Skip to content

Commit 4a0d1ea

Browse files
valendesignsvalendesigns
authored
Merge pull request #10 from WP-API/review-fixes
Review fixes
2 parents 8de86a3 + 8221c92 commit 4a0d1ea

13 files changed

+100
-124
lines changed

‎.dev-lib

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
DEFAULT_BASE_BRANCH=develop
2-
PHPCS_IGNORE='vendor/*,wp-includes/rest-api/auth/jwt/*,tests/wp-tests/*'
2+
PHPCS_IGNORE='vendor/*,wp-includes/php-jwt/*,tests/wp-tests/*'
33
CHECK_SCOPE=patches

‎.phpcs.ruleset.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<!-- Ignoring Files and Folders:
1111
https://github.com/squizlabs/PHP_CodeSniffer/wiki/Advanced-Usage#ignoring-files-and-folders -->
1212
<exclude-pattern>/vendor/*</exclude-pattern>
13-
<exclude-pattern>/wp-includes/rest-api/auth/jwt/*</exclude-pattern>
13+
<exclude-pattern>/wp-includes/php-jwt/*</exclude-pattern>
1414
<exclude-pattern>/tests/wp-tests/*</exclude-pattern>
1515

1616
<!-- How to scan -->

‎.travis.yml

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,7 @@
1-
# Tell Travis CI we're using PHP
21
language: php
32

4-
# Opt to use Travis container-based environment.
53
sudo: false
64

7-
# Newer versions like trusty don't have PHP 5.2 or 5.3
8-
# https://blog.travis-ci.com/2017-07-11-trusty-as-default-linux-is-coming
9-
dist: precise
10-
115
notifications:
126
email:
137
on_success: never
@@ -19,6 +13,11 @@ cache:
1913
- vendor
2014
- $HOME/phpunit-bin
2115

16+
addons:
17+
apt:
18+
packages:
19+
- libxml2-utils
20+
2221
php:
2322
- 7.2
2423

‎composer.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"license": "GPLv2",
77
"prefer-stable" : true,
88
"require": {
9-
"php": ">=5.3"
9+
"php": ">=5.6.20"
1010
},
1111
"require-dev": {
1212
"brainmaestro/composer-git-hooks": "^2.6.0",
@@ -16,7 +16,7 @@
1616
"php-coveralls/php-coveralls": "^2.1",
1717
"slowprog/composer-copy-file": "0.2.1",
1818
"wp-coding-standards/wpcs": "*",
19-
"xwp/wp-dev-lib": "^1.0.0"
19+
"xwp/wp-dev-lib": "^1.1.1"
2020
},
2121
"scripts": {
2222
"phpcs": [
@@ -48,7 +48,7 @@
4848
"extra": {
4949
"copy-file": {
5050
"tests/autoload.php": "tests/wp-tests/phpunit/wp-tests-config.php",
51-
"vendor/firebase/php-jwt/src/": "wp-includes/rest-api/auth/jwt/"
51+
"vendor/firebase/php-jwt/src/": "wp-includes/php-jwt/"
5252
},
5353
"hooks": {
5454
"pre-commit": "./vendor/xwp/wp-dev-lib/scripts/pre-commit"

‎jwt-auth.php

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,15 @@
2626
define( 'JWT_AUTH_VERSION', '0.1' );
2727

2828
/**
29-
* Requires running PHP 5.3 or above.
29+
* Requires running PHP 5.6.20 or above.
3030
*
3131
* @since 0.1
3232
* @codeCoverageIgnore
3333
*/
3434
function jwt_auth_version_check() {
35-
36-
if ( version_compare( PHP_VERSION, '5.3', '<' ) ) {
35+
if ( version_compare( PHP_VERSION, '5.6.20', '<' ) ) {
3736
deactivate_plugins( plugin_basename( __FILE__ ) );
38-
wp_die( esc_html__( 'The JWT Auth plugin requires PHP Version 5.3 or above.', 'jwt-auth' ) );
37+
wp_die( esc_html__( 'The JWT Auth plugin requires PHP Version 5.6.20 or above.', 'jwt-auth' ) );
3938
}
4039
}
4140
add_action( 'admin_init', 'jwt_auth_version_check' );
@@ -47,18 +46,18 @@ function jwt_auth_version_check() {
4746
*/
4847
function jwt_auth_loader() {
4948

50-
/** JWT Classes */
51-
foreach ( glob( JWT_AUTH_PLUGIN_DIR . '/wp-includes/rest-api/auth/jwt/*.php' ) as $filename ) {
49+
// JWT Classes.
50+
foreach ( glob( JWT_AUTH_PLUGIN_DIR . '/wp-includes/php-jwt/*.php' ) as $filename ) {
5251
require_once $filename;
5352
}
5453

