
+    wp_default_styles($wp_styles);
+    wp_default_scripts($wp_scripts);
+
+    // Set fallback paths for the required CSS and JS assets.
+    $admin_bar_css = '/wp-includes/css/admin-bar.min.css';
+    $dashicons_css = '/wp-includes/css/dashicons.min.css';
+    $admin_bar_js  = '/wp-includes/js/admin-bar.min.js';
+
+    // If WordPress has dynamically registered these assets (e.g., they have a version string),
+    // extract their exact source URLs.
+    if (isset($wp_styles->registered['admin-bar']->src)) {
+        $admin_bar_css = $wp_styles->registered['admin-bar']->src;
+    }
+    if (isset($wp_styles->registered['dashicons']->src)) {
+        $dashicons_css = $wp_styles->registered['dashicons']->src;
+    }
+    if (isset($wp_scripts->registered['admin-bar']->src)) {
+        $admin_bar_js = $wp_scripts->registered['admin-bar']->src;
+    }
+
+    // Build an array of the absolute URLs to the required assets.
+    $assets = [
+        'css' => [
+            'admin_bar' => site_url((string)$admin_bar_css),
+            'dashicons' => site_url((string)$dashicons_css),
+        ],
+        'js' => [
+            'admin_bar' => site_url((string)$admin_bar_js),
+        ]
+    ];
+
+    // STEP 9: Return the Payload
+    return new WP_REST_Response([
+        'success' => true,
+        'html'    => $admin_bar_html,
+        'assets'  => $assets,
+    ], 200);
+}

package/lib/wp-lib/src/api/nextpress_validate_user_session.php

@@ -0,0 +1,114 @@
+<?php
+
+namespace Nextpress;
+
+use WP_Error;
+use WP_REST_Request;
+use WP_REST_Response;
+
+add_action('rest_api_init', function() {
+    register_rest_route(
+        'nextpress/v1',
+        '/validate-user-session/',
+        [
+            'methods' => 'GET',
+            'callback' => __NAMESPACE__ . '\handle_validate_user_session_response',
+            'permission_callback' => __NAMESPACE__ . '\validate_validate_user_session',
+            'args' => [
+                'user_hash' => [
+                    'type' => 'string',
+                    'required' => true,
+                    'sanitize_callback' => 'sanitize_text_field',
+                ]
+            ]
+        ]
+    );
+});
+
+/**
+ * Permission callback to validate the API key and the user session hash.
+ *
+ * This function intercepts the request before it reaches the main callback. It performs two critical security checks:
+ * 1. Server-to-Server Authentication: Verifies that the `Authorization: api-key <key>` header matches the expected `CROSS_CONTAINER_API_KEY` Docker environment variable.
+ * 2. Session Validation: Uses WordPress's native `wp_validate_auth_cookie()` to verify the provided `user_hash` parameter.
+ *
+ * If validation succeeds, it injects the `validated_user_id` parameter into the request object so it can be consumed by the main callback without re-querying the database.
+ *
+ * @since 1.0.0
+ * @access public
+ *
+ * @param WP_REST_Request $request The incoming REST API request object.
+ * @return bool|WP_Error Returns `true` if the API key and session hash are valid. Returns a `WP_Error` (401 status) if either check fails.
+ */
+function validate_validate_user_session(WP_REST_Request $request): bool | WP_Error {
+    $api_key = getenv_docker('CROSS_CONTAINER_API_KEY', '');
+    $auth_header = $request->get_header('Authorization');
+
+    $passed_key = '';
+    if (!empty($auth_header) && preg_match('/api-key\s(\S+)/', $auth_header, $matches)) {
+        $passed_key = $matches[1];
+    }
+
+    if (!\is_string($api_key) || empty($api_key) || !hash_equals($api_key, $passed_key)) {
+        return new WP_Error('rest_forbidden', __('Unauthorized API Key.'), ['status' => 401]);
+    }
+
+    $passed_hash = (string) (\is_scalar($request->get_param('user_hash')) ? $request->get_param('user_hash') : '');
+
+    $user_id = !empty($passed_hash)
+        ? wp_validate_auth_cookie($passed_hash, 'logged_in')
+        : wp_validate_auth_cookie('', 'logged_in');
+
+    if (!$user_id) {
+        return new WP_Error('rest_cookie_invalid', __('Invalid session hash.'), ['status' => 401]);
+    }
+
+    $request->set_param('validated_user_id', $user_id);
+
+    return true;
+}
+
+/**
+ * Handles the GET request for validating a user session hash.
+ *
+ * This function serves as the primary callback for the `/nextpress/v1/validate-user-session/` endpoint.
+ * It relies on the `validated_user_id` parameter, which is set by the `validate_validate_user_session` permission callback upon successful authentication.
+ *
+ * ### API Endpoint Information
+ * - URL: `/wp-json/nextpress/v1/validate-user-session/`
+ * - Method: `GET`
+ * - Auth Required: Yes (via `Authorization` header)
+ *
+ * ### Request Headers
+ * - `Authorization`: `api-key <CROSS_CONTAINER_API_KEY>`
+ *
+ * ### Request Parameters
+ * - `user_hash` (string): The hashed session cookie value to validate.
+ *
+ * ### Success Response
+ * - Code: 200 OK
+ * - Content: * ```json
+ * {
+ *  "success": true,
+ *  "user_id": 123
+ * }
+ * ```
+ *
+ * ### Error Responses (Handled by permission callback)
+ * - Code: 401 Unauthorized (`rest_forbidden`) - Missing or invalid API key.
+ * - Code: 401 Unauthorized (`rest_cookie_invalid`) - Invalid session hash.
+ *
+ * @since 1.0.0
+ * @access public
+ *
+ * @param WP_REST_Request $request The incoming REST API request object containing the `validated_user_id`.
+ * @return WP_REST_Response Response object containing the success status and the validated user ID.
+ */
+function handle_validate_user_session_response(WP_REST_Request $request): WP_REST_Response {
+    $user_id = $request->get_param('validated_user_id');
+
+    return new WP_REST_Response([
+        'success' => true,
+        'user_id' => $user_id
+    ], 200);
+}

