kate522
8c5b1555c9
Move all domain folders from src/AKSRT/{Domain} to src/{Domain}; remap
Composer PSR-4 "AKSRT\\": "src/"; update audit script + README + ADR
paths; remove dead tools/build-psr4-map.php (scanned deleted inc/classes).
75 lines
2.7 KiB
PHP
75 lines
2.7 KiB
PHP
<?php
|
|
/**
|
|
* Identity provider callback endpoints.
|
|
*
|
|
* @package AKSRT
|
|
*/
|
|
|
|
namespace AKSRT\Identity;
|
|
|
|
use AKSRT\Identity\Provider\ProviderFactory;
|
|
|
|
defined('ABSPATH') || exit;
|
|
|
|
final class CallbackController {
|
|
|
|
private const NS = 'aksrt/v1';
|
|
|
|
public function register_routes(): void {
|
|
foreach (['aliyun', 'tencent'] as $provider) {
|
|
register_rest_route(self::NS, '/identity/callback/' . $provider, [
|
|
'methods' => $provider === 'aliyun' ? ['GET', 'POST'] : 'POST',
|
|
'callback' => function (\WP_REST_Request $request) use ($provider): \WP_REST_Response {
|
|
return $this->handle($provider, $request);
|
|
},
|
|
'permission_callback' => '__return_true',
|
|
]);
|
|
}
|
|
}
|
|
|
|
private function handle(string $provider_key, \WP_REST_Request $request): \WP_REST_Response {
|
|
$body = $request->get_body();
|
|
if (strlen($body) > 1024 * 1024) {
|
|
return new \WP_REST_Response(['success' => false], 413);
|
|
}
|
|
$provider = ProviderFactory::make($provider_key);
|
|
if (!$provider->verify_callback($request)) {
|
|
return new \WP_REST_Response(['success' => false], 403);
|
|
}
|
|
$result = $provider->parse_callback($request);
|
|
$session = sanitize_text_field((string) ($result->data['provider_session_id'] ?? ''));
|
|
$outer_order = sanitize_text_field((string) ($result->data['outer_order_no'] ?? ''));
|
|
if ($session === '' && $outer_order === '') {
|
|
return new \WP_REST_Response(['success' => false], 422);
|
|
}
|
|
|
|
global $wpdb;
|
|
$table = \AKSRT\Core\DBMigrator::table('identity_application');
|
|
if ($session !== '') {
|
|
$row = $wpdb->get_row($wpdb->prepare(
|
|
"SELECT * FROM {$table} WHERE provider = %s AND provider_session_id = %s ORDER BY id DESC LIMIT 1",
|
|
$provider_key,
|
|
$session
|
|
), ARRAY_A);
|
|
} else {
|
|
$row = $wpdb->get_row($wpdb->prepare(
|
|
"SELECT * FROM {$table} WHERE provider = %s AND application_uuid = %s ORDER BY id DESC LIMIT 1",
|
|
$provider_key,
|
|
$outer_order
|
|
), ARRAY_A);
|
|
}
|
|
if (!is_array($row)) {
|
|
return new \WP_REST_Response(['success' => false], 404);
|
|
}
|
|
|
|
// The callback only wakes server-side reconciliation. A provider query
|
|
// remains the source of truth for a successful identity decision.
|
|
$service = new ApplicationService();
|
|
$response = $service->refresh($row);
|
|
if (is_wp_error($response)) {
|
|
return new \WP_REST_Response(['success' => false], 409);
|
|
}
|
|
return new \WP_REST_Response(['success' => true]);
|
|
}
|
|
}
|