55-
/** WP_REST_Token Class */
54+
// WP_REST_Token Class.
5655
require_once JWT_AUTH_PLUGIN_DIR . '/wp-includes/rest-api/auth/class-wp-rest-token.php';
5756

58-
/** WP_REST_Key_Pair Class */
57+
// WP_REST_Key_Pair Class.
5958
require_once JWT_AUTH_PLUGIN_DIR . '/wp-includes/rest-api/auth/class-wp-rest-key-pair.php';
6059

61-
/** WP_Key_Pair_List_Table Class */
60+
// WP_Key_Pair_List_Table Class.
6261
require_once JWT_AUTH_PLUGIN_DIR . '/wp-admin/includes/class-wp-key-pair-list-table.php';
6362

6463
// Initialize JSON Web Tokens.

‎phpunit.xml.dist

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,20 @@
66
convertNoticesToExceptions="true"
77
convertWarningsToExceptions="true"
88
>
9-
<php>
10-
<const name="WP_TEST_VIP_QUICKSTART_ACTIVATED_PLUGINS" value="jetpack/jetpack.php,media-explorer/media-explorer.php,writing-helper/writing-helper.php,mrss/mrss.php,wordpress-importer/wordpress-importer.php,keyring/keyring.php,polldaddy/polldaddy.php" />
11-
<const name="WPCOM_VIP_DISABLE_REMOTE_REQUEST_ERROR_REPORTING" value="1" />
12-
<const name="WP_TEST_ACTIVATED_PLUGINS" value="" /> <!-- this list is used if not on VIP Quickstart -->
13-
</php>
149
<testsuites>
1510
<testsuite>
1611
<directory prefix="class-test-" suffix=".php">./tests/</directory>
1712
<directory prefix="test-" suffix=".php">./tests/</directory>
1813
</testsuite>
1914
</testsuites>
20-
2115
<filter>
2216
<whitelist processUncoveredFilesFromWhitelist="false">
2317
<directory suffix=".php">./</directory>
2418
<exclude>
2519
<directory suffix=".php">./coverage</directory>
2620
<directory suffix=".php">./tests</directory>
2721
<directory suffix=".php">./vendor</directory>
28-
<directory suffix=".php">./wp-includes/rest-api/auth/jwt</directory>
22+
<directory suffix=".php">./wp-includes/php-jwt</directory>
2923
</exclude>
3024
</whitelist>
3125
</filter>

‎tests/autoload.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,19 @@
88
$config = getenv( 'WP_TESTS_CONFIG' );
99

1010
/**
11-
* Supports loading the wp-tests-config.php from a non VVV custom directory.
11+
* Supports loading the `wp-tests-config.php` from a custom directory.
1212
*/
1313
if ( file_exists( $config ) ) {
1414
include_once $config;
1515
return;
1616
}
1717

18-
// VVV Paths.
18+
// Attempt to find the server Path.
1919
$_path = dirname( __FILE__ );
2020
$config = substr( $_path, 0, strpos( $_path, 'public_html' ) + 11 ) . '/wp-tests-config.php';
2121

2222
/**
23-
* Supports loading the wp-tests-config.php from the `public_html` root directory of both the
24-
* `wordpress-default` and `wordpress-develop` sites, and any other custom site in the www directory.
23+
* Loads the `wp-tests-config.php` from the `public_html` root directory of a typical Vagrant install.
2524
*/
2625
if ( file_exists( $config ) ) {
2726
include_once $config;

‎wp-includes/rest-api/auth/jwt/BeforeValidException.php renamed to ‎wp-includes/php-jwt/BeforeValidException.php

File renamed without changes.

‎wp-includes/rest-api/auth/jwt/ExpiredException.php renamed to ‎wp-includes/php-jwt/ExpiredException.php

File renamed without changes.

‎wp-includes/rest-api/auth/jwt/JWT.php renamed to ‎wp-includes/php-jwt/JWT.php

File renamed without changes.

‎wp-includes/rest-api/auth/jwt/SignatureInvalidException.php renamed to ‎wp-includes/php-jwt/SignatureInvalidException.php

File renamed without changes.