package/lib/wp-lib/src/index.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Nextpress;
+
+\defined('ABSPATH') or die;
+
+require_once __DIR__ . '/api/nextpress_validate_user_session.php';
+require_once __DIR__ . '/api/nextpress_get_admin_bar.php';
+require_once __DIR__ . '/nextpress_save_path.php';
+require_once __DIR__ . '/nextpress_revalidate_frontend.php';
+require_once __DIR__ . '/nextpress_remove_menu_pages.php';
+require_once __DIR__ . '/nextpress_remove_comments.php';
+require_once __DIR__ . '/nextpress_disable_core_depency_updates.php';
+require_once __DIR__ . '/nextpress_dev_mailer_setup.php';
+require_once __DIR__ . '/theme.php';
+
+require_once __DIR__ . '/acf/acf.php';
+
+add_action('after_setup_theme', fn() => nextpress_setup_theme());
+
+add_action('after_switch_theme', fn() => nextpress_switch_theme());
+
+add_action('save_post', fn(int $_post_id, \WP_Post $post, bool $_update) => nextpress_save_post_path($post), 10, 3 );
+add_action('saved_term', fn(int $term_id, int $_tt_id, string $taxonomy) => nextpress_save_term_path($term_id, $taxonomy), 10, 3);
+
+add_action('admin_init', fn() => nextpress_revalidate_frontend());

package/lib/wp-lib/src/nextpress_dev_mailer_setup.php

@@ -0,0 +1,17 @@
+<?php
+
+add_action('phpmailer_init', function($phpmailer) {
+    if (WP_DEBUG) {
+        $phpmailer->isSMTP();
+        $phpmailer->Host       = 'mailpit';
+        $phpmailer->Port       = 1025;
+        $phpmailer->SMTPAuth   = false;
+        $phpmailer->From       = 'wordpress@test.local';
+        $phpmailer->FromName   = 'WordPress';
+    }
+});
+
+add_filter('wp_mail_from', function($_original_email_address) {
+    return 'wordpress@test.local';
+});
+

package/lib/wp-lib/src/nextpress_disable_core_depency_updates.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Nextpress;
+
+/**
+ * Block updates and notifications ONLY for WordPress Core and Secure Custom Fields.
+ * Allows translations, other plugins, and themes to update normally.
+ */
+
+add_filter('pre_site_transient_update_core', function($transient) {
+    if (!\is_object($transient)) {
+        $transient = new \stdClass();
+    }
+
+    if (property_exists($transient, 'updates')) {
+        $transient->updates = [];
+    }
+    if (property_exists($transient, 'response')) {
+        $transient->response = [];
+    }
+
+    return $transient;
+});
+
+// 2. Intercept Plugin update checks specifically for Secure Custom Fields
+add_filter('site_transient_update_plugins', function($transient) {
+    if (!\is_object($transient) || !isset($transient->response)) {
+        return $transient;
+    }
+
+    // The target slug for Secure Custom Fields
+    $scf_slug = 'secure-custom-fields/secure-custom-fields.php';
+
+    // If an update is waiting for SCF, strip it out of the notification loop
+    if (property_exists($transient, 'response') && is_array($transient->response) && isset($transient->response[$scf_slug])) {
+        unset($transient->response[$scf_slug]);
+    }
+
+    return $transient;
+});
+
+// 3. Block automatic background updates for Core and SCF
+add_filter('auto_update_core', '__return_false');
+add_filter('auto_update_plugin', function($update, $item) {
+    if (\is_object($item) && isset($item->plugin) && $item->plugin === 'advanced-custom-fields/acf.php') {
+        return false;
+    }
+    return $update;
+}, 10, 2);