‎wp-includes/rest-api/auth/class-wp-rest-key-pair.php

Lines changed: 52 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -85,78 +85,60 @@ public static function get_rest_uri() {
8585
*/
8686
public function register_routes() {
8787
$args = array(
88-
array(
89-
'methods' => WP_REST_Server::CREATABLE,
90-
'callback' => array(
91-
$this,
92-
'generate_key_pair',
88+
'methods' => WP_REST_Server::CREATABLE,
89+
'callback' => array( $this, 'generate_key_pair' ),
90+
'args' => array(
91+
'name' => array(
92+
'description' => esc_html__( 'The name of the key-pair.', 'jwt-auth' ),
93+
'type' => 'string',
94+
'required' => true,
95+
'sanitize_callback' => 'sanitize_text_field',
96+
'validate_callback' => 'rest_validate_request_arg',
9397
),
94-
'args' => array(
95-
'name' => array(
96-
'description' => esc_html__( 'The name of the key-pair.', 'jwt-auth' ),
97-
'type' => 'string',
98-
'required' => true,
99-
'sanitize_callback' => 'sanitize_text_field',
100-
'validate_callback' => 'rest_validate_request_arg',
101-
),
102-
'user_id' => array(
103-
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
104-
'type' => 'integer',
105-
'required' => true,
106-
'sanitize_callback' => 'absint',
107-
'validate_callback' => 'rest_validate_request_arg',
108-
),
98+
'user_id' => array(
99+
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
100+
'type' => 'integer',
101+
'required' => true,
102+
'sanitize_callback' => 'absint',
103+
'validate_callback' => 'rest_validate_request_arg',
109104
),
110105
),
111-
'schema' => array(
112-
$this,
113-
'get_item_schema',
114-
),
106+
'schema' => array( $this, 'get_item_schema' ),
115107
);
116108
register_rest_route( self::_NAMESPACE_, '/' . self::_REST_BASE_ . '/(?P<user_id>[\d]+)', $args );
117109

118110
$args = array(
119-
array(
120-
'methods' => WP_REST_Server::DELETABLE,
121-
'callback' => array(
122-
$this,
123-
'delete_all_key_pairs',
124-
),
125-
'args' => array(
126-
'user_id' => array(
127-
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
128-
'type' => 'integer',
129-
'required' => true,
130-
'sanitize_callback' => 'absint',
131-
'validate_callback' => 'rest_validate_request_arg',
132-
),
111+
'methods' => WP_REST_Server::DELETABLE,
112+
'callback' => array( $this, 'delete_all_key_pairs' ),
113+
'args' => array(
114+
'user_id' => array(
115+
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
116+
'type' => 'integer',
117+
'required' => true,
118+
'sanitize_callback' => 'absint',
119+
'validate_callback' => 'rest_validate_request_arg',
133120
),
134121
),
135122
);
136123
register_rest_route( self::_NAMESPACE_, '/' . self::_REST_BASE_ . '/(?P<user_id>[\d]+)/revoke-all', $args );
137124

138125
$args = array(
139-
array(
140-
'methods' => WP_REST_Server::DELETABLE,
141-
'callback' => array(
142-
$this,
143-
'delete_key_pair',
126+
'methods' => WP_REST_Server::DELETABLE,
127+
'callback' => array( $this, 'delete_key_pair' ),
128+
'args' => array(
129+
'user_id' => array(
130+
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
131+
'type' => 'integer',
132+
'required' => true,
133+
'sanitize_callback' => 'absint',
134+
'validate_callback' => 'rest_validate_request_arg',
144135
),
145-
'args' => array(
146-
'user_id' => array(
147-
'description' => esc_html__( 'The ID of the user.', 'jwt-auth' ),
148-
'type' => 'integer',
149-
'required' => true,
150-
'sanitize_callback' => 'absint',
151-
'validate_callback' => 'rest_validate_request_arg',
152-
),
153-
'api_key' => array(
154-
'description' => esc_html__( 'The API key being revoked.', 'jwt-auth' ),
155-
'type' => 'string',
156-
'required' => true,
157-
'sanitize_callback' => 'sanitize_text_field',
158-
'validate_callback' => 'rest_validate_request_arg',
159-
),
136+
'api_key' => array(
137+
'description' => esc_html__( 'The API key being revoked.', 'jwt-auth' ),
138+
'type' => 'string',
139+
'required' => true,
140+
'sanitize_callback' => 'sanitize_text_field',
141+
'validate_callback' => 'rest_validate_request_arg',
160142
),
161143
),
162144
);
@@ -279,6 +261,10 @@ public function after_password_reset( WP_User $user ) {
279261
/**
280262
* Fires after the user's password is reset.
281263
*
264+
* When a user resets their password this method will deleted all of
265+
* the application passwords associated with their account. In turn
266+
* this will renders all JSON Web Tokens invalid for their account
267+
*
282268
* @param int $user_id The user ID.
283269
*/
284270
public function profile_update( $user_id ) {
@@ -317,7 +303,9 @@ public function require_token( $require_token, $request_uri, $request_method ) {
317303
* Authenticate the key-pair if API key and API secret is provided and return the user.
318304
*
319305
* If not authenticated, send back the original $user value to allow other authentication
320-
* methods to attempt authentication.
306+
* methods to attempt authentication. If the initial value of `$user` is false this method
307+
* will return a `WP_User` object on success or a `WP_Error` object on failure. However,
308+
* if the value is not `false` it will return that value, which could be any type of object.
321309
*
322310
* @filter rest_authentication_user
323311
*
@@ -394,6 +382,11 @@ public function authenticate( $user, WP_REST_Request $request ) {
394382
/**
395383
* Filters the JWT Payload.
396384
*
385+
* Due to the fact that `$user` could have been filtered the object type is technically
386+
* unknown. However, likely a `WP_User` object if auth has not been filtered. In any
387+
* case, the object must have the `$user->data->api_key` property in order to connect
388+
* the API key to the JWT payload and allow for token invalidation.
389+
*
397390
* @filter rest_authentication_token_private_claims
398391
*
399392
* @param array $payload The payload used to generate the token.