package/lib/wp-lib/src/nextpress_remove_comments.php

@@ -0,0 +1,17 @@
+<?php
+
+add_action('init', 'nextpress_disable_comments_post_types_support');
+function nextpress_disable_comments_post_types_support(): void {
+    $post_types = get_post_types();
+    foreach ($post_types as $post_type) {
+        if (post_type_supports($post_type, 'comments')) {
+            remove_post_type_support($post_type, 'comments');
+            remove_post_type_support($post_type, 'trackbacks');
+        }
+    }
+}
+
+add_filter('comments_open', '__return_false', 20);
+add_filter('pings_open', '__return_false', 20);
+
+add_filter('comments_array', '__return_empty_array', 10);

package/lib/wp-lib/src/nextpress_remove_menu_pages.php

@@ -0,0 +1,32 @@
+<?php
+
+add_action('admin_menu', function() {
+    remove_menu_page('edit-comments.php');
+    remove_submenu_page('options-general.php', 'options-permalink.php');
+    remove_menu_page('themes.php');
+
+    // Create a brand new top-level menu item for Customize
+    add_menu_page(
+        'Customize',                           // Page title
+        'Customize',                           // Menu title
+        'edit_theme_options',                  // Capability required to see it
+        'customize.php',                       // Direct link to the Customizer
+        '',                                    // No function needed for an existing file
+        'dashicons-admin-appearance',          // Keeps the original brush icon from image_d5e315.png
+        60                                     // Positions it right where Appearance used to be
+    );
+});
+
+/* Hides the entire active theme control row in the Customizer */
+add_action('customize_controls_print_styles', function() {
+    ?>
+    <style>
+        #accordion-section-themes, #accordion-section-custom_css {
+            display: none !important;
+        }
+    </style>
+    <script>
+        document.title = "<?php echo esc_js(get_bloginfo('name')); ?>";
+    </script>
+    <?php
+});

package/lib/wp-lib/src/nextpress_revalidate_frontend.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Nextpress;
+
+/**
+ * Revalidates the Next.js frontend by pinging its API.
+ *
+ * * @return true|\WP_Error Returns true on success, or a WP_Error object on failure.
+ */
+function revalidate_frontend(): true|\WP_Error {
+    $nextjs_service_url = getenv_docker('NEXTJS_SERVICE_URL', '');
+    $api_key = getenv_docker('CROSS_CONTAINER_API_KEY', '');
+
+    if (!$nextjs_service_url || !\is_scalar($nextjs_service_url) || !\is_scalar($api_key)) {
+        return new \WP_Error(
+            'missing_credentials',
+            'Next.js service URL or API key is missing or invalid.'
+        );
+    }
+
+    $response = wp_remote_post($nextjs_service_url . '/api/revalidate', [
+        'headers' => [
+            'Authorization' => 'api-key ' . $api_key,
+            'Content-Type' => 'application/json'
+        ]
+    ]);
+
+    if (is_wp_error($response)) {
+        return $response;
+    }
+
+    $status_code = wp_remote_retrieve_response_code($response);
+
+    if ($status_code !== 200) {
+        $error_message = wp_remote_retrieve_response_message($response);
+        return new \WP_Error(
+            'http_response_error',
+            sprintf('Next.js API returned status code %d: %s', $status_code, $error_message),
+            ['status_code' => $status_code]
+        );
+    }
+
+    return true;
+}
+
+/**
+ * Triggers the frontend revalidation and logs any errors that occur.
+ *
+ * @return void
+ */
+function nextpress_revalidate_frontend(): void {
+    $revalidated = revalidate_frontend();
+
+    if (is_wp_error($revalidated)) {
+        error_log($revalidated->get_error_message());
+    }
+}