‎wp-includes/rest-api/auth/class-wp-rest-token.php

Lines changed: 26 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -89,43 +89,35 @@ public static function get_rest_uri() {
8989
*/
9090
public function register_routes() {
9191
$args = array(
92-
array(
93-
'methods' => WP_REST_Server::CREATABLE,
94-
'callback' => array(
95-
$this,
96-
'generate_token',
92+
'methods' => WP_REST_Server::CREATABLE,
93+
'callback' => array( $this, 'generate_token' ),
94+
'args' => array(
95+
'username' => array(
96+
'description' => __( 'The username of the user; requires also setting the password argument.', 'jwt-auth' ),
97+
'type' => 'string',
98+
'sanitize_callback' => 'sanitize_user',
99+
'validate_callback' => 'rest_validate_request_arg',
97100
),
98-
'args' => array(
99-
'username' => array(
100-
'description' => __( 'The username of the user; requires also setting the password argument.', 'jwt-auth' ),
101-
'type' => 'string',
102-
'sanitize_callback' => 'sanitize_user',
103-
'validate_callback' => 'rest_validate_request_arg',
104-
),
105-
'password' => array(
106-
'description' => __( 'The password of the user; requires also setting the username argument.', 'jwt-auth' ),
107-
'type' => 'string',
108-
'sanitize_callback' => 'sanitize_text_field',
109-
'validate_callback' => 'rest_validate_request_arg',
110-
),
111-
'api_key' => array(
112-
'description' => __( 'The API key of the user; requires also setting the api_secret.', 'jwt-auth' ),
113-
'type' => 'string',
114-
'sanitize_callback' => 'sanitize_text_field',
115-
'validate_callback' => 'rest_validate_request_arg',
116-
),
117-
'api_secret' => array(
118-
'description' => __( 'The API secret of the user; requires also setting the api_key.', 'jwt-auth' ),
119-
'type' => 'string',
120-
'sanitize_callback' => 'sanitize_text_field',
121-
'validate_callback' => 'rest_validate_request_arg',
122-
),
101+
'password' => array(
102+
'description' => __( 'The password of the user; requires also setting the username argument.', 'jwt-auth' ),
103+
'type' => 'string',
104+
'sanitize_callback' => 'sanitize_text_field',
105+
'validate_callback' => 'rest_validate_request_arg',
106+
),
107+
'api_key' => array(
108+
'description' => __( 'The API key of the user; requires also setting the api_secret.', 'jwt-auth' ),
109+
'type' => 'string',
110+
'sanitize_callback' => 'sanitize_text_field',
111+
'validate_callback' => 'rest_validate_request_arg',
112+
),
113+
'api_secret' => array(
114+
'description' => __( 'The API secret of the user; requires also setting the api_key.', 'jwt-auth' ),
115+
'type' => 'string',
116+
'sanitize_callback' => 'sanitize_text_field',
117+
'validate_callback' => 'rest_validate_request_arg',
123118
),
124119
),
125-
'schema' => array(
126-
$this,
127-
'get_item_schema',
128-
),
120+
'schema' => array( $this, 'get_item_schema' ),
129121
);
130122
register_rest_route( self::_NAMESPACE_, '/' . self::_REST_BASE_, $args );
131123
}

0 commit comments

Comments
 (